Hacker News new | ask | show | jobs
by Randor 528 days ago
It's a very common security technique to avoid being targeted by malware. I believe even the Microsoft KSLDriver drops randomly named DLL and device drivers along with creating a randomly named system service. Uses 8 hex characters.

Several third-party vendors use the same technique, mostly security vendors.

1 comments

I'm the engineer who spearheaded adding the blocking technique outlined by OP. Security vendors are some of the worst offenders when it comes to injecting buggy DLLs into processes.
A brilliant idea, maybe all software should block DLL without English names. Could even incorporate the new technique into the operating system.