SYSTEM AND METHOD FOR PREVENTING MALWARE ON A MOBILE COMMUNICATION DEVICE

• US 20130086682A1
• Filed: 11/29/2012
• Published: 04/04/2013
• Est. Priority Date: 10/21/2008
• Status: Active Grant

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: Mahaffey, Kevin Patrick, Burgess, James David, Golombek, David, Lineberry, Anthony McKay, Barton, Kyle, Evans, Daniel Lee, Richardson, David Luke, Salomon, Ariel, Wyatt, Timothy Michael
• Granted Patent: US 8,875,289 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A server receives from a mobile communication device information about a data object (e.g., application) on the device when the device cannot assess the data object. The server uses the information along with other information stored at the server to assess the data object. Based on the assessment, the device may be permitted to access the data object or the device may not be permitted to access the data object. The other information stored at the server can include data objects known to be bad, data objects known to be good, or both.

Claims

1. A non-transitory computer-readable storage medium having stored thereon a plurality of instructions which, when executed by a processor, cause the processor to perform the steps of a method for assessing a data object present on a mobile communication device, the assessment provided by a server computer, the method comprising:

before receiving data identifying at least a portion of the data object present on the mobile communication device at the server computer, determining if previously stored definition information stored in a local store at the mobile communication device corresponds to the data identifying at least a portion of the data object present on the mobile communication device, the local store storing a corresponding assessment for the previously stored definition information; and

,

if the previously stored definition information in the local store at the mobile communication device does not correspond to the data identifying at least a portion of the data object present on the mobile communication device, then at the server computer, receiving data identifying at least a portion of the data object present on the mobile communication device;

at the server, determining if previously stored definition information for a data object corresponds to the received data, the definition information stored in a data store accessible by the server, the data store storing a corresponding assessment for the definition information;

if the previously stored definition information corresponds to the received data from the mobile communication device, then at the server, providing the assessment of the data object present on the mobile communication device corresponding to the previously stored definition information.

2. The non-transitory computer readable storage medium of claim 1, wherein the data identifying at least a portion of the data object present on the mobile communication device is application data for the data object present on the mobile communication device.

3. The non-transitory computer readable storage medium of claim 1, wherein the data identifying at least a portion of the data object present on the mobile communication device is behavioral data for the data object present on the mobile communication device.

4. The non-transitory computer readable storage medium of claim 1, wherein the data identifying at least a portion of the data object present on the mobile communication device is metadata for the data object present on the mobile communication device.

5. The non-transitory computer readable storage medium of claim 1, wherein the data identifying at least a portion of the data object present on the mobile communication device includes at least a portion of the data object present on the mobile communication device.

6. The non-transitory computer readable storage medium of claim 1, wherein the previously stored definition information includes a hash identifier for the data object present on the mobile communication device.

7. The non-transitory computer readable storage medium of claim 1, wherein the previously stored definition information includes a package name for the data object present on the mobile communication device.

8. The non-transitory computer readable storage medium of claim 1, wherein the previously stored definition information includes at least a portion of the data object present on the mobile communication device.

9. The non-transitory computer readable storage medium of claim 1, wherein the previously stored definition information includes an identifier for the data object present on the mobile communication device.

10. The non-transitory computer readable storage medium of claim 1, further comprising:

if the data identifying at least a portion of the data object present on the mobile communication device does not correspond to previously stored definition information stored in the data store accessible to the server, then analyzing, by the server, at least a portion of the data identifying at least a portion of the data object present on the mobile communication device to determine an assessment corresponding to the data identifying at least a portion of the data object present on the mobile communication device; and

,

storing the assessment corresponding to the data identifying at least a portion of the data object present on the mobile communication device in the data store accessible to the server.

11. The non-transitory computer readable storage medium of claim 10, wherein analyzing at least a portion of the data identifying at least a portion of the data object present on the mobile communication device comprises analyzing by a decision component accessible by the server.

12. The non-transitory computer readable storage medium of claim 1, further comprising:

if the data identifying at least a portion of the data object present on the mobile communication device does not correspond to definition information stored in the data store accessible to the server, then analyzing, by the server, at least a portion of the data identifying at least a portion of the data object present on the mobile communication device to determine an assessment corresponding to the data identifying at least a portion of the data object present on the mobile communication device;

requesting, by the server, additional data pertaining to the data object present on the mobile communication device;

analyzing, by the server, at least a portion of the additional data pertaining to the data object present on the mobile communication device to determine an assessment corresponding to the data object present on the mobile communication device; and

storing the determined assessment in the data store accessible to the server.

13. The non-transitory computer readable storage medium of claim 1, further comprising, after the step of providing the assessment, if the assessment indicates that the data object present on the mobile communication device is undesirable, then at the server, transmitting instructions to the mobile communication device to prevent the mobile communication device from accessing the data object present on the mobile communication device.

14. The non-transitory computer readable storage medium of claim 1, further comprising, after the step of providing the assessment, if the assessment indicates that the data object present on the mobile communication device is undesirable, then at the server, transmitting a notification to the mobile communication device.

15. The non-transitory computer readable storage medium of claim 14, wherein the notification is a warning.

16. The non-transitory computer readable storage medium of claim 14, wherein the notification is an instruction to uninstall the data object.

17. A non-transitory computer-readable storage medium having stored thereon a plurality of instructions which, when executed by a processor, cause the processor to perform the steps of a method for assessing a data object present on a mobile communication device by a server computer comprising:

receiving data from the mobile communication device by the server computer, the received data identifying the data object present on the mobile communication device;

at the server computer, analyzing the received data by a known good component resident on the server computer to provide an assessment of the data object present on the mobile communication device;

if the analysis of the received data by the known good component on the server computer results in an assessment that the data object is allowed, then at the server computer, transmitting instructions to the mobile communication device allowing the mobile communication device to access the assessed data object present on the mobile communication device;

if, at the server computer, the analysis of the received data by the known good component on the server computer does not result in an assessment that the data object is allowed, then, at the server computer, analyzing the received data by a known bad component resident on the server computer to provide an assessment of the data object present on the mobile communication device; and

if, at the server computer, the analysis of the received data by the known bad component on the server computer results in an assessment that the data object is undesirable, then, at the server computer, transmitting instructions to the mobile communication device preventing the mobile communication device from accessing the data object present on the mobile communication device.

18. The non-transitory computer readable storage medium of claim 17, wherein the received data identifying the data object present on the mobile communication device is application data for the data object present on the mobile communication device.

19. The non-transitory computer readable storage medium of claim 17, wherein the received data identifying the data object present on the mobile communication device is behavioral data for the data object present on the mobile communication device.

20. The non-transitory computer readable storage medium of claim 17, wherein the received data identifying the data object present on the mobile communication device is metadata for the data object present on the mobile communication device.

21. The non-transitory computer readable storage medium of claim 17, wherein the received data identifying at least a portion of the data object present on the mobile communication device includes at least a portion of the data object present on the mobile communication device.

22. The non-transitory computer readable storage medium of claim 17, further comprising:

prior to receiving data identifying the data object present on the mobile communication device by the server computer, at the mobile communication device, analyzing the data identifying the data object present on the mobile communication device by a known good component resident on the mobile communication device to provide an assessment of the data object present on the mobile communication device; and

,

prior to receiving data identifying the data object present on the mobile communication device, if the analysis of the data identifying the data object present on the mobile communication device by the known good component on the mobile communication device does not result in an assessment that the data object is allowed, then, at the mobile communication device, transmitting metadata for the data identifying the data object present on the mobile communication device to the server computer, and, at the server computer, proceeding with analyzing the received metadata by the known good component on the server computer.

23. The non-transitory computer readable storage medium of claim 17, further comprising:

prior to receiving data identifying the data object present on the mobile communication device by the server computer, at the mobile communication device, analyzing the data identifying the data object present on the mobile communication device by a known bad component resident on the mobile communication device to provide an assessment of the data object present on the mobile communication device; and

,

if the analysis of the data identifying the data object present on the mobile communication device by the known bad component on the mobile communication device does not result in an assessment that the data object is undesirable, then, at the mobile communication device transmitting metadata for the data identifying the data object present on the mobile communication device to the server, and proceeding with analyzing the metadata to provide an assessment of the data object present on the mobile communication device.

24. The non-transitory computer readable storage medium of claim 17, further comprising:

prior to receiving data identifying the data object present on the mobile communication device by the server computer, at the mobile communication device, analyzing the data identifying the data object present on the mobile communication device by a known good component resident on the mobile communication device to provide an assessment of the data object present on the mobile communication device;

if the analysis of the data identifying the data object present on the mobile communication device by the known good component on the mobile communication device does not result in an assessment that the data object is allowed, then analyzing the data identifying the data object present on the mobile communication device by a known bad component resident on the mobile communication device to provide an assessment of the data object present on the mobile communication device; and

,

if the analysis of the data identifying the data object present on the mobile communication device by the known bad component on the mobile communication device does not result in assessment that the data object is undesirable, then transmitting at least a portion of the data identifying the data object present on the mobile communication device to the server, and at the server, proceeding with analyzing the received data to provide an assessment of the data object present on the mobile communication device.

25. The non-transitory computer readable storage medium of claim 17, further comprising:

prior to receiving data identifying the data object present on the mobile communication device by the server computer, at the mobile communication device, analyzing the data identifying the data object present on the mobile communication device by a known bad component resident on the mobile communication device to provide an assessment of the data object present on the mobile communication device;

if the analysis of the data identifying the data object present on the mobile communication device by the known bad component on the mobile communication device does not result in an assessment that the data object is undesirable, then analyzing the data by a known good component resident on the mobile communication device to provide an assessment of the data object present on the mobile communication device; and

,

if the analysis of the data identifying the data object present on the mobile communication device by the known good component on the mobile communication device does not result in an assessment that the data object is allowed, then transmitting at least a portion of the data identifying the data object present on the mobile communication device to the server, and at the server, proceeding with analyzing the received data to provide an assessment of the data object present on the mobile communication device.

26. The non-transitory computer readable storage medium of claim 17, further comprising:

if the assessment of the data identifying the data object present on the mobile communication device by the known good component resident on the mobile communication device does not result in a positive assessment that the data object is allowed, and if the analysis of the data identifying the data object present on the mobile communication device by the known bad component resident on the mobile communication device does not result in an assessment that the data object is undesirable, then

analyzing the data identifying the data object present on the mobile communication device by the server to provide an assessment identifying the data object present on the mobile communication device; and

,

storing the assessment of the data identifying the data object present on the mobile communication device on a data store accessible by the server.

27. A non-transitory computer-readable storage medium having stored thereon a plurality of instructions which, when executed by a processor, cause the processor to perform the steps of a method for assessing a data object present on a mobile communication device, the assessment provided by a server computer, the method comprising:

at the mobile communication device, determining, by the mobile communication device, if previously stored definition information in a local store corresponds to the data object present on the mobile communication device;

if the determination at the mobile communication device shows that the previously stored definition information in the local store does not correspond to the data object present on the mobile communication device, then, at a server computer, receiving data identifying at least a portion of the data object present on the mobile communication device;

determining, by the server computer, if previously stored definition information for a data object corresponds to the received data, the definition information stored in a data store accessible to the server, the data store storing a corresponding assessment for the definition information;

if the previously stored definition information corresponds to the received data, then, at the server, providing the assessment corresponding to the previously stored definition information; and

,

if the previously stored definition information in the data store accessible to the server does not correspond to the received data, then analyzing, by the server, at least a portion of the received data identifying at least a portion of the data object present on the mobile communication device to determine an assessment corresponding to the data object present on the mobile communication device.

28. The non-transitory computer readable storage medium of claim 27, wherein the data identifying at least a portion of the data object present on the mobile communication device is application data for the data object present on the mobile communication device.

29. The non-transitory computer readable storage medium of claim 27, wherein the data identifying at least a portion of the data object present on the mobile communication device is behavioral data for the data object present on the mobile communication device.

30. The non-transitory computer readable storage medium of claim 27, wherein the data identifying at least a portion of the data object present on the mobile communication device is metadata for the data object present on the mobile communication device.

31. The non-transitory computer readable storage medium of claim 27, wherein the data identifying at least a portion of the data object present on the mobile communication device includes at least a portion of the data object present on the mobile communication device.

32. The non-transitory computer readable storage medium of claim 27, wherein analyzing at least a portion of the received data identifying at least a portion of the data object present on the mobile communication device, by the server, to determine the assessment comprises analyzing the data by a decision component accessible by the server.

33. The non-transitory computer readable storage medium of claim 27, further comprising:

requesting, by the server, additional data pertaining to the data object present on the mobile communication device; and

,

analyzing the additional data to determine an assessment corresponding to the data object present on the mobile communication device.

34. The non-transitory computer readable storage medium of claim 27, further comprising, after the step of providing the assessment, if the assessment indicates that the data object present on the mobile communication device is undesirable, then at the server, transmitting instructions to the mobile communication device to prevent the mobile communication device from accessing the data object present on the mobile communication device.

35. The non-transitory computer readable storage medium of claim 27, further comprising, after the step of providing the assessment, if the assessment indicates that the data object on the mobile communication device is undesirable, then at the server, transmitting a notification to the mobile communication device.

36. The non-transitory computer readable storage medium of claim 27, wherein the notification is a warning.

37. The non-transitory computer readable storage medium of claim 27, wherein the notification is an instruction to uninstall the data object.

38. The non-transitory computer readable storage medium of claim 27, wherein the notification is an instruction preventing the mobile communication device from accessing the data object.

39. A method comprising:

storing at a server definition information for a data object;

storing at the server a corresponding assessment for the definition information;

receiving at the server data identifying at least a portion of a data object on a mobile communication device, wherein the data identifying the at least a portion of the data object on the mobile communication device is received at the server when previously stored definition information in a local store at the mobile communication device does not correspond to the data identifying the at least a portion of the data object on the mobile communication device;

determining if the definition information that is stored at the server corresponds to the received data; and

if the definition information that is stored at the server corresponds to the received data, providing the corresponding assessment.

40. A method comprising:

storing at a server definition information for a data object;

storing at the server a corresponding assessment for the definition information;

receiving at the server data identifying at least a portion of a data object on a mobile communication device, wherein the data identifying the at least a portion of the data object on the mobile communication device is received at the server after the mobile communication device determines that previously stored definition information at the mobile communication device does not correspond to the data identifying the at least a portion of the data object on the mobile communication device;

if the definition information stored at the server corresponds to the received data, providing the corresponding assessment;

if the definition information stored at the server does not correspond to the received data, at the server, analyzing at least a portion of the received data identifying at least a portion of the data object on the mobile communication device to determine an assessment corresponding to the data object on the mobile communication device; and

at the server, providing the corresponding assessment resulting from the analyzing step if it is performed.

41. A method comprising:

receiving at a server data identifying a data object on a mobile communication device;

analyzing the received data by a known good component on the server to provide an assessment of the data object;

if the analysis of the received data by the known good component on the server results in an assessment that the data object is allowed, transmitting instructions to the mobile communication device to permit access to the data object;

if the analysis of the received data by the known good component does not result in an assessment that the data object is allowed, analyzing the received data by a known bad component on the server to provide an assessment of the data object; and

if the analysis of the received data by the known bad component results in an assessment that the data object is undesirable, transmitting instructions to the mobile communication device to deny access to the data object.

42. The method of claim 41 wherein the data identifying the data object on the mobile communication device is received at the server after the mobile communication device analyzes the data identifying the data object on the mobile communication device using a known good component on the mobile communication device, and

the analysis by the known good component on the mobile communications device does not result in an assessment that the data object on the mobile communication device is allowed.

43. The method of claim 41 comprising:

at the server, receiving metadata for the data identifying the data object on the mobile communication device; and

analyzing the received metadata by the known good component on the server, wherein the metadata is received when an analysis of the data identifying the data object on the mobile communication device by a known good component on the mobile communication device does not result in an assessment that the data object on the mobile communication device is allowed.

44. The method of claim 41 wherein the data identifying the data object on the mobile communication device is received at the server after the mobile communication device analyzes the data identifying the data object on the mobile communication device using a known bad component stored on the mobile communication device, and

the analysis does not result in an assessment that the data object is undesirable.

45. The method of claim 41 comprising:

at the server, receiving metadata for the data identifying the data object on the mobile communication device; and

at the server, analyzing the received metadata to provide an assessment of the data object on the mobile communication device, wherein the metadata is received when an analysis of the data identifying the data object on the mobile communication device using a known bad component on the mobile communication device does not result in an assessment that the data object is undesirable.

46. The method of claim 41 wherein the data identifying the data object on the mobile communication device is received at the server after the mobile communication device analyzes the data identifying the data object on the mobile communication device using a known good component stored on the mobile communication device, and

the analysis by the known good component does not result in an assessment that the data object is allowed,

wherein if the analysis by the known good component does not result in the assessment that the data object is allowed, the mobile communication device analyzes the data identifying the data object on the mobile communication device using a known bad component on the mobile communication device to provide an assessment of the data object on the mobile communication device, and

wherein if the analysis of the data identifying the data object on the mobile communication device using the known bad component on the mobile communication device does not result in an assessment that the data object is undesirable, at the server, receiving from the mobile device at least a portion of the data identifying the data object on the mobile communication device and analyzing the received data to provide an assessment of the data object on the mobile communication device.

47. The method of claim 41 wherein the data identifying the data object on the mobile communication device is received at the server after the mobile communication device analyzes the data identifying the data object on the mobile communication device using a known bad component on the mobile communication device, and

the analysis by the known bad component does not result in an assessment that the data object is undesirable,

wherein if analysis using the known bad component does not result in the assessment that the data object is undesirable, the mobile communication device analyzes the data identifying the data object on the mobile communication device using a known good component on the mobile communication device to provide an assessment of the data object on the mobile communication device, and

wherein if the analysis of the data identifying the data object on the mobile communication device using the known good component does not result in an assessment that the data object is allowed, at the server, receiving from the mobile device at least a portion of the data identifying the data object on the mobile communication device and analyzing the received data to provide an assessment of the data object on the mobile communication device.

48. The method of claim 41 wherein the receiving at the server the data identifying the data object on the mobile communication device is in response to an assessment of the data identifying the data object on the mobile communication device using a known good component on the mobile communication device that does not result in a positive assessment that the data object is allowed, and

an analysis of the data identifying the data object on the mobile communication device using a known bad component on the mobile communication device that does not result in an assessment that the data object is undesirable.

49. The method of claim 41 comprising:

if the analysis of the received data using the known bad component does not result in an assessment that the data object is undesirable, and the analysis of the received data using the known good component does not result in an assessment that the data object is allowed, transmitting instructions to the mobile communication device to permit access to the data object.

50. The method of claim 41 comprising:

if the analysis of the received data using the known bad component does not result in an assessment that the data object is undesirable, and the analysis of the received data using the known good component does not result in an assessment that the data object is allowed, at the server, transmitting instructions to the mobile communication device to deny access to the data object.

51. A method comprising:

receiving at a server data identifying a data object on a mobile communication device;

analyzing the received data using a known bad component stored on the server to provide an assessment of the data object;

if the analysis of the received data using the known bad component results in an assessment that the data object is undesirable, at the server, transmitting instructions to the mobile communication device to deny access to the data object;

if the analysis of the received data using the known bad component does not result in the assessment that the data object is undesirable, analyzing the received data using a known good component on the server to provide an assessment of the data object; and

if the analysis of the received data by the known good component results in an assessment that the data object is allowed, transmitting instructions to the mobile communication device to permit access to the data object.

52. The method of claim 51 comprising:

if the analysis of the received data using the known bad component does not result in the assessment that the data object is undesirable, and the analysis of the received data using the known good component does not result in the assessment that the data object is allowed, at the server, transmitting instructions to the mobile communication device to permit access to the data object.

53. The method of claim 51 comprising:

if the analysis of the received data using the known bad component does not result in the assessment that the data object is undesirable, and the analysis of the received data using the known good component does not result in the assessment that the data object is allowed, at the server, transmitting instructions to the mobile communication device to deny access to the data object.