Methods of detection of software exploitation

• US 8,943,592 B1
• Filed: 07/15/2013
• Issued: 01/27/2015
• Est. Priority Date: 07/15/2013
• Status: Active Grant

• Current Assignee: ESET, spol. s.r.o.
• Original Assignee: ESET, spol. s.r.o.
• Inventors: Mirski, Pawel, Hlavaty, Peter, Kosinar, Peter
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US13/942,385
• Publication Number:
  US 20150020198A1
• Time in Patent Office: 561 Days
• Field of Search: 726 22- 27, 709217-224
• US Class Current: 726/23
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/033 Test or assess software

Abstract

A method for detecting software exploitation broadly comprises the steps of gathering information about processes and threads executing on a computing device, monitoring instructions executed by a thread that is currently running, performing the following steps if a function to create a process or a function to load a library is called, examining a thread information block, determining whether an address included in a stack pointer of the thread is in a range of addresses for a stack specified by the thread information block, and determining whether a first plurality of no-operation instructions is followed by shell code that is followed by a second plurality of no-operation instructions.

Claims

1. A non-transitory computer-readable storage medium with an executable program stored thereon for detecting software exploitation, wherein the program instructs a processing element to perform the following steps:

gathering information about processes and threads executing on a computing device;

monitoring instructions executed by a thread that is currently running; and

performing the following steps when a function to create a process or a function to load a library is called;

examining a thread information block,

determining whether an address included in a stack pointer of the thread is in a range of addresses for a stack specified by the thread information block,

examining the contents of a plurality of memory addresses,

determining whether a first plurality of no-operation instructions is followed by shell code that is followed by a second plurality of no-operation instructions, and

displaying a message to a user that a possible software exploit has been detected when the address included in the stack pointer is not in the range of stack addresses.

2. The computer-readable storage medium of claim 1, wherein the information includes the starting address of the thread.

3. The computer-readable storage medium of claim 1, wherein the program further comprises the step of recording in an internal log that the address included in the stack pointer is not in the range of stack addresses if the address included in the stack pointer is not in the range of stack addresses.

4. The computer-readable storage medium of claim 1, wherein the program further comprises the step of recording in an internal log that the first plurality of no-operation instructions followed by shell code followed by the second plurality of no-operation instructions was detected if the first plurality of no-operation instructions followed by shell code followed by the second plurality of no-operation instructions was detected.

5. The computer-readable storage medium of claim 1, wherein the program further comprises the step of displaying a message to a user that a possible software exploit has been detected if the first plurality of no-operation instructions followed by shell code followed by the second plurality of no-operation instructions was detected.