System, apparatus and method for conducting on-the-fly decryption of encrypted objects for malware detection

• US 9,560,059 B1
• Filed: 11/16/2015
• Issued: 01/31/2017
• Est. Priority Date: 11/21/2013
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: FireEye, Inc.
• Inventors: Islam, Ali
• Primary Examiner(s): Jeudy, Josnel
• Application Number:
  US14/942,327
• Time in Patent Office: 442 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 12/2865 Logical combinations
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 61/45 Network directories; Name-to-address mapping
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04L 9/065 Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A decryption scheme for recover of a decrypted object without a cryptographic key is described. First, logical operation(s) are conducted on data associated with a first data string expected at a first location within an object having the predetermined format and data within the encrypted object at the first location to recover data associated with a portion of a cryptographic key from the encrypted object. Thereafter, logical operation(s) are conducted on that data and a first portion of the encrypted object at a second location to produce a result. Responsive to the result including data associated with the plaintext version of the second data string, logical operation(s) are conducted on a second portion of the encrypted object and the data associated with the plaintext version of the second data string to recover data associated with the cryptographic key. Thereafter, the encrypted object may be decrypted using the cryptographic key.

Claims

1. A computerized method for decrypting an encrypted object having a predetermined format that is received by an electronic device, the method comprising:

performing, by a processor, one or more logical operations at least on (i) data associated with a first data string expected at a first location within the encrypted object having the predetermined format and (ii) data within the encrypted object at the first location to recover data associated with a portion of a cryptographic key from the encrypted object;

conducting, by the processor, one or more logical operations at least on (i) the data associated with the portion of the cryptographic key and (ii) a first portion of the encrypted object at a second location within the encrypted object to produce a result, wherein the second location being different than the first location and the result includes a portion of data associated with a plaintext version of a second data string that is expected at the second location;

responsive to the result including data associated with the plaintext version of the second data string, conducting one or more logical operations by the processor at least on (i) a second portion of the encrypted object and (ii) the data associated with the plaintext version of the second data string expected at the second location to recover data associated with the cryptographic key, wherein the recovered data associated with the cryptographic key includes the data associated with the portion of the cryptographic key; and

decrypting, by the processor, the encrypted object using the cryptographic key to produce a decrypted object.

2. The computerized method of claim 1, wherein the recovered data associated with the cryptographic key is the cryptographic key and the data associated with the portion of the cryptographic key is a portion of the cryptographic key.

3. The computerized method of claim 1 further comprising:

performing a static scanning operation associated with the decrypted object to determine whether the decrypted object is suspected of including malware; and

classifying the decrypted object to identify a suspected presence of malware when the static scanning operation determines that the decrypted object includes malware.

4. The computerized method of claim 1, wherein the conducting of the one or more logical operations on the data associated with the first data string and the data within the encrypted object at the first location comprises conducting a first Exclusive OR (XOR) operation on a first plurality of alphanumeric characters and a portion of the encrypted object at a first prescribed address.

5. The computerized method of claim 4, wherein the one or more logical operations conducted on the second portion of the encrypted object and the data associated with the plaintext version of the second data string further comprises a second Exclusive OR (XOR) operation on the second portion of the encrypted object and the data associated with the plaintext version of the second data string, the data associated with the plaintext version of the second data string includes a second plurality of alphanumeric characters greater in number than the first plurality of alphanumeric characters of the first data string.

6. The computerized method of claim 1, wherein the conducting of the one or more logical operations on the second portion of the encrypted object and the data associated with the plaintext version of the second data string expected at the second location comprises conducting an Exclusive OR (XOR) operation on the second portion of the encrypted object that corresponds to a plurality of alphanumeric characters and the data associated with the plaintext version of the second data string corresponds to an anticipated plaintext version of the plurality of alphanumeric characters.

7. The computerized method of claim 1, wherein the data associated with the first data string comprises a first plurality of alphanumeric characters, the result comprises a second plurality of alphanumeric characters greater in number than the first plurality of alphanumeric characters, and the data associated with the second data string comprises a third plurality of alphanumeric characters greater in number than the second plurality of characters.

8. The computerized method of claim 7, wherein each of the logical operations operates as an Exclusive OR (XOR) operation.

9. The computerized method of claim 1, wherein prior to decrypting the encrypted object using the cryptographic key, the method further comprises validating the cryptographic key.

10. The computerized method of claim 9, wherein the validating of the cryptographic key comprises

conducting one or more logical operations on both a third portion of the encrypted object and the cryptographic key to recover a value associated with an address offset;

conducting one or more logical operations on the third portion of the encrypted object at the address offset and the cryptographic key to recover a data string; and

comparing the data string to a prescribed data string expected at the address offset.

11. The computerized method of claim 1 further comprising analyzing the decrypted object by one or more virtual machines and monitoring for anomalous or unexpected activity indicative of the presence of malware.

12. The computerized method of claim 1, wherein the receiving of the encrypted object comprises (i) determining that the encrypted object is embedded with a second object and (ii) extracting the encrypted object from the second object.

13. A non-transitory computer readable medium that includes software that, when executed by a processor, decrypts an encrypted object having a predetermined format, comprising:

performing one or more logical operations at least on data associated with a first data string expected at a first location within an object having the predetermined format and data within the encrypted object at the first location to recover data associated with a portion of a cryptographic key from the encrypted object;

conducting one or more logical operations at least on the data associated with the cryptographic key and a first portion of the encrypted object at a second location within the encrypted object to produce a result, wherein the second location being different than the first location and the result includes a portion of data associated with a plaintext version of a second data string that is expected at the second location;

responsive to the result including data associated with the plaintext version of the second data string, conducting one or more logical operations at least on a second portion of the encrypted object and the data associated with the plaintext version of the second data string expected at the second location to recover data associated with the cryptographic key, wherein the recovered data associated with the cryptographic key includes the data associated with the portion of the cryptographic key; and

decrypting the encrypted object using the cryptographic key to produce a decrypted object.

14. The non-transitory computer readable medium of claim 13, wherein the software, when executed by the processor, further perform operations comprising:

performing a static scanning operation associated with the decrypted object, where results of the static scanning operation are used to classify the decrypted object to identify a suspected presence of malware; and

issuing one or more alerts to identify a presence of malware within the encrypted object.

15. The non-transitory computer readable medium of claim 13, wherein the one or more logical operations conducted on the data associated with the first data string and the data within the encrypted object at the first location comprises a first Exclusive OR (XOR) operation conducted on a first plurality of alphanumeric characters and a portion of the encrypted object at a first prescribed address.

16. The non-transitory computer readable medium of claim 15, wherein the one or more logical operations conducted on the second portion of the encrypted object and the data associated with the plaintext version of the second data string further comprises a second Exclusive OR (XOR) operation on the second portion of the encrypted object and the data associated with the plaintext version of the second data string, the data associated with the plaintext version of the second data string includes a second plurality of alphanumeric characters greater in number than the first plurality of alphanumeric characters of the first data string.

17. The non-transitory computer readable medium of claim 13, wherein the data associated with the first data string comprises a first plurality of alphanumeric characters, the result comprises a second plurality of alphanumeric characters greater in number than the first plurality of characters, and the data associated with the second data string comprises a third plurality of alphanumeric characters greater in number than the second plurality of alphanumeric characters.

18. The non-transitory computer readable medium of claim 17, each of the logical operations operates as one or more Exclusive OR (XOR) operations.

19. The non-transitory computer readable medium of claim 18, wherein prior to decrypting the encrypted object using the cryptographic key, the software, when executed by the processor, further validating the cryptographic key.

20. The non-transitory computer readable medium of claim 19, wherein

the validating of the cryptographic key comprises conducting one or more logical operations on both a third portion of the encrypted object and the cryptographic key to recover a value associated with an address offset;

conducting one or more logical operations on the third portion of the encrypted object at the address offset and the cryptographic key to recover a data string; and

comparing the data string to a prescribed data string expected at the address location.

21. The non-transitory computer readable medium of claim 13, wherein the software, when executed by the processor, further performs the operations comprising analyzing the decrypted object by virtual execution of the decrypted object by one or more virtual machines and monitoring for anomalous or unexpected activity indicative of the presence of malware.

22. An electronic device, comprising:

one or more hardware processors; and

a memory communicatively coupled to the one or more hardware processors, the memory including one or more software modules that, upon execution by the one or more hardware processors, conducts a first scanning operation on an encrypted object to recover a decrypted object, wherein the first scanning operation comprises

performing one or more logical operations at least on data associated with a first data string expected at a first location within an object having the predetermined format and data within the encrypted object at the first location to recover data associated with a portion of a cryptographic key from the encrypted object,

conducting one or more logical operations at least on the data associated with the cryptographic key and a first portion of the encrypted object at a second location within the encrypted object to produce a result, wherein the second location being different than the first location and the result includes a portion of data associated with a plaintext version of a second data string that is expected at the second location,

responsive to the result including data associated with the plaintext version of the second data string, conducting one or more logical operations at least on a second portion of the encrypted object and the data associated with the plaintext version of the second data string expected at the second location to recover data associated with the cryptographic key, wherein the recovered data associated with the cryptographic key includes the data associated with the portion of the cryptographic key, and

decrypting the encrypted object using the cryptographic key to produce the decrypted object.

23. The electronic device of claim 22, wherein the one or more hardware processors, upon execution of the one or more software modules, further comprises:

performing a second scanning operation associated with the decrypted object to determine whether the decrypted object is suspected of including malware; and

classifying the decrypted object to identify a suspected presence of malware based on results of the second scanning operation.

24. The electronic device of claim 22, wherein the one or more hardware processors, upon execution of the one or more software modules, conducting the one or more logical operations on the data associated with and part of the first data string and the data within the encrypted object at the first location that comprises a first Exclusive OR (XOR) operation on a first plurality of alphanumeric characters and a portion of the encrypted object at a first prescribed address.

25. The electronic device of claim 24, wherein the one or more hardware processors, upon execution of the one or more software modules, conducting the one or more logical operations on the second portion of the encrypted object and the data associated with the plaintext version of the second data string that comprises a second Exclusive OR (XOR) operation on the second portion of the encrypted object and the data associated with the plaintext version of the second data string, the data associated with the plaintext version of the second data string includes a second plurality of alphanumeric characters greater in number than the first plurality of alphanumeric characters of the first data string.

26. The electronic device of claim 22, wherein the one or more hardware processors, upon execution of the one or more software modules, conduct the one or more logical operations on the second portion of the encrypted object and the data associated with the plaintext version of the second data string expected at the second location that comprise conducting an Exclusive OR (XOR) operation on the second portion of the encrypted object that corresponds to a first plurality of alphanumeric characters and the data associated with the plaintext version of the second data string corresponds to an anticipated plaintext version of the first plurality of alphanumeric characters.

27. The electronic device of claim 22, wherein the data associated with the first data string comprises a first plurality of alphanumeric characters, the result comprises a second plurality of alphanumeric characters greater in number than the first plurality of alphanumeric characters, and the data associated with the second data string comprises a third plurality of alphanumeric characters greater in number than the second plurality of characters.

28. The electronic device of claim 27, wherein the one or more hardware processors, upon execution of the one or more software modules, conduct the one or more logical operations that operate as one or more Exclusive OR (XOR) operations.

29. The electronic device of claim 22, wherein the one or more hardware processors, upon execution of the one or more software modules and prior to decrypting the encrypted object using the cryptographic key, further validates the cryptographic key.

30. The electronic device of claim 29, wherein the one or more hardware processors, upon execution of the one or more software modules, validates the cryptographic key by

conducting one or more logical operations on both a third portion of the encrypted object and the cryptographic key to recover a value associated with an address offset;

conducting one or more logical operations on the third portion of the encrypted object at the address offset and the cryptographic key to recover a data string; and

comparing the data string to a prescribed data string expected at the address offset.

31. The electronic device of claim 22, wherein the one or more hardware processors, upon execution of the one or more software modules, further performing a second scanning operation associated with the decrypted object to determine whether the decrypted object is suspected of including malware;

and classifying the decrypted object to identify a suspected presence of malware based on results of the second scanning operation.

32. The electronic device of claim 22, wherein the one or more software modules further comprises a reporting module that, upon execution by the one or more hardware processors, transmits an alert indicating a presence of malware within the encrypted object.

33. The electronic device of claim 22, wherein prior to conducting the first scanning operation, the one or more hardware processors, upon execution of the one or more software modules, receive an object, determines that the object is embedded with a second object and (ii) extracting the second object as the encrypted object from the first object.

34. The electronic device of claim 33, wherein the alert comprises reference information that identifies a particular message or messages within the encrypted object that contains malware.

35. The electronic device of claim 34, wherein the reference information includes a pointer that points to a memory location associated with the particular message or messages that contain malware.