Patent Application
20080127352
The present invention relates to computer system management. In particular, but not by way of limitation, the present invention relates to systems and methods for protecting a registry from pestware or malware.
Personal computers and business computers are continually attacked by trojans, spyware, and adware, collectively referred to as “malware” or “pestware.” These types of programs generally act to gather information about a person or organization-often without the person or organization's knowledge. Some pestware is highly malicious. Other pestware is non-malicious but may cause issues related to privacy and/or system performance. And yet other pestware is actually beneficial or wanted by the user. Wanted pestware is sometimes not characterized as “pestware” or “spyware.” But, unless specified otherwise, “pestware” as used herein refers to any program that collects and/or reports information about a person or an organization and any “watcher processes” related to the pestware.
Many pestware processes maliciously infiltrate a computer system by altering a registry associated with an operating system of a computer. Because the registry is vital to the functionality of fundamental components/modules of the computer, it is a prime target for many pestware processes. The design and implementation of current and future pestware incorporates techniques, and likely future improvements to them, that are often used to alter a registry of the computer by circumventing pestware detection and removal software and/or hardware modules. For example, pestware can gain access to the registry of a computer using undocumented registry access techniques or cloaking techniques. Accordingly, because current software is not always able to identify, detect, and intercept pestware, current software is not always able to prevent unauthorized modification of a registry.
Exemplary embodiments of the present invention that are shown in the drawings are summarized below. These and other embodiments are more fully described in the Detailed Description section. It is to be understood, however, that there is no intention to limit the invention to the forms described in this Summary of the Invention or in the Detailed Description. One skilled in the art can recognize that there are numerous modifications, equivalents and alternative constructions that fall within the spirit and scope of the invention as expressed in the claims.
The present invention can provide a system and method for protecting a registry from pestware or malware. In one exemplary embodiment, the present invention includes receiving, at a filter, a registry access signal from an application. The registry access signal is rerouted, using the filter, to a virtual registry. The virtual registry corresponds to at least a portion of a registry of a computer that includes an entry related to an operating system (OS) of the computer.
Another embodiment of the present invention includes accessing a portion of a registry identified as a critical portion of the registry. A portion of a virtual registry that corresponds to the critical portion of the registry is generated and access to the virtual registry is controlled.
In yet another embodiment, a method includes accessing a portion of a registry of a computer that includes an entry related to an operating system (OS) of the computer. A portion of a virtual registry corresponds with the portion of the registry is also accessed. A difference between the portion of the virtual registry and the portion of the registry is identified.
As previously stated, the above-described embodiments and implementations are for illustration purposes only. Numerous other embodiments, implementations, and details of the invention are easily recognized by those of skill in the art from the following descriptions and claims.
Various objects and advantages and a more complete understanding of the present invention are apparent and more readily appreciated by reference to the following Detailed Description and to the appended claims when taken in conjunction with the accompanying Drawings wherein:
Referring now to the drawings, where like or similar elements are designated with identical reference numerals throughout the several views, and referring in particular to
The filter 120 and/or virtual registry 108 can be designed to operate on any type of computer system (e.g., personal computer or server) including in a WINDOWS and/or Linux-based environment. For convenience, embodiments of the present invention are generally described herein with relation to WINDOWS-based systems. Those of skill in the art can easily adapt these implementations for other types of operating systems or computer systems.
The virtual registry 108 corresponds to a critical portion of the registry 104 and access to the virtual registry 108, like access to the registry 110, is controlled by the filter 120 and/or the pestware management application/system. In many implementations, the virtual registry 108 is an image of the critical portion of the registry 104. The virtual registry 108 is configured so that the critical portion of the registry 104 can be repaired (e.g., restored) using information in the virtual registry 108 when a registry access signal circumvents the filter 120 and accesses and/or alters an entry in the critical portion of the registry 104 in an unauthorized manner (e.g., undocumented registry access signal from a pestware application). In many embodiments, the virtual registry 108 is a secure virtual registry (e.g., encrypted) with restricted access that is controlled by the filter 120.
The critical portion of the registry 104 is a set of keys/entries that are pre-defined by, for example, a user or software developer. The critical portion of the registry 104 includes, for example, keys that allow the operating system 114 to load an application implicitly and/or automatically; keys that are used to install a device driver or service; keys that should be used only by the operating system 114; and/or keys that belong to and should only be accessed by a security application such as a pestware management application. A definition of the keys that should be included as critical portions of the registry 104 is configurable (e.g., can be updated with additional keys and/or portions of keys) and stored so that the virtual registry 108 will be created based on that definition.
One of ordinary skill in the art will appreciate that the critical portion of the registry 104 and the virtual registry 108 are depicted as single portions or blocks for convenience in this Detailed Description. In many implementations, the critical portion of the registry 104 and/or the virtual registry 108 can be separated into more than one block (e.g., separate pieces or locations in memory).
As shown in
The filter 120 (also referred to as a filter driver, hook filter, or registry filter) is configured to intercept registry access signals (e.g., application program interface (API) calls) such as those originating at application 130 and/or pestware application 140 to enable a determination to be made as to whether the registry access signals should be denied or routed to either the registry 110 or the virtual registry 108. In some embodiments, the filter 120 controls access to and from the registry 110 and virtual registry 108 such that communication being facilitated and/or monitored by the filter 120 is transparent to pestware application 140 and application 130. In many implementations, the filter 122 is realized by a kernel mode driver that may be loaded during a boot sequence of the operating system 114.
In some embodiments, the filter 120 is configured to authenticate all registry access signals that trigger access to the registry 110 and/or virtual registry 108 to ensure that the registry access signals are not from the pestware application 140 before allowing access (e.g., read/write/delete access). For example, the filter 120 itself may analyze whether registry access signals are associated with a potential-pestware process.
In other embodiments, the filter 120 is configured to intercept the registry access signals and then communicate with a pestware management application/system (e.g., a user-mode pestware management application), which analyzes whether the registry access signals are associated with a potential-pestware process. In these other embodiments, the filter 120 may wait for the pestware management application/system to assess whether the registry access signals pose a threat before allowing or denying access to the registry 110.
More details related to intercepting registry access signals (e.g., using a kernel-mode driver) are set forth in commonly assigned and co-pending application Ser. No. 11/257,609, Attorney Docket No. WEBR-015/00US, filed Oct. 25, 2005, entitled System and Method for Kernel-Level Pestware Management which is incorporated herein by reference.
An analysis of whether registry access signals are associated with pestware (e.g., the pestware application) may include, for example, one or more of the following techniques: a definition-based analysis, a heuristics-based analysis, or an offset scanning analysis. More details related these types of analysis may be found in the following commonly assigned and co-pending applications: application Ser. No. 10/956,574, filed Oct. 1, 2004. Attorney Docket No. WEBR-005/00US, entitled System and Method for Pestware Detection and Removal; application Ser. No. 11/237,291, filed Sep. 28, 2005. Attorney Docket No. WEBR-020/00US, entitled Client Side Exploit Tracking; and application Ser. No. 11/105,977, filed Apr. 4, 2005. Attorney Docket No. WEBR-014/00US, entitled System and Method for Scanning Memory for Petsware Offset Signatures, which are incorporated herein by reference.
As shown in
Registry access signal 132 is a registry access signal from application 130 that is directed/targeted to a location in the critical portion of the registry 104.
After the virtual registry has been created, a registry access signal from an application is received (block 220). The registry access signal is intercepted by, for example, a filter before the registry access signal accesses or triggers the accessing of the registry. The registry access signal is, in some embodiments, a registry access request and in some embodiments, the registry access signal is an instruction, indicator, and/or command that will be used to directly or indirectly access the registry. For example, in some embodiments, the registry access signal triggers a separate program to access and/or send information associated with the registry.
The registry access signal is then analyzed by the filter to determine if the registry access signal is authorized (e.g., authenticated) to access the registry (block 230). If the registry access signal is not authenticated by the filter, access to the registry or virtual registry is denied (block 240).
If the registry access signal is authenticated, the filter determines whether or not the registry access signal should be routed to the registry or the virtual registry (block 250). The registry access signal is routed to the target location in the registry (block 260) when the target of the registry access signal is a location in the registry that has not been selected as a critical portion of the registry. The registry access signal is routed to a location in the virtual registry that corresponds with the critical portion of the registry (block 270) when the target of the registry access signal is a location in the critical portion of the registry.
As shown in
Although the embodiment shown in
A critical portion of the registry that is to be protect is identified (block 310). The critical portion can be defined by, for example, a user, an application, or a software developer interested in protecting the critical portion of the registry. The critical portion of the registry can include one or more keys/entries that, for example, relate to an operating system, device and/or module installation, security application, etc. A list/database of the critical portion(s) of the registry can be uploaded to and/or stored on, for example, a computer system for use in creating a virtual registry. The list/database can be uploaded from a remote computer or installed on a computer system during, for example, a software installation of a pestware application that will use the list/database of the critical portion(s) of the registry to create a virtual registry. In some embodiments, the critical portions of the registry are user specific (e.g., different lists of critical registry entries for each user).
As shown in
After space for the critical portion of the registry has been allocated, the registry is accessed (block 330) and the critical portion of the registry is included in the memory allocated for the virtual registry (block 340). In some embodiments, a copy of the critical portion of the registry is included in the memory. In some implementations, a look-up table that can be used to associate locations within the critical portion of the registry with locations in the virtual registry is stored in the allocated memory.
Although not illustrated in
The difference is the result of changes made to the critical portion of the registry or changes made to the virtual registry. For example, the difference can be the result of unauthorized changes to the critical portion of the registry by a registry access signal that accessed the critical portion of the registry in an unauthorized manner (e.g., by circumventing a filter associated with a pestware management system). The difference can also be, for example, a result of changes to the virtual registry that were authorized by a filter. The comparison is executed using a one-to-one comparison of, for example, corresponding bits or using identifiers associated with the virtual registry and/or the critical portion of the registry that indicate a difference.
The critical portion of the registry is not modified (block 460) when a difference between the virtual registry and the critical portion of the registry is not detected. In some embodiments, a user can be notified that a critical portion of the registry has not been modified.
When a difference between the virtual registry and the critical portion of the registry is detected, a user is prompted with a proposed modification to the registry (block 430) and the user responds to indicate whether or not the modification is authorized (block 440). When the modification is not authorized by the user, the critical portion of the registry is not modified (block 460). If the modification is authorized by the user, the registry is modified (block 450) based on the proposed modification (block 430).
In some embodiments, changes that were authorized and made to the virtual registry are automatically copied into the critical portion of the registry without authorization from a user. A filter and/or a pestware management system can be configured to log authorized changes to the virtual registry to make this determination. In some embodiments, a user is only given the option to authorize a modification to the critical portion of the registry, for example, if the changes were made by registry access requests that circumvented a filter or were not authorized by the filter. If, for example, multiple unrelated differences are detected, a user can be prompted to authorize each of the differences separately and modifications can be made separately.
In some embodiments, the method illustrated in
In conclusion, the present invention provides, among other things, a system and method for protecting a registry from pestware or malware. Those skilled in the art can readily recognize that numerous variations and substitutions may be made in the invention, its use and its configuration to achieve substantially the same results as achieved by the embodiments described herein. Accordingly, there is no intention to limit the invention to the disclosed exemplary forms. Many variations, modifications and alternative constructions fall within the scope and spirit of the disclosed invention as expressed in the claims.
