System, method, and computer program product for reacting in response to a detection of an attempt to store a configuration file and an executable file on a removable device

• US 9,531,748 B2
• Filed: 12/22/2014
• Issued: 12/27/2016
• Est. Priority Date: 06/27/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Kumar, Lokesh, Ramachetty, Harinath V.
• Primary Examiner(s): BEHESHTI SHIRAZI, SAYED ARESH
• Application Number:
  US14/578,543
• Publication Number:
  US 20150172301A1
• Time in Patent Office: 736 Days
• Field of Search: 726/1, 726/24, 726/25, 726/26, 726/23, 380/2
• US Class Current: 1/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04W 12/08 Access security

Abstract

A system, method, and computer program product are provided for reacting in response to a detection of an attempt to store a configuration file and an executable file on a removable device. In use, a first device removably coupled to a second device is identified. Additionally, an attempt to store on the first device a configuration file for the first device and an executable file is detected. Further, a reaction is performed in response to the detection of the attempt.

Claims

1. A non-transitory, tangible, computer readable medium comprising one or more instructions that, when executed on a processor, configure the processor to perform operations comprising:

monitoring, by a security system, file copy or create operations directed to a removable storage device to detect an attempt by a program on a first device to store a configuration file and an executable file on the removable storage device; and

,

in response to detecting the attempt, displaying, by the security system, an alert including at least a part of text in the configuration file, wherein the part of the text in the configuration file identifies that the executable file is to be executed via the configuration file.

2. The non-transitory, tangible, computer readable medium of claim 1, wherein the security system does not have a malware signature for the program.

3. The non-transitory, tangible, computer readable medium of claim 1, wherein the operations further comprise:

flagging the program for a review by the security system in response to a selection to prevent the attempt to store the configuration file and the executable file on the removable storage device.

4. The non-transitory, tangible, computer readable medium of claim 1, wherein the operations further comprise:

preventing a storage of the configuration file and the executable file on the removable storage device.

5. The non-transitory, tangible, computer readable medium of claim 1, wherein the configuration file includes one or more instructions for an operating system of a second device to run the executable file upon the removable storage device being coupled to the second device.

6. The non-transitory, tangible, computer readable medium of claim 1, wherein the configuration file includes a file for configuring software on a second device.

7. The non-transitory, tangible, computer readable medium of claim 1, wherein the configuration file includes a setup information (INF) file.

8. The non-transitory, tangible, computer readable medium of claim 1, wherein the configuration file is a text-based configuration file.

9. The non-transitory, tangible, computer readable medium of claim 1, wherein the operations further comprise:

displaying one or more of the following;

a name, a location, and a source of the configuration file.

10. The non-transitory, tangible, computer readable medium of claim 1, wherein the alert comprises one or more of the following:

a name, a location, a source, and content of the executable file.

11. The non-transitory, tangible, computer readable medium of claim 1, wherein the executable file includes one or more of the following:

a malware file, a virus software file, an adware file, and a spyware file.

12. The non-transitory, tangible, computer readable medium of claim 1, wherein the removable storage device is removably coupled to the first device via a universal serial bus (USB) connection or an Institute of Electrical and Electronics Engineers (IEEE) 1394 connection.

13. The non-transitory, tangible, computer readable medium of claim 1, wherein the removable storage device is removably coupled to the first device via a Bluetooth wireless connection or a network connection.

14. The non-transitory, tangible, computer readable medium of claim 1, wherein the removable storage device includes one or more of the following:

a portable hard drive device, a flash-based memory device, a shared network drive, and a portable music player.

15. The non-transitory, tangible, computer readable medium of claim 1, wherein the operations further comprise:

monitoring, by the security system, ports of the first device to identify that the removable storage device coupled to the first device.

16. A device, comprising:

a processor, and

a memory having instructions stored thereon, wherein the instructions are executable by the processor to cause the device to

monitor, by a security system, file copy or create operations directed to a removable storage device to detect an attempt by a program on the device to store a configuration file and an executable file on the removable storage device; and

,

in response to detecting the attempt, display, by the security system, an alert including at least a part of text in the configuration file, wherein the part of the text in the configuration file identifies that the executable file is to be executed via the configuration file.

17. The device of claim 16, wherein the security system does not have a malware signature for the program.

18. A method, comprising:

monitoring, by a security system, file copy or create operations directed to a removable storage device to detect an attempt by a program on a device to store a configuration file and an executable file on the removable storage device; and

,

in response to detecting the attempt, displaying, by the security system, an alert including at least a part of text in the configuration file, wherein the part of the text in the configuration file identifies that the executable file is to be executed via the configuration file.

19. The method of claim 18, wherein the security system does not have a malware signature for the program.