System and method for repairing vulnerabilities of objects connected to a data network

• US 10,484,416 B2
• Filed: 08/22/2018
• Issued: 11/19/2019
• Est. Priority Date: 03/18/2016
• Status: Active Grant

• Current Assignee: Lab A.O. Kaspersky
• Original Assignee: Lab A.O. Kaspersky
• Inventors: Rusakov, Vyacheslav E., Janus, Marta Anna
• Primary Examiner(s): Mehrmanesh, Amir
• Application Number:
  US16/108,194
• Publication Number:
  US 20190007445A1
• Time in Patent Office: 454 Days
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 41/0809 Plug-and-play configuration
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud

Abstract

Disclosed are systems and methods for repairing vulnerabilities of objects connected to a data network. An example method includes transmitting a request throughout the data network, obtaining responses from a plurality of accessible objects in the data network, attempting to obtain access to the plurality of accessible objects using a plurality of access methods, when access to an object is obtained, obtaining a list of resources of the accessed object, comparing the list of resources with a database of vulnerabilities to determine to identify one or more resources from the list of resources that have a similar vulnerable status as a vulnerable resource in the database of vulnerabilities and repairing vulnerabilities associated with the accessed object by applying repairs associated with the vulnerable resource to the accessed object.

Claims

1. A method for repairing vulnerabilities of objects connected to a data network, the method comprising:

transmitting, by a hardware processor, a request throughout the data network;

obtaining responses from a plurality of accessible objects in the data network;

determining, by the hardware processor, whether access to the plurality of accessible objects is available using a plurality of access methods;

when access to an object is available, accessing the object and obtaining a list of resources of the accessed object;

crawling through an administrative console of the object to determine a list of resources of the object and open ports of the object, each resource comprising an adjustable parameter and/or an attribute of the object;

comparing, by the hardware processor, the list of resources and the open ports with a database of resources with associated network vulnerabilities to identify one or more resources from the list of resources that have a similar vulnerable status as a vulnerable resource in the database of resources with associated network vulnerabilities;

identifying one or more repair actions from the database of resources with associated network vulnerabilities based on the identified one or more resources; and

repairing the network vulnerabilities associated with the accessed object by applying the one or more repair actions associated with the vulnerable resource to the accessed object.

2. The method of claim 1, wherein the request is a broadcast request that is transmitted via a router through the data network.

3. The method of claim 1, wherein the plurality of access methods comprises:

web access, uPnP protocol access, FTP protocol access, RDP protocol access, and SSH protocol access.

4. The method of claim 1, further comprising:

performing authorization using predetermined login/password groups or online automation authentication techniques.

5. The method of claim 4, wherein the access is obtained by:

accessing a configuration interface exposed by each of the accessible objects; and

parsing the configuration interface to obtain the data fields.

6. The method of claim 1, wherein comparing the list of resources with a database of vulnerabilities further comprises:

comparing a type and status of the accessed object with resource set of rules defined in the database of vulnerabilities;

determining that the type and the status of the accessed object match one of the set of rules;

obtaining settings associated with the one of the set of rules; and

repairing the accessed object based on the obtained settings.

7. The method of claim 6, wherein a type of the resource may comprise:

passwords, remote administration, DNS settings, Network ports, Wi-fi settings, access by protocols, and firewalls.

21. The medium of claim 6, wherein a type of the resource may be comprise:

passwords, remote administration, DNS settings, Network ports, Wi-fi settings, access by protocols, and firewalls.

8. A system for repairing vulnerabilities of objects connected to a data network, the system comprising:

a hardware processor configured to;

transmit a request throughout the data network;

obtain responses from a plurality of accessible objects in the data network;

determine whether access to the plurality of accessible objects is available using a plurality of access methods;

when access to an object is available, access the object and obtain a list of resources of the accessed object;

crawl through an administrative console of the object to determine a list of resources of the object and open ports of the object, each resource comprising an adjustable parameter and/or an attribute of the object;

compare the list of resources and the open ports with a database of resources with associated network vulnerabilities to identify one or more resources from the list of resources that have a similar vulnerable status as a vulnerable resource in the database of resources with associated network vulnerabilities;

identifying one or more repair actions from the database of resources with associated network vulnerabilities based on the identified one or more resources; and

repair the network vulnerabilities associated with the accessed object by applying the one or more repair actions associated with the vulnerable resource to the accessed object.

9. The system of claim 8, wherein the request is a broadcast request that is transmitted via a router through the data network.

10. The system of claim 8, wherein the plurality of access methods comprises:

web access, uPnP protocol access, FTP protocol access, RDP protocol access, and SSH protocol access.

11. The system of claim 8, wherein the hardware processor is further configured to:

perform authorization using predetermined login/password groups or online automation authentication techniques.

12. The system of claim 11, wherein the access is obtained by:

accessing a configuration interface exposed by each of the accessible objects; and

parsing the configuration interface to obtain the data fields.

13. The system of claim 8, wherein comparing the list of resources with a database of vulnerabilities further comprises:

comparing a type and status of the accessed object with resource set of rules defined in the database of vulnerabilities;

determining that the type and the status of the accessed object match one of the set of rules;

obtaining settings associated with the one of the set of rules; and

repairing the accessed object based on the obtained settings.

14. The system of claim 13, wherein a type of the resource may comprise:

passwords, remote administration, DNS settings, Network ports, Wi-fi settings, access by protocols, and firewalls.

15. A non-transitory computer-readable medium storing instructions therein for repairing vulnerabilities of objects connected to a data network, the instructions comprising:

transmitting a request throughout the data network;

obtaining responses from a plurality of accessible objects in the data network;

determining whether access to the plurality of accessible objects is available using a plurality of access methods;

when access to an object is available, accessing the object and obtaining a list of resources of the accessed object;

crawling through an administrative console of the object to determine a list of resources of the object and open ports of the object, each resource comprising an adjustable parameter and/or an attribute of the object;

comparing the list of resources and the open ports with a database of resources with associated network vulnerabilities to identify one or more resources from the list of resources that have a similar vulnerable status as a vulnerable resource in the database of resources with associated network vulnerabilities;

identifying one or more repair actions from the database of resources with associated network vulnerabilities based on the identified one or more resources; and

repairing vulnerabilities associated with the accessed object by applying the one or more repair actions associated with the vulnerable resource to the accessed object.

16. The medium of claim 15, wherein the request is a broadcast request that is transmitted via a router through the data network.

17. The medium of claim 15, wherein the plurality of access methods comprises:

web access, uPnP protocol access, FTP protocol access, RDP protocol access, and SSH protocol access.

18. The medium of claim 15, the instructions further comprising:

performing authorization using predetermined login/password groups or online automation authentication techniques.

19. The medium of claim 18, wherein the access is obtained by:

accessing a configuration interface exposed by each of the accessible objects; and

parsing the configuration interface to obtain the data fields.

20. The medium of claim 15, wherein comparing the list of resources with a database of vulnerabilities further comprises:

comparing a type and status of the accessed object with resource set of rules defined in the database of vulnerabilities;

determining that the type and the status of the accessed object match one of the set of rules;

obtaining settings associated with the one of the set of rules; and

repairing the accessed object based on the obtained settings.