Shimming Attack Definition

A shimming attack is a technique that abuses software shims to intercept or modify how an application interacts with the operating system. A software shim is a legitimate compatibility layer that helps older applications run on newer systems by intercepting API calls and adjusting their behavior.

Attackers can exploit this mechanism by installing or modifying a shim to monitor data, alter application behavior, execute unauthorized code, or bypass security controls while allowing the application to continue running normally.

How Shimming Attacks Work

A shimming attack begins when an attacker gains the ability to install or register a malicious shim on a system. When the targeted application starts, it loads the shim before communicating with the operating system.

The shim intercepts API calls between the application and the operating system. It can inspect, modify, or redirect those calls before forwarding them, allowing the application to continue functioning normally while the malicious code operates in the background. Depending on the attacker's objective, the shim may capture sensitive information, alter program behavior, or help execute additional malicious code.

Examples of Shimming Attacks

• Credential theft: A malicious shim can intercept API calls used to process usernames, passwords, or authentication tokens before they are protected or sent to another component.
• Application tampering: Attackers may modify how an application behaves by intercepting API calls, allowing security checks or restrictions to be bypassed without changing the application's original code.
• Malware persistence: Some malware uses compatibility shims to ensure malicious code loads automatically when a legitimate application starts.
• Security control bypass: A malicious shim may alter or suppress application behavior to interfere with logging, monitoring, or other security features.

Risks of Shimming Attacks

• Data interception: Attackers may capture sensitive information such as login credentials, payment details, or personal data.
• Malware distribution: Shims can inject malicious code into legitimate applications or system processes.
• Stealthy operation: Because the application continues functioning normally, these attacks can be difficult to detect.
• System compromise: Intercepting system calls can allow attackers to manipulate processes or bypass security controls.
• Privilege escalation: In some cases, attackers may use shimming techniques to gain higher levels of system access.

How to Reduce the Risk of Shimming Attacks

• Use trusted software sources and verify digital signatures where possible.
• Install security updates to reduce vulnerabilities that attackers could use to deploy malicious code.
• Limit administrative access to reduce the ability to install or modify shims.
• Use application allowlisting or code-signing policies to restrict unauthorized code.
• Detect unexpected changes to application behavior, compatibility settings, or loaded modules.

Read More

• What Is a Man-in-the-Middle Attack?
• What Is Anti-Malware?
• What Is a Network Intrusion Prevention System?

FAQ