said by Link Logger :

(CAS is actually kind of cool as you can white list what your app can do such that any exceptions are flagged, handy if your using a third party dll that you don't trust, so white list what it can do and anything else it does and CAS raises an exception and stops the app cold).

• select a White Listed .dll (ver.dll)

• modify a copy of ver.dll and place on a USB drive

• attempt to copy/overwrite ver.dll

And, as a side note – the methods described in this paper are not restricted only for the
.NET Framework, but can also be applied to other VM based platforms, such as Java.

Surprisingly, it was found during this research that the modified DLL can be directly
copied to the correct location at the file system, because the SN mechanism does not
check the actual signature of a loaded DLL but blindly loads the DLL based on
the directory name with the corresponding signature name!
It is important to mention that this technique does not requires "full trust"
permissions, which further proves the fact that the GAC / CAS protection
mechanisms are broken

said by whitepaper :

---

It is important to mention that the technique described in this paper is considered as a post exploitation type attack! Such attacks are usually deployed after an attacker has managed to penetrate a system (using some other attack) and want to leave backdoors and rootkits behind, for further exploitation. In other words, changing the Framework requires administrator level privileges.

And, although it goes without saying - you must have administrator level permissions to overwrite the DLL, since this is a post exploitation attack…

---