Extensible activation exploit scanner

• US 8,146,158 B2
• Filed: 12/30/2008
• Issued: 03/27/2012
• Est. Priority Date: 12/30/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Gurevich, Peter Alexi
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Getachew, Abiy
• Application Number:
  US12/346,391
• Publication Number:
  US 20100169976A1
• Time in Patent Office: 1,183 Days
• Field of Search: 726/22, 717/168
• US Class Current: 726/22
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data

Abstract

An extensible activation exploit scanner may have a modular structure, such that capabilities of the activation exploit scanner may be updated easily. The extensible activation exploit scanner may include an exploit data file, at least one detection module, at least one response module, and a base scanner. The exploit data file may have a number of entries, each of which may include information about a respective activation exploit or a respective class of activation exploit, as well as information about a detection module and a response module. The activation exploit scanner may read an entry of the exploit data file, may execute a detection module, corresponding to the entry, to detect a respective activation exploit or class of activation exploit, and may execute a response module, corresponding to the entry, to perform an action when the respective activation exploit or the class of activation exploit is detected.

Claims

1. A method, performed on a processing device, for detecting an activation exploit, the method comprising:

executing, by at least one processor of the processing device, at least one detection module, each of the at least one detection module being specific for detecting a respective known activation exploit or a respective class of activation exploit, the respective known activation exploit or the respective class of activation exploit being for deceiving authentication components, such that a counterfeit copy of software is authenticated as a genuine copy of the software;

executing, by the at least one processor of the processing device, at least one response module, each of the at least one response module includes response logic for performing a corresponding action in response to detecting the respective known activation exploit or the respective class of activation exploit; and

executing, by the at least one processor of the processing device, a scanner, which uses an exploit data file, the at least one detection module, and the at least one response module, the exploit data file including information regarding at least one known activation exploit.

2. The method of claim 1, wherein:

the information regarding at least one known activation exploit or class of activation exploit comprises a breach identifier corresponding to one of the at least one known activation exploit or the class of activation exploit, an identifier corresponding to an application or an operating system associated with the one of the at least one known activation exploit or the class of activation exploit, location information of a detection module of the at least one detection module, and location information of a response module of the at least one response module, and

the method further comprises;

determining, by the scanner, whether the detection module and the response module are present based on the information included in the exploit data file; and

when the detection module and the response module are determined to be present, the scanner performs;

scanning to detect a presence of the one of the at least one known activation exploit or the class of activation exploit by executing the detection module, and

performing a corresponding action in response to detecting the presence of the one of the at least one known activation exploit or the class of activation exploits by executing the response module.

3. The method of claim 2, further comprising:

determining whether the one of the at least one known activation exploit or the class of activation exploit applies to the processing device, based on the information included in the exploit data file; and

scanning, by the scanner, to detect a presence of the one of the at least one known activation exploit or the class of activation exploit only when the one of the at least one activation exploit or the class of activation exploit is determined to apply to the processing device.

4. The method of claim 2, wherein the performing of a corresponding action further comprises:

executing, by the response module, one or more response sub-modules.

5. The method of claim 4, wherein the one or more response sub-modules perform one or more actions from a group of actions comprising sending telemetry data, providing a pop up user interface, providing a notification regarding detection of the detected one of the at least one activation exploit or the detected class of activation exploit, and removing the detected one of the at least one activation exploit or the detected class of activation exploits.

6. The method of claim 1, further comprising:

updating a capability to detect an activation exploit or class of activation exploit by replacing one or more of the at least one detection module with corresponding one or more replacement detection modules or by adding one or more new detection modules.

7. The method of claim 1, further comprising:

updating a capability to respond to a detected activation exploit or a detected class of activation exploit by replacing one or more of the at least one response module with corresponding one or more replacement response modules or by adding one or more new response modules.

8. A system for an extensible activation exploit scanner installed on a processing device, the system comprising:

at least one detection module, each of the at least one detection module including a respective signature for detecting a respective known activation exploit or a respective known class of activation exploit, the respective known activation exploit or the respective known class of activation exploit being for deceiving authentication components, such that a counterfeit copy of software is authenticated as a genuine copy of the software, the respective signature being an algorithm that is specific to detecting the respective known activation exploit or the respective known class of activation exploit;

at least one response module, each of the at least one response module for performing a corresponding action responsive to detecting the respective known activation exploit or the respective known class of activation exploit;

an exploit data file including at least one entry, each of the at least one entry including an identifier corresponding to a respective known activation exploit or a respective known class of activation exploit, location information of one of the at least one detection module, and location information of one of the at least one response module; and

a scanner for scanning for a presence of the respective known activation exploit or the respective known class of activation exploit by calling a detection module of the at least one detection module identified by an entry of the exploit file as being for detecting the respective known activation exploit or the respective known class of activation exploit, and the scanner further being for responding to the presence of the respective known activation exploit or the respective known class of activation exploit by calling a response module of the at least one response module identified by the entry of the exploit file.

9. The system of claim 8, wherein:

before scanning for the presence of the respective known activation exploit or the respective known class of activation exploit, the scanner reads the entry of the exploit file to obtain the location information of the detection module and the location information of the response module and determines whether the detection module and the response module are present, and

the scanner scans for the presence of the respective known activation exploit or the respective known class of activation exploit only when the detection module and the response module are determined to be present.

10. The system of claim 8, wherein:

each of the at least one entry of the exploit file includes an identifier corresponding to an application or an operating system associated with the respective known activation exploit or the respective known class of activation exploit.

11. The system of claim 10, wherein:

the scanner scans for the respective known activation exploit or the respective known class of activation exploit only when the respective known activation exploit or the respective known class of activation exploit applies to the processing device, based on the identifier, corresponding to an application or an operating system, included in a corresponding one of the at least one entry.

12. The system of claim 8, wherein the at least one response module executes one or more response sub-modules to perform one or more actions.

13. The system of claim 12, wherein the one or more actions include one or more actions from a group of actions comprising sending telemetry data, providing a pop-up user interface, providing a notification regarding detection of a known activation exploit or a known class of activation exploit, and removing a detected activation exploit or a detected class of activation exploit.

14. The system of claim 12, wherein the scanner is extensible by:

changing the exploit data file, and

performing at least one of;

changing a module of any of the at least one detection module,

changing a module of any of the at least one response module,

adding a new detection module, or

adding a new response module.

15. A machine-readable storage device having instructions recorded thereon for a processing device to perform a method comprising:

reading, by the processing device, an entry of an exploit data file, the entry including an identifier corresponding to a known activation exploit, location information of a detection module, and location information of a response module, the known activation exploit being for deceiving authentication components, such that a counterfeit copy of software is authenticated as a genuine copy of the software;

using, by the processing device, the location information of the detection module to execute the detection module to detect whether the known activation exploit is present; and

using, by the processing device, the location information of the response module to execute the response module to perform one or more actions in response to the detection module detecting that the known activation exploit is present.

16. The machine-readable storage device of claim 15, wherein the method further comprises:

using the detection module to determine whether a file is present which, when hashed, produces a hash that matches a breach file hash included in the entry of the exploit data file.

17. The machine-readable storage device of claim 15, wherein:

the response module executes one or more sub-modules, and

each of the sub-modules is for performing an action from a group of actions.

18. The machine-readable storage device of claim 17, wherein the group of actions comprise:

sending telemetry data;

informing a user about the detected known activation exploit; and

removing the detected known activation exploit.

19. The machine-readable storage device of claim 15, wherein the method further comprises:

updating detection capabilities by performing one or more of;

replacing the detection module; and

adding a new detection module and replacing the exploit data file with a new exploit data file, the new exploit data file including an entry having location information of the new detection module.

20. The machine-readable storage device of claim 15, wherein the method further comprises:

updating a response capability by replacing the response module.