Functional patching/hooking detection and prevention

• US 8,239,940 B2
• Filed: 08/07/2009
• Issued: 08/07/2012
• Est. Priority Date: 12/25/2008
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: Trusteer Incorporated (International Business Machines Corporation)
• Inventors: Klein, Amit, Izmerly, Oleg, Regev, Shmuel, Ben-Haim, Eldan
• Primary Examiner(s): Lipman, Jacob
• Application Number:
  US12/537,893
• Publication Number:
  US 20100169969A1
• Time in Patent Office: 1,096 Days
• Field of Search: 726/22
• US Class Current: 726/22
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 9/328 for runtime instruction patching

Abstract

A method for preventing malicious attacks on software, using the patching method, includes providing a database of legitimate and known patches, the database contains characteristic code paths of said legitimate patches. The method also includes detecting whether a patch is malicious by inspecting one or more characteristic paths of the patch and matching one or more code paths against the database of legitimate and known patches. An activity needed to prevent the malicious patch from performing undesired activities is then performed.

Claims

1. A method for preventing malicious attacks on software using a patching method, comprising the steps of:

a) providing a database of legitimate and known patches, which database contains characteristic code paths of said legitimate patches;

b) detecting whether a first inspected patch is malicious by inspecting one or more characteristic code paths of said first inspected patch and matching said one or more characteristic code paths of said first inspected patch against said database of legitimate and known patches;

c) if a mismatch is found, determining whether said first inspected patch is a malicious patch and performing an activity needed to prevent said malicious patch from performing undesired activities by correcting or removing said malicious patch;

d) obtaining information from said database regarding where to search for a next inspected patch; and

e) repeating steps a) to d) until no match is found in said database.

2. A method according to claim 1, wherein performing an activity needed to prevent said malicious patch from performing undesired activities comprises making changes to said malicious patch to prevent said malicious patch from performing undesired activities, or deleting said malicious patch.

3. A method according to claim 1, wherein the characteristic code path inspected includes a pointer to a function in an Export Address Table (EAT).

4. A method according to claim 1, wherein the characteristic code path inspected includes a pointer to a function in an Import Address Table (IAT) of currently loaded modules.

5. A method according to claim 1, wherein the characteristic code path inspected includes a code of a function.

6. A method according to claim 1, comprising providing in the database also information regarding where to look for the next patch.

7. A method according to claim 1, further comprising providing in the database information on how to represent the code being examined as a continuous code.

8. The method according to claim 1, wherein the software is a browser.

9. A method according to claim 1, wherein performing an activity needed to prevent said malicious patch from performing undesired activities comprises reporting the presence of the malicious patch to a receiving entity.

10. A method according to claim 9, wherein said receiving entity is selected from one or more of a remote software agent, a local software agent, or a user.