Patent Application
20150113644
The present disclosure relates to a method for protecting computer systems from malware infection. More particularly, an exemplary embodiment relates to the detection and prevention of the malware infection carried out via attacks known as “Exploitation attacks”.
Malware creators always look for ways to circumvent protections provided to computer systems, in order to deploy a so-called “malware” to computer systems, from which it can develop and infiltrate other subsystems. While different malware has different targets, the general-purpose is most often to extract unbeknownst to the computer user, information that has value for the malware developer, such as axis information to financial organizations, passwords and other personal information.
Since for the successful delivery of malware to a computer system the user of the system must not be aware that the deployment process is taking place, attackers often use apparently harmless websites for this purpose. One example is when a user is browsing in apparently legitimate website, which displays an advertisement, and another could be, for instance, allowing to download a brochure. When the brochure is downloaded, the PDF reader opens the PDF file, which is not a legitimate file but rather primes activities which are unusual for the reader, which includes downloading and executing a malicious file from the web. This process is known as “Drive by Download”. It can be performed using a variety of readers and players, typically running files such as Java, PDF and Flash. It can also be targeting the browser itself. Such process can be performed singularly, or may be a part of a so-called “Exploit Kit”, which is a “shrink-wrapped” system which can attempt several (sometimes dozens) of different exploits per the victim's OS, browser and plugin inventory, in order to maximize the likelihood of the victim being exploited.
In order to further illustrate the activities taking place inside the Adobe Reader process as it processes the (malicious) PDF file, the following is a typical exploitation flow:
Finally, the exploit code runs the newly created file (e.g. in Windows by invoking CreateProcess Windows API).
The present disclosure may provide means to detect an Exploit attempt, so as to be able to alert the user of its existence. In addition, various embodiments may provide means to prevent Exploit attempts.
Other objects and advantages will become apparent as the description proceeds.
An Agent for detecting and/or preventing an Exploit attack, comprises:
According to an embodiment, the process element consists of readers, players, browsers and the like software elements capable of initiating a process. According to another embodiment, the Agent is suitable to intercept the creation of a process. The interception of process creation can be performed, for instance, by one or more of the following:
In one embodiment, the Agent is suitable to inspect a process about to be created, e.g., by looking at the originating process and determining whether it is one susceptible of attack. Illustrative examples of processes to which an exemplary embodiment refer include those that originate from one of a browser, a viewer or a player.
In another embodiment, the inspection of the process about to be created is carried out by looking at one or more of the following:
The Agent of an exemplary embodiment can also be provided with a blacklist and/or whitelist of process images. In some embodiments, the Agent is suitable to determine whether the launched process is used to launch/register another process and thereby to carry out the inspection of the process about to be created not on the process itself but, instead, on its target argument. The means for performing preventive activities may include software and the preventive activities may include generating an alert, either to the user or to a remote location.
An exemplary embodiment also encompasses a method for the detection and/or prevention of an Exploit attack, comprising:
According to an embodiment, the method of comprises intercepting the creation of a process, e.g., by one or more of the following:
In an embodiment, the method comprises inspecting a process about to be created, e.g., by looking at one or more of:
In the drawings:
Moreover, the software (e.g., PDF reader, player, clients, and the like) described herein may run on a network-enabled computer system and/or device which may include, but is not limited to: e.g., any computer device, or communications device including, e.g., a server, a network appliance, a personal computer (PC), a workstation, a mobile device, a phone, a handheld PC, a personal digital assistant (PDA), a thin client, a fat client, an Internet browser, or other device. The network-enabled computer systems may execute one or more software applications to, for example, receive data as input from an entity accessing the network-enabled computer system, process received data, transmit data over a network, and receive data over a network. The network-enabled computer systems may further include data storage. The data storage of the network-enabled computer systems may include electronic information, files, and documents stored in various ways, including, for example, a flat file, indexed file, hierarchical database, relational database, such as a database created and maintained with software from, for example, Oracle® Corporation, Microsoft® Excel file, Microsoft® Access file, or any other storage mechanism.
The process starts with a user surfing the web and reaching a page, generally indicated by numeral 1, which displays an advertisement 2. Clicking on the advertisement downloads a PDF file 3 (which can be disguised, for instance, as a brochure). When the PDF file is read by reader 4, it causes the reader 4 to access the web (generally indicated by numeral 5 and to download a malicious file 6. The reader 4 then causes the file 6 to be executed.
According to an exemplary embodiment this Exploit is detected and/or prevented, by providing an Agent in the user's system, which monitors the behavior of process elements, such as readers, players and browsers, and intervenes, either by generating an alert or by stopping the process, when a reader or player initiates a “create process” operation. For the purposes of this description a “process element” refers to any software that is capable of initiating a process. Software, as referred to herein, may refer to non-transitory computer-readable media that when executed on a computer, causes the computer to perform steps defined in the software. In many cases it is legitimate for such a process element to initiate a create process operation, and it is desirable to whitelist such legitimate cases. However, a small number of false positive responses (i.e., alerts that a potential Exploit situation is happening while the operation triggering this alert is legitimate) is acceptable, taking into account the severity of the outcome of such an attack.
In order to carry out an exemplary embodiment appropriate software must be provided to perform various operations, which will be collectively referred to herein as “Agent”. The interception of process creation can be implemented by said Agent in several ways, e.g.:
Once the interception of process creation is guaranteed, the Agent needs to inspect the process about to be created, by looking at:
Note that when the launched process is used to launch/register another process, e.g. cmd.exe, java.exe, rund1132.exe or regsvr32.exe, the arguments about the “about to be launched process” should apply not to the process itself (cmd.exe, java.exe, rund1132.exe, regsvr32.exe respectively), but rather to the target argument of it (e.g. in the case of “cmd.exe/start file”—to file).
Accordingly, as will be easily understood by the skilled person, an exemplary embodiment provides a simple and yet powerful tool for preventing Exploit attacks, which can be easily implemented by operating as hereinbefore detailed.
All the above description and exemplary embodiments have been provided for the purpose of illustration and are not intended to limit the disclosure in any way except as provided for by the appended claims.
