Preventing unauthorized loading of late binding code into a process

• US 7,565,686 B1
• Filed: 11/08/2004
• Issued: 07/21/2009
• Est. Priority Date: 11/08/2004
• Status: Active Grant

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Sobel, William E., Kennedy, Mark
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Baum; Ronald
• Application Number:
  US10/983,374
• Time in Patent Office: 1,716 Days
• Field of Search: 726/2
• US Class Current: 726/2
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A late binding code manager prevents the unauthorized loading of late binding code into a process. The late binding code manager detects an attempt to load late binding code into a process'"'"'s address space. Subsequently, the late binding code manager determines whether a detected attempt to load late binding code into a process'"'"'s address space is permitted. Responsive to the results of a determination as to whether an attempt to load late binding code into a process'"'"'s address space is permitted, the late binding code manager executes at least one additional step affecting the loading of the late binding code into the process'"'"'s address space. Such a step can comprise permitting, blocking or modifying the attempt to load the late binding code.

Claims

1. A computer-implemented method for preventing unauthorized loading of late binding code into a process, said method comprising the steps of:

detecting, by a late binding code manager executing on a computer, an attempt to load late binding code into a process'"'"'s address space, the detecting comprising detecting access of a registry key that enumerates late binding code to load into the process'"'"'s address space;

determining, by the late binding code manager executing on the computer, whether the attempt to load late binding code into the process'"'"'s address space is permitted; and

responsive to determining that the attempt to load late binding code is not permitted, preventing, by the late binding code manager executing on the computer, at least some of the late binding code from being loaded into the process'"'"'s address space.

2. The method of claim 1 further comprising:

monitoring, by the late binding code manager executing on the computer, access of the registry key.

3. The method of claim 1 further comprising:

detecting, by the late binding code manager executing on the computer, that a second process is accessing the registry key.

4. The method of claim 3 wherein:

the process accessing the registry key houses user32.dll.

5. The method of claim 1 wherein determining whether the attempt to load late binding code is permitted further comprises:

determining, by the late binding code manager executing on the computer, whether at least some late binding code which is a target of the detected attempt is on a white list.

6. The method of claim 1 wherein determining whether the attempt to load late binding code is permitted further comprises:

determining, by the late binding code manager executing on the computer, whether at least some late binding code which is a target of the detected attempt is on a black list.

7. The method of claim 1 wherein determining whether the attempt to load late binding code is permitted further comprises:

determining, by the late binding code manager executing on the computer, whether at least some late binding code which is a target of the detected attempt is digitally signed.

8. The method of claim 1 wherein determining whether the attempt to load late binding code is permitted further comprises:

determining, by the late binding code manager executing on the computer, whether at least some late binding code which is a target of the detected attempt originates from a trusted source.

9. The method of claim 1 wherein determining that the attempt to load late binding code is not permitted comprises:

determining, by the late binding code manager executing on the computer, that at least some of the late binding code meets at least one criteria from a group of criteria consisting of;

being on a black list;

not being on a white list;

not being digitally signed; and

not originating from a trusted source.

10. The method of claim 9 further comprising the late binding code manager executing on the computer performing at least one step from a group of steps consisting of:

preventing late binding code that is on a black list from being loaded into the process'"'"'s address space;

preventing late binding code that is not on a white list from being loaded into the process'"'"'s address space;

preventing late binding code that is not digitally signed from being loaded into the process'"'"'s address space; and

preventing late binding code that does not originate from a trusted source from being loaded into the process'"'"'s address space.

11. The method of claim 1 further comprising:

responsive to determining that the attempt to load late binding code is permitted, the late binding code manager executing on the computer allowing at least some of the late binding code to be loaded into the process'"'"'s address space.

12. The method of claim 11 wherein determining that the attempt to load late binding code is permitted further comprises:

determining, by the late binding code manager executing on the computer, that at least some of the late binding code meets at least one criteria from a group of criteria consisting of;

not being on a black list;

being on a white list;

being digitally signed; and

originating from a trusted source.

13. The method of claim 12 further comprising the late binding code manager executing on the computer performing at least one step from a group of steps consisting of:

allowing late binding code that is not on a black list to be loaded into the process'"'"'s address space;

allowing late binding code that is on a white list to be loaded into the process'"'"'s address space;

allowing late binding code that is digitally signed to be loaded into the process'"'"'s address space;

allowing late binding code that originates from a trusted source to be loaded into the process'"'"'s address space.

14. The method of claim 1 wherein determining whether the attempt to load late binding code is permitted further comprises:

determining, by the late binding code manager executing on the computer, whether the process into the address space of which the late binding code is being attempted to be loaded is protected.

15. A computer-readable storage medium storing computer-executable code for preventing unauthorized loading of late binding code into a process, the computer-executable code comprising instructions for performing the steps of:

detecting an attempt to load late binding code into a process'"'"'s address space, the detecting comprising detecting access of a registry key that enumerates late binding code to load into the process'"'"'s address space;

determining whether the attempt to load late binding code into the process'"'"'s address space is permitted; and

responsive to determining that the attempt to load late binding code is not permitted, preventing at least some of the late binding code from being loaded into the process'"'"'s address space.

16. The computer program product of claim 15 wherein the computer-executable code further comprises instructions for performing the step of:

responsive to determining that the attempt to load late binding code is permitted, allowing at least some of the late binding code to be loaded into the process'"'"'s address space.

17. The computer program product of claim 15 wherein the computer-executable code further comprises instructions for performing the step of:

detecting that a second process is accessing the registry key.

18. The computer program product of claim 15 wherein determining whether the attempt to load late binding code is permitted further comprises:

determining whether at least some late binding code which is a target of the detected attempt is on a white list.