# [Fixed] A vulnerability in KAVKIS 2020 products family allows full disabling of protection

Kaspersky Internet Security 2020 allowed DLL injection via SetWindowsHookEx using tiptsf.dll, letting an unprivileged attacker hook WinAPIs and disable antivirus protection.

- Payout: hidden
- Severity: high
- Program: Kaspersky
- Found by: abbadeed
- Disclosed: 2021-03-31
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/870615
- Library page: https://bugbountylibrary.com/r/h1%3A870615
- Tags: area:os domain:desktop impact:integrity impact:privesc kind:bounty platform:hackerone sev:high tech:windows technique:reverse-engineering vuln:auth-bypass vuln:privilege-escalation

**Target:** avpui.exe GUI process of Kaspersky Internet Security 2020
**Root cause:** ClientLoadLibrary hook blocked most DLL injection but allowed DLLs with specific filenames (tiptsf.dll) through, permitting SetWindowsHookEx-based injection into avpui.exe.
**Steps:**
1. `FindWindow` to get hwnd of avpui.exe
2. Call `SetWindowsHookEx` injecting a DLL named `tiptsf.dll` to bypass ClientLoadLibrary filter
3. Hook `TrackPopupMenu` and send a popup via `PostMessage`
4. Self-protection spawns new avpui.exe and a confirmation Dialog; injected DLL propagates
5. In new avpui.exe hook `IsDialogMessageW` and substitute the OK-button click message
6. Download and run ransomware after protection disabled
**How found:** Researcher noticed ClientLoadLibrary hook blocked injection generally but specific DLL filenames like tiptsf.dll slipped through, then explored hooking GUI message APIs to bypass the confirmation dialog.
**Exploitation:** Unprivileged attacker injects DLL into avpui.exe via SetWindowsHookEx using whitelisted filename tiptsf.dll, hooks TrackPopupMenu and IsDialogMessageW to auto-confirm the self-protection dialog, then hooks WinAPIs to disable antivirus before running ransomware.
**Escalation:** Chained GUI message hooking to auto-approve the self-protection confirmation dialog, then disabling AV to enable ransomware execution.
**Insight:** When a security product filters DLL injection by filename, look for allowlisted system DLL names (e.g. tiptsf.dll) that bypass the check; also target GUI confirmation dialogs via message-hooking APIs like IsDialogMessageW to auto-approve self-protection prompts.