The present invention relates to an information device, a program, a method for preventing execution of a malicious program code and a computer readable recording medium.
Generally, on information devices such as PC (Personal Computer) and WS (Work Station) there exists a control unit such as CPU (Central Processing Unit) which executes various types of data processing by sequentially executing program codes loaded in a working area of a storage unit such as a RAM (Random Access Memory). In recent years, illegal accesses to the information devices has been occurring by way of unauthorized execution using program codes created by malicious users.
Data managed by the information devices are generally assigned with access rights. Accordingly, the illegal accesses will not occur as long as the user has no access right. The illegal accesses will be possible if an unauthorized operation is made using a general program code assigned with the access rights to data. One known technique of this sort is using the so-called buffer overflow, allowing data at the time of execution of the program codes overflow out from a predetermined area allocated in the RAM or anything similar to RAM.
The illegal access using the buffer overflow will now be described in detail by showing comparison between the case where the program codes are properly ran and the case where the program codes are ran with an illegal action.
First, a model case where the program codes are properly ran will be explained referring to
The data for the running the program code illustrated in
For example, in the program code based on the source code illustrated in
ReturnAddress (return address) indicates an address value to which the process is to return upon the completion of a program. Return address is also an address value to which the process is to return upon the completion subprogram when the subprogram is called by the function or the like. ReturnAddress is automatically stored in the stack area by the CPU immediately after the execution of the program or immediately after the subprogram is called by the function or the like.
ebp is one type of CPU register, and indicates an address located just before a temporary memory area currently being used. In the example illustrated in
char buf[8] stores buf which is an array used in main( ) function. buf is an array for storing eight char-type (1 byte) variables, and 8-byte data can be stored in buf. int i stores i which is an int-type variable used in strcpy_helloworld( ) function.
Accordingly, by execution of the program code, a stack frame of main( ) function is allocated and a stack frame of strcpy_helloworld( ) function is allocated in the stack area. Then, a value of int i is sequentially incremented and the 6-byte character string “Hello!” is stored in char buf[8]. Next, upon completion of strcpy_helloworld( ) function, ReturnAddress2 is read out and returned to main( ) function, and upon completion of main( ) function, ReturnAddress1 is read out and the program terminates normally.
Next, a case where an illegal act took place when the program code is executed will be described with reference to
In the stack area illustrated in
According to the source code illustrated in
As a method of detecting such illegal access, one possible method is by detecting whether any illegal access is executed or not by inspecting the return addresses stored in the stack area and comparing an arrangement pattern of the return addresses under execution of the normal program and an arrangement pattern of the return addresses under operation of an attack code. For example, the program may be judged as normal, if a destination memory attribute pointed by the return address has a program code attribute, or if the memory areas have a non-writable attribute.
However, return-to-libc attack (see Non-Patent Document 1) may not be detected by the above-described method of detecting illegal access. The return-to-libc attack refers to a technique of making an illegal access by calling a function preliminarily stored in a computer without adding any malicious code into the program code.
A possible attack using the return-to-libc attack is such as executing a predetermined program code by combining program codes of programs which are stored in a storage unit of an information device in advance. Also in this method of attack, the return addresses in the stack area seem to have similar pattern as those in the return-to-libc attack, so that the program including the attack using the return-to-libc attack may not be distinguishable from the normal program.
Patent Document 1 discloses a technique using branch trace which is one of the CPU functions so as to detect an action of returning back to the top address of the OS standard function, when returning from the function which is being executed to the process of the function at a caller.
However, while the technique described in Patent Document 1 might successfully detect the return-to-libc attack making use of the function called branch trace, the technique may increase process load of the CPU since it uses the function owned by the CPU, and may also restrict the use of other applications (such as performance measurement tool and so forth) which make use of the branch trace function. In other words, the technique may increase the process load of the computer in a period over which the process for detecting the return-to-libc attack continues, and may thereby degrade the usability of the computer.
The present invention was conceived after considering the above-described problems in the prior art, and an object of which is therefore to provide a technique of preventing an illegal access using buffer overflow in a reliable and simple manner, without depending on the OS functions owned by CPU.
In order to solve the above problems, the invention described in claim 1 is An information device which processes data based on cooperation of program codes loaded in a memory with a central control unit including detection unit which detects a timing when any one of the program codes is called, a return address acquisition unit which sequentially acquires return addresses of the program codes loaded in the memory, when the program code detected by the detection unit is called and a termination unit which detects an illegal access based on destination addresses pointed by the return addresses sequentially acquired by the return address acquisition unit when the program code detected by the detection unit is called, and terminates the data processing when the illegal access is detected.
The invention described in claim 2 is the invention described in claim 1, wherein the memory has a stack area used for storing the return addresses of the program codes, and the return address acquisition unit traces and acquires the return addresses stored in the stack area.
The invention described in claim 3 is the invention described in claim 1 or 2, wherein the termination unit detects the illegal access when the destination addresses pointed by the return addresses acquired by the attribute acquisition unit is a starting address of a function, and terminates the data processing when the illegal access is detected.
The invention described in claim 4 is the invention described in any one of claims 1 to 3, wherein the termination unit detects the illegal access when an instruction located just before the destination addresses pointed by the return addresses acquired by the attribute acquisition unit is not a call instruction, and terminates the data processing when the illegal access is detected.
The invention described in claim 5 makes a computer, which executes program codes loaded in a memory, function as a detection unit which detects a timing when any one of the program codes is called, a return address acquisition unit which sequentially acquires return addresses of the program codes loaded in the memory, when the program code detected by the detection unit is called and a termination unit which detects an illegal access based on destination addresses pointed by the return addresses sequentially acquired by the return address acquisition unit when the program code detected by the detection unit is called, and terminates the data processing when the illegal access is detected.
The invention described in claim 6 is a method for preventing execution of a malicious program code in a computer which executes program codes loaded in a memory including detecting a timing when any one of the program codes is called, sequentially acquiring return addresses of the program codes loaded in the memory when the detected program code is called, detecting an illegal access based on destination addresses pointed by the acquired return addresses and terminating data processing when the illegal access is detected.
The invention described in claim 7 is a computer-readable recording medium which stores a program configured to make a computer, which executes program codes loaded in a memory, function as detection unit which detects a timing when any one of the program codes is called, a return address acquisition unit which sequentially acquires return addresses of the program codes loaded in the memory, when the program code detected by the detection unit is called and a termination unit which detects an illegal access based on destination addresses pointed by the return addresses sequentially acquired by the return address acquisition unit when the program code detected by the detection unit is called, and terminates the data processing when the illegal access is detected.
According to the present invention, an illegal access using buffer overflow can be prevented in a reliable and simple manner, without depending on the CPU functions.
Embodiments of the present invention will be described below referring to the attached diagrams. However, the scope of the present invention is not limited to the embodiments described below.
First, a configuration of the information device according to an embodiment will be explained.
The CPU (10) controls operations of the information device 1 in a centralized manner. The CPU (10) loads program codes and various data, which are stored in the storage unit (20) in a work area of the RAM (30), and outputs control signals to the individual units in cooperation with the data loaded in the RAM (30).
The storage unit (20) stores data which includes program codes and various setting information, wherein the data is readable and writable by the CPU (10). The storage unit (20) is a HDD (Hard Disk Drive), semiconductor memory, and the like, for example. The storage unit (20) may alternatively be configured to store the data in a ROM (Read Only Memory). The program codes stored by the storage unit (20) includes basic software such as OS (Operating System), various application programs provided by vendors, and programs relevant to the processing described later.
In the RAM (30), a stack area for storing information about the running the program code is allocated.
ExitProcess( ) is a function for terminating the program, and a termination code of the program to be terminated is set to the argument of ExitProcess. WinExec( ) is a function for allowing execution of a designated program. Since ReturnAddress is located just before ebp backup, ReturnAddress can sequentially be traced and acquired by following ebp backup.
The stack frames contained in the stack area are sequentially allocated with execution of the program codes, when the individual program codes are sequentially executed. For a model case where the main program code is executed, a program code relevant to a subroutine is called in the program code and still another program code is called, areas corresponded to the individual program codes are allocated according to the order of the stack frames. When processes relevant to the individual program codes terminate, return to the main program code or processes after termination of the program will occur upon read-out of ReturnAddress in the stack frame.
The operation unit (40) accepts an entry of operation made by a user and outputs an operation signal corresponding to the operation to the CPU (10). The operation unit (40) herein is a keyboard having character keys, numeral keys and other keys assigned to various functions, or a pointing device such as mouse, for example.
The display unit (50) displays an image on a screen, the image being based on a display control signal output from the CPU (10). The display unit (50) may be a CRT (Cathode Ray Tube), LCD (Liquid Crystal Display), and the like.
The I/F unit (60) has a data network IC (Integrated Circuit), connectors and so forth (all of them not illustrated), and is connected to external devices and a communication network so as to communicated with each other. The I/F unit (60) may typically be a USB (Universal Serial Bus) network port, or a network interface card (NIC) which allows connection with LAN (Local Area Network), WAN(Wide Area Network) or the Internet, for example.
Next, operations of the information device (1) when detecting execution of malicious program code will be explained. In order to prevent execution of malicious program code in the information device (1), it is necessary to insert a process for checking a malicious program code execution by detecting an API, library function, system call and so forth which are required for the execution of the malicious program code. In the information device (1) of this embodiment, detecting of malicious code used for calling a predetermined library function and inserting of a process for checking illegality are realized by using hooks.
The hook process is a mechanism for enabling a user to insert his or her unique process at a specific position in any program. In other words, it is a mechanism used when the programmer who created the program code to be hooked and the programmer who created the program code used for the hook process are different persons, and where the source codes relevant to their program codes are not created by the same programmer. Accordingly, the mechanism is used for modifying OS or functions provided by the vendor, or for adding arbitrary processes.
The hook process may be used also when the programmer himself or herself is able to modify subprograms such as functions to be checked. Note that, for the case where the programmer himself or herself is able to modify subprograms and he or she modified the subprograms so as to enable checking of illegality upon execution of the subprogram, it is no longer necessary to use the hook process and the existing functions and library can be used as safer ones.
First, a model case for checking whether the malicious program code is executed or not by using API hook process (hook process of library function) will be explained with reference to
Hereinafter, a hook process (
As illustrated in
Next, a small function (temporary function) for hooking execution of API is dynamically generated (step S2). The dynamically-generated function is a function for calling the stack layout check process described later.
Next, the top code of WinExec( ) is rewritten and modified so as to enable execution of the function generated in step S2 (step S3).
By virtue of the hook process described above, it is now capable of inserting a process of detecting a call of the subprogram code, and checking any illegality, in the information device (1). In general cases where a subprogram of the function is called, a function called by a certain function is executed as it is. In contrast, in the information device (1), by performing the above-described hook process which takes place before the subprogram code is called, the stack layout check process may be executed upon calling of the subprogram code.
As illustrated in
Next, StackWalk( ) is called to trace one stack back so as to sequentially call the stack frames in the stack area (step S12), and whether the return address was correctly acquired or not after the tracing is determined (step S13).
If it is determined in step S13 that the return address is not correctly acquired (step S13; NO), the execution of WinExec( ) to be checked is continued while assuming normal termination of the process. A possible case which corresponds to this situation is such that the stack has been damaged by an unknown reason other than illegal access, and thereby StackWalk( ) does not properly operate. While the process in this embodiment is configured to normally terminate when the StackWalk( ) does not operate correctly, it is also possible to terminate the program or to output a dialog box on the display unit (50) by which the user can confirm weather to terminate or continue the program even when the stack trace failed.
On the other hand, when it was determined that the return address is correctly acquired (step S13; YES), the return address is judged whether it is the starting address of the function (step S14). The starting address of the function may be acquired by various known methods, for example, by referring to values preliminarily stored in the storage unit (20) or by referring to an IAT (Import Address Table) which is an array for storing actual memory address of the function to be imported.
If the return address is not determined as the starting address (step S14; NO), whether the instruction located just before the return address is a CALL instruction or not is judged (step S15). The CALL instruction herein means an instruction used for calling a subroutine, and in step S15, the instruction located just before the destination address pointed by the return address is to be determined.
If the return address was determined as the CALL instruction (step S15; YES), whether there is any unchecked return address or not is judged (step S16).
If it is determined that there remains unchecked addresses (step S16; YES), the process goes back to step S12, and the next return address is traced.
If it is determined that there are no addresses remained unchecked (step S16; NO), the execution of WinExec( ) to be checked is executed while assuming normal termination of the process.
On the other hand, if the return address is determined as the starting address (step S14; YES), or if the instruction was not judged as the CALL instruction (step S15; NO), an attack such as an illegal access is detected and a dialog stating that the data processing is temporarily terminated in order to prevent execution of any malicious program code is displayed on the display unit (50) (step S17), and execution of the program is terminated (step S18).
In the stack layout check process described above, the return-to-libc attack is detected in step S14 and step S15. When the return-to-libc attack takes place, the destination pointed by the return addresses characteristically falls on the starting address of the function. For the case of a normal program, the destination pointed by the return addresses does not fall on the starting address of the function, and the process thereafter continues for the rest of the function.
On the other hand, an attack which is an applied technique of the return-to-libc attack, wherein the program code stored in the information device (1) is combined, has a characteristic that an instruction located just before the destination pointed by the return addresses is not the CALL instructions. These two features are not found when executing a normal program. In the stack layout check process, the return-to-libc attack is detected based on these two features.
Next, derivation patterns of the return-to-libc attack, detectable by the stack layout check process, will be explained. In the aforementioned stack layout check process, the return-to-libc attack becomes detectable by checking the destinations pointed by the return addresses, wherein the return-to-libc attack has various known attack patterns.
In the case shown in
In the case shown in
Next, a return-to-libc attack which is run in Windows Operating System (registered trademark, this annotation will be omitted hereinafter) will be described as an example, and the timing when the information device (1) of the present invention detects the return-to-libc attack will be described.
First, an exemplary return-to-libc attack caused by executing a file created by the CPU 10 will be explained. In this case, the return-to-libc attack takes place using CreateFile( ), WriteFile( ), WinExec( ), ExitProcess( ) and so forth, which are the functions provided by Windows. CreateFile( ) is a function for creating files, wherein name of the created file is used as an argument. WriteFile( ) is a function for writing data into the file, wherein a file handle which indicates a target where data is to be written, data to be written, data size and the like are used as arguments.
In the return-to-libc attack, first, a predetermined file is created using CreateFile( ) and WriteFile( ). The procedure herein is configured to execute the above created file using WinExec( ) and to terminate the above created file by using ExitProcess( ).
There may be another case where an attack code of the return-to-libc attack prompts downloading of a malicious code through the Internet, and the file is executed. For example, first, a malicious file is downloaded through the I/F unit (60) from the Internet, using a function named URLDownloadTofile( ) provided by Windows. The downloaded file is then executed using WinExec( ).
As described above, according to the information device of the present invention, the return-to-libc attack, which is a technique of illegal access using buffer overflow, can be prevented in a reliable and simple manner, without depending on the CPU function.
Note that the description of the above-described embodiments is given merely for exemplary purposes, and is not intended to limit the invention to the embodiments. The configurations and operations in the above-described embodiments may be modified as needed.
For example, while the above description discloses the case where the storage unit (20) and the ROM are used as the computer-readable media for storing the program of the present invention, the media are not limited to these examples. Other computer-readable media adoptable herein include portable recording media including non-volatile memory such as flash memory, and CD-ROM. Alternatively, as a medium for assisting provision of program data of the present invention through network lines connected to the I/F unit (60), carrier wave can also be adopted in the present invention.
The entire contents of disclosure of Japanese Patent Application No. 2009-107294, filed on Apr. 27, 2009, including specifications, claims, diagrams and abstracts, are incorporated hereinto as part of the present application.
The present invention is applicable in the fields of information devices including PC, WS, mobile phone, and network appliances.
Number | Date | Country | Kind |
---|---|---|---|
2009-107294 | Apr 2009 | JP | national |
Filing Document | Filing Date | Country | Kind | 371c Date |
---|---|---|---|---|
PCT/JP2010/056500 | 4/12/2010 | WO | 00 | 10/27/2011 |