Hacker News new | ask | show | jobs
by pjc50 532 days ago
Anyone naming their DLL with random hex digits is definitely up to no good.
1 comments

It's a very common security technique to avoid being targeted by malware. I believe even the Microsoft KSLDriver drops randomly named DLL and device drivers along with creating a randomly named system service. Uses 8 hex characters.

Several third-party vendors use the same technique, mostly security vendors.

I'm the engineer who spearheaded adding the blocking technique outlined by OP. Security vendors are some of the worst offenders when it comes to injecting buggy DLLs into processes.
A brilliant idea, maybe all software should block DLL without English names. Could even incorporate the new technique into the operating system.