The invention relates to the field of detecting exploitation of a system by the execution of malicious code. More specifically, the invention relates to a method and system for detecting the running of a malicious code which is injected to within in the execution context of a widget at a device having a web based operating system.
The web based operating system is an emerging technology which becomes more and more popular these days. A prominent example is the Tizen OS developed jointly by Samsung Electronics and Intel Corporation, targeting consumer devices such as smartphones and SmartTVs.
A Web based operating system forms an execution environment, which is built around a web browser. This technology allows running within the device of widgets mainly written in HTML/JavaScript, said widgets are rendered by the runtime engine of the web browser.
The widget is the most typical software code for running within the Web based operating system. As the Web based OS is typically designed for the operation of mobile devices (such as smartphones, tablet, etc.) and smartTVs, the various widgets are typically supplied to the within the relevant device from an App-Store, which is most commonly owned by the manufacturer of the specific device. For example, widgets for the Samsung SmartTV are supplied by the Samsung owned App-Store.
As with any new platform, web based operating systems have their own unique set of security problems and weaknesses, many of which are inherent to the web OS architecture. The most prominent security weaknesses evolve from the lack of: (a) proper access control; (b) distinct and enforceable user privileges; and (c) a clear separation between the presentation layer and the business logic.
Injection-type vulnerabilities, such as, XSS and HTML injections are the most critical vulnerabilities that affect web based applications. These vulnerabilities allow execution of malicious code in the execution context of the vulnerable application (i.e., widget). The abovementioned type of security weakness amplifies the severity of malicious injection to any widget, an injection that may potentially result in a broad system exploit and a complete security compromise within the consumer device.
It is therefore an object of the present invention to provide a method and system for detecting and preventing the exploitation of injection-type vulnerabilities in a Web based Operating system environment.
It is another object of the present invention to provide a method and system for detecting and preventing such exploitation in a generic manner, with no requirement for a-priori knowledge of the malicious code nature, behavior, or its structure.
It is still another object of the present invention to provide such method and system in a simple and compact manner.
Other advantages of the present invention will become apparent as the description proceeds.
The invention relates to a method for detecting a malicious code which is injected into the command stream of a widget running by a web-based OS at a device, which comprises: (a) introducing by an App-Store hooks to within the command stream of the widget; (b) running at the App-Store the widget on an App-Store device, measuring respective time durations between various hooks, and recording said time durations within a metadata file; (c) associating said metadata file with said widget, and supplying said widget, including said associated metadata file to within a user device which is substantially identical to said App-Store device; (d) upon running said widget by a web based OS at said user device, activating a monitoring module, determining by said module times durations between said introduced hooks, and comparing respectively said determined time durations with said measured time durations; and (e) issuing an alert upon detection of a variation above a predefined value between any of said determined durations and said measured durations respectively.
Preferably, said monitoring module is a part of said web-based OS.
Preferably, when an update is introduced at the APP-Store into said widget, a corresponding updated metadata file is also prepared, and sent to the device together with said update to the widget.
Preferably, when an update is introduced at the APP-Store introduced into said web based OS that affect any of said measured time durations, said metadata file is also updated respectively, and said updated metadata file is sent to the device together with said updated web based OS.
Preferably, said variation is a time value.
Preferably, said variation is a percentage value.
Preferably, the method is performed separately for each device model.
Preferably, all updates to said widget, said metadata file, and said web based OS are performed by the App-Store. Preferably, the hooks are introduced every X lines of the widget code, where X is a constant integer.
Preferably, the hooks are introduced only in functions that do not involve with inputting from a user.
Preferably, the hooks are introduced randomly within the widget lines of code.
In the drawings:
A typical prior art system for running a widget within a device is shown in
In any case, by its nature the App-store 20, even though receiving applications and widgets for distribution from many sources, is considered as a reliable entity whose task, among others, is to assure the authenticity, reliability, and security of the applications and widgets that are supplied to the end devices 10. Furthermore, to a large extent, each user of a device uses a single App-Store 20, which is typically owned and operated by the manufacturer of the respective device 10. As also noted, the App-Store 10 of the device manufacturer is also the supplier of the web based OS 70, when used to operate the device. These facts are utilized by the security system of the present invention.
On the other hand, it has been found that when a malicious code is injected to within the code context 12, the values of said Δts are very substantially affected, and may enlarge, for example, by 100% or more. This is because at least some of the most dangerous malicious codes use slow operating resources (such as a network), or involve in transfer of relatively large amounts of data. The present invention utilizes said latter observations as well.
According to the present invention, several “hooks” 30a-30n are spread within the code of each widget 12. The widget is then run by a web based OS within a specific device 10, and the time durations Δts between respective command executions are determined. This procedure of selecting the hooks locations and determination of the times Δt is typically performed by the APP-Store (or a similar reliable entity). The respective times durations Δts are then recorded within a meta-data file 40, which is associated with said specific widget 12 and said specific device 10.
There are various manners for selecting the locations of the hooks. In one embodiment, the hooks are placed once every X lines of code (where X is a constant integer). In another embodiment, the hooks are positioned at predefined functions, for example, at each function that does not involve inputting from the user. In still another embodiment, the hooks may be distributed randomly within the widget code lines. Various other considerations may be applied for selecting where to introduce the hooks.
As shown, the invention provides a mechanism for determining a malicious code which may be injected to within a widget execution context. This injection may come from any unreliable source, for example, a hacker. As shown, the invention utilizes the fact that typically all the widgets are conveyed to within a device from a reliable App-Store, which is typically owned by the same entity as the provider or manufacturer of the respective device. The security mechanism of the invention is substantially independent from the specific content or nature of the malicious code, so it can even detect a new and unfamiliar malicious code.
While some embodiments of the invention have been described by way of illustration, it will be apparent that the invention can be carried into practice with many modifications, variations and adaptations, and with the use of numerous equivalents or alternative solutions that are within the scope of persons skilled in the art, without departing from the spirit of the invention or exceeding the scope of the claims.