Software object corruption detection

[0001] 1. Field of Disclosure

[0002] The disclosure generally relates to the field of computer security, in particular to detecting computer memory corruption.

[0003] 2. Description of the Related Art

[0004] A wide variety of malicious software (malware) can attack modern computers. Malware threats include computer viruses, worms, Trojan horse programs, spyware, adware, crimeware, and phishing websites. Malicious entities sometimes attack servers that store sensitive or confidential data that can be used to the malicious entity's own advantage. Similarly, other computers, including home computers, must be constantly protected from malicious software that can be transmitted when a user communicates with others via electronic mail, when a user downloads new programs or program updates, and in many other situations. The different options and methods available to malicious entities for attack on a computer are numerous.

[0005] Conventional techniques for detecting malware, such as signature string scanning, are becoming less effective. Modern malware is often targeted and delivered to only a relative handful of computers. For example, a Trojan horse program can be designed to target computers in a particular department of a particular enterprise. Such malware might never be encountered by security analysts, and thus the security software might never be configured with signatures for detecting such malware. Mass-distributed malware, in turn, can contain polymorphisms that make every instance of the malware unique. As a result, it is difficult to develop signature strings that reliably detect all instances of the malware.

[0006] Newer techniques for detecting malware involve the use of reputation systems. A reputation system can determine the reputation of a file encountered on a computer in order to assess the likelihood that the file is malware. One way to develop the reputation for a file is to monitor its runtime activities and base the reputation on such activities. However, instead of carrying out suspicious activities itself, malware may exploit vulnerabilities of a legitimate application and direct the legitimate application to carry out such activities. For example, malicious web content may exploit vulnerabilities in web browsers (or browser plug-ins) to install malicious software on computer systems. Accordingly, there is a need for techniques that can detect whether legitimate applications have been exploited by malware.

[0007] Embodiments of the present disclosure include methods (and corresponding systems and computer program products) for detecting software object corruption in a running software application.

[0008] One aspect of the present disclosure is a computer-implemented method for detecting software object corruption, comprising: identifying a pointer of a software object created by a running software application, a value of the pointer comprising an address of a virtual method table that comprises addresses of methods associated with the software object; examining the value of the pointer and the addresses in the virtual method table to determine whether the software object is corrupted; and responsive to a determination that the software object is corrupted, applying a corrective action.

[0009] Another aspect of the present disclosure is a computer system for detecting software object corruption, comprising: a non-transitory computer-readable storage medium storing executable computer program code, the computer program code comprising program code for: identifying a pointer of a software object created by a running software application, a value of the pointer comprising an address of a virtual method table that comprises addresses of methods associated with the software object; examining the value of the pointer and the addresses in the virtual method table to determine whether the software object is corrupted; and responsive to a determination that the software object is corrupted, applying a corrective action.

[0010] Still another aspect of the present disclosure is a non-transitory computer-readable storage medium encoded with executable computer program code for detecting software object corruption, the computer program code comprising program code for: identifying a pointer of a software object created by a running software application, a value of the pointer comprising an address of a virtual method table that comprises addresses of methods associated with the software object; examining the value of the pointer and the addresses in the virtual method table to determine whether the software object is corrupted; and responsive to a determination that the software object is corrupted, applying a corrective action.

[0011] The features and advantages described in the specification are not all inclusive and, in particular, many additional features and advantages will be apparent to one of ordinary skill in the art in view of the drawings, specification, and claims. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the disclosed subject matter.

[0016] The Figures (FIGS.) and the following description describe certain embodiments by way of illustration only. One skilled in the art will readily recognize from the following description that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles described herein. Reference will now be made in detail to several embodiments, examples of which are illustrated in the accompanying figures. It is noted that wherever practicable similar or like reference numbers may be used in the figures and may indicate similar or like functionality.

System Environment

[0017] FIG. 1 is a high-level block diagram that illustrates a computing environment 100 for detecting software object corruption and preventing malicious exploitation of such corruption, according to one embodiment of the present disclosure. Software applications developed using the object oriented programming paradigm use software objects (also called “objects” herein) to store data and implement functionalities. These objects are created and stored in memory buffers allocated for the corresponding software applications. If the memory allocated for a software object is compromised, the corresponding software application may become vulnerable to malicious exploitation.

[0018] As shown, the computing environment 100 includes a client system 110 and a security system 120 connected through a network 130. Only one of each entity is illustrated in order to simplify and clarify the present description. There can be other entities in the computing environment 100 as well.

[0019] The client system 110 is an electronic device that can host malicious software. In one embodiment, the client system 110 is a conventional computer system executing, for example, a Microsoft Windows-compatible operating system (OS), Apple OS X, and/or a Linux distribution. In another embodiment, the client system 110 is another device having computer functionality, such as a personal digital assistant (PDA), mobile telephone, video game system, etc. The client system 110 typically stores numerous computer files that can host malicious software. Malicious software (or content) may also be temporarily transmitted over the network 130 to the client system 110 to be executed or processed on the client system 110.

[0020] Malicious software, sometimes called “malware,” is generally defined as software that executes on the client system 110 surreptitiously or that has some surreptitious functionality. Malware can take many forms, such as parasitic viruses that attach to legitimate files, worms that exploit weaknesses in the computer's security in order to infect the computer and spread to other computers, Trojan horse programs that appear legitimate but actually contain hidden malicious code, and spyware that monitors keystrokes and/or other actions on the computer in order to capture sensitive information or display advertisements. Malicious content (also called malicious programmatic content) may be inserted into scripting code such as JavaScript code, VBScript code, Flash code, Portable Document Format (PDF) code, PostScript code, to name a few. These malicious code can be interpreted by a running software (or application, module, plug-in) such as a web browser and a specialized document rendering application (e.g., Adobe Reader), and carry out malicious activities by exploiting vulnerabilities in such software. Other examples of the running software include HTML control, Adobe Reader control, and Scripting host, to name a few.

[0021] The client system 110 executes a security module 115 for detecting software object corruption in software applications running on the client system 110 and preventing malicious exploitation of such corruption. The security module 115 can be, for example, incorporated into the OS of the computer or part of a separate comprehensive security package, or loaded directly into a running program via programmatic extensions such as a plug-in or a control module. In one embodiment, the security module 115 is provided by the entity that operates the security system 120. The security module 115 can communicate with the security system 120 via the network 130 for classification logic (e.g., a set of tests, a decision tree) for determining whether a software object is corrupted.

[0022] The security module 115 detects software object corruption in software applications running on the client system 110, and applies corrective actions as needed. The security module 115 inspects pointers of software objects used by a running software application and associated memory content. A pointer is a data type whose value refers directly to (or “points to”) another value (e.g., data or instruction) stored elsewhere in the computer memory using its address. The computer memory address a pointer refers to is called the value of the pointer or the pointer value. Examples of such pointers include pointers pointing to virtual method tables (hereinafter called the v-tables) of the objects, and pointers in the v-tables pointing to the memory locations where instructions of the corresponding subroutines are stored. A subroutine (hereinafter called a method, a function, a procedure) is a set of instructions that collectively perform a specific task and are relatively independent of other instructions in the same software application. The security module 115 determines whether a software object is corrupted by inspecting its pointer pointing to the v-table (hereinafter called the v-table pointer), the v-table itself (e.g., addresses or pointers in the v-table), and associated memory content using a set of tests. In one embodiment, the tests are integrated into a decision tree (e.g., as splitting tests of branch nodes), and the security module 115 classifies a software object as being corrupted or correct by traversing the decision tree.

[0023] The security system 120 is a hardware device and/or software program configured to provide logic (e.g., a set of tests, a decision tree) for detecting software object corruption to the client systems 110. An example of the security system 120 is a web-based system providing security software and services allowing the security module 115 to detect software object corruption and prevent malicious exploitation of such corruption in the client systems 110. The tests can be manually deduced by computer security experts based on observed exploitations of corrupted software objects, or automatically generated by a machine learning engine by applying a decision tree induction algorithm to information about the observed exploitations. Examples of the tests are provided and described in detail below with regard to FIG. 3.

[0024] The network 130 enables communications between the client system 110 and the security system 120. In one embodiment, the network 130 uses standard communications technologies and/or protocols. Thus, the network 130 can include links using technologies such as Ethernet, 802.11, worldwide interoperability for microwave access (WiMAX), 3G, digital subscriber line (DSL), asynchronous transfer mode (ATM), InfiniBand, PCI Express Advanced Switching, etc. Similarly, the networking protocols used on the network 130 can include multiprotocol label switching (MPLS), the transmission control protocol/Internet protocol (TCP/IP), the User Datagram Protocol (UDP), the hypertext transport protocol (HTTP), the simple mail transfer protocol (SMTP), the file transfer protocol (FTP), etc. The data exchanged over the network 130 can be represented using technologies and/or formats including the hypertext markup language (HTML), the extensible markup language (XML), JavaScript, VBScript, Flash, PDF, PostScript, etc. In addition, all or some of links can be encrypted using conventional encryption technologies such as secure sockets layer (SSL), transport layer security (TLS), virtual private networks (VPNs), Internet Protocol security (IPsec), etc. In another embodiment, the entities can use custom and/or dedicated data communications technologies instead of, or in addition to, the ones described above. Depending upon the embodiment, the network 130 can also include links to other networks such as the Internet.

Computer Architecture

[0025] The entities shown in FIG. 1 are implemented using one or more computers. FIG. 2 is a high-level block diagram illustrating an example computer 200. The computer 200 includes at least one processor 202 coupled to a chipset 204. The chipset 204 includes a memory controller hub 220 and an input/output (I/O) controller hub 222. A memory 206 and a graphics adapter 212 are coupled to the memory controller hub 220, and a display 218 is coupled to the graphics adapter 212. A storage device 208, keyboard 210, pointing device 214, and network adapter 216 are coupled to the I/O controller hub 222. Other embodiments of the computer 200 have different architectures.

[0026] The storage device 208 is a non-transitory computer-readable storage medium such as a hard drive, compact disk read-only memory (CD-ROM), DVD, or a solid-state memory device. The memory 206 holds instructions and data used by the processor 202. The pointing device 214 is a mouse, track ball, or other type of pointing device, and is used in combination with the keyboard 210 to input data into the computer system 200. The graphics adapter 212 displays images and other information on the display 218. The network adapter 216 couples the computer system 200 to one or more computer networks.

[0027] The computer 200 is adapted to execute computer program modules for providing functionality described herein. As used herein, the term “module” refers to computer program logic used to provide the specified functionality. Thus, a module can be implemented in hardware, firmware, and/or software. In one embodiment, program modules are stored on the storage device 208, loaded into the memory 206, and executed by the processor 202.

[0028] The types of computers 200 used by the entities of FIG. 1 can vary depending upon the embodiment and the processing power required by the entity. For example, the security system 120 might comprise multiple blade servers working together to provide the functionality described herein. As another example, the client system 110 might comprise a mobile telephone with limited processing power. The computers 200 can lack some of the components described above, such as keyboards 210, graphics adapters 212, and displays 218.

Example Architectural Overview of the Security Module

[0029] FIG. 3 is a high-level block diagram illustrating a detailed view of modules within the security module 115 according to one embodiment. Some embodiments of the security module 115 have different and/or other modules than the ones described herein. Similarly, the functions can be distributed among the modules in accordance with other embodiments in a different manner than is described here. As illustrated, the security module 115 includes a communication module 310, an application monitor module 320, a software object corruption detection engine 330, and a data store 340.

[0030] The communication module 310 communicates with the security system 120 to request and receive tests for detecting software object corruption. The tests can be received in a variety of forms, such as a set of if-then-else statements, a decision tree, a computer program module implementing the tests, textual description of the tests in an XML file, or any ASCII file format.

[0031] The application monitor module 320 monitors software applications running on the client system 110, and diverts the execution of the software applications to detect software object corruption. In one embodiment, the application monitor module 320 examines a software application (e.g., by matching specific bit patterns in memory, examining specific addresses in the process memory space, or searching for particular types of instructions such as jump commands) to identify execution points (e.g., instructions) at which to interrupt the execution to detect software object corruption. The execution points can be identified using identification information (e.g., instruction addresses in executable images) provided by the security system 120 along with the classification logic. In another embodiment, the application monitor module 320 interrupts the execution of a software application at predefined intervals (e.g., every minute) or events (e.g., when the application attempts to transmit data over the network 130), or prior to using a software object. The application monitor module 320 may also accomplish execution diversion programmatically using Application Programming Interface (API) or interfaces implemented by the monitored program or the operating system which allow the security module 115 to register “callback” routines.

[0032] The application monitor module 320 diverts the execution of a software application by replacing the instructions at the identified execution points with instructions (e.g., jump commands) redirecting the execution to the software object corruption detection engine 330 (or instructions provided by the detection engine 330) such that the detection engine 330 can access the memory buffers of the software application and detect software object corruption before the software application executes further. The monitor module 320 can replace (or insert) the instructions before or during execution of the software application.

[0033] The software object corruption detection engine 330 detects software object corruption in a software application by inspecting pointers associated with software objects used in the software application. Examples of the inspected pointers include the v-table pointer and pointers (or addresses) in the v-table. In one embodiment, the execution of the software application is diverted to the detection engine 330 (e.g., through a jump command placed in the software application by the monitor module 320). The detection engine 330 analyzes the execution environment of the software application (e.g., content of the allocated stacks, heaps) to identify one or more software objects used by the software application. For example, a pointer pointing to a current software object is typically located at the top of the call stack, and the v-table pointer of a software object is typically located at the beginning of the object. Thus, the detection engine 330 can locate the current software object, its v-table pointer, and pointers to its virtual methods.

[0034] The detection engine 330 inspects the integrity of the pointers by applying a set of tests. The tests inspects the pointer values, properties of the memory buffer the pointers point to, and/or content of the memory buffer for inconsistencies that are evidence of corruption.

[0035] Some of the tests inspect the pointer values for evidence of corruption. For example, one of the tests examines the v-table pointer and/or pointers in the v-table for invalid pointer values (e.g., a NULL pointer value). Because the v-table pointer and pointers in the v-table for a valid software object should never be a NULL pointer, the presence of such a pointer suggests that the software object is corrupted. As another example, a test examines the pointer values to detect the presence of suspicious bit patterns indicating heap spray, such as symmetric bit patterns (e.g., 0C0C0C0C, 0C0D0C0D). Because pointer values are typically allocated at runtime based on current computer system memory usage status, the pointer values typically appear random and rarely exhibit a symmetric bit pattern. Thus, if any of the pointer values exhibits such a pattern, it is likely that the memory buffer including the pointer is corrupted (e.g., overwritten by a malware using techniques such as heap spraying). Still another example test examines the pointer values to determine if the pointer values are interpreted as instructions (e.g., machine code), whether there are repeated (or multiple) No Operation Performed (NOP) instructions (e.g., an instruction that does nothing) or equivalent instructions. Because malware typically sprays NOP instructions in a memory buffer, if a pointer value when interpreted as instructions includes repeated NOP instructions, it is likely that the software object is corrupted.

[0036] Some of the tests examine the logical consistency of the pointer values for evidence of corruption. For example, one such test examines the pointers in the v-table to make sure that their values are not the same as the memory address of the v-table itself. Since pointers in a v-table should points to the instructions of the virtual methods, the fact that one such pointer points to the v-table itself suggests that the software object is corrupted. Another example test examines the pointer values for duplications. Because the v-table pointer points to the v-table and the pointers in the v-table point to different virtual methods of the associated software objects, these pointers should point to different memory locations. Thus, the presence of pointer value duplication indicates that the software object is likely corrupted.

[0037] Some of the tests examine the target memory of the pointers for inconsistencies that indicate corruption. For example, a test examines the label (or attribute) of the memory segment including the memory address of a pointer for inconsistency. When a compiler generates an executable software application, the compiler typically labels the segment in which the executable instructions reside as an executable segment. If a pointer in the v-table points a non-executable memory region, a non-memory mapped image section (or region), a heap, a stack, or a static data section, then it is likely that the software object is corrupted. Another example test examines the pointer values to determine whether they are within a predictable range. If a pointer value is below a process base address of the memory buffer(s) allocated for the software application, or falls into the memory region(s) known to be reserved for the system and only accessible by kernel code, it is also likely that the software object is corrupted, since normally the v-table pointer and pointers within the v-table would not point to such memory regions. Still another example test examines the content stored at the memory region(s) referred by the pointers for inconsistency. For example, if the memory content contains repeated NOP instructions or suspicious bit patterns, it is likely that the memory content is contaminated (e.g., sprayed by malware), and the software object is corrupted. Typically a software application would not exhibit repeated NOP instructions or suspicious bit patterns in its instructions.

[0038] The detection engine 330 determines whether a software object is corrupted based on the result of applying one or more such tests. If no corruption is detected, the detection engine 330 resumes the execution of the software application by passing the control back to the software application (e.g., through another jump command). Otherwise, the detection engine 330 applies one or more appropriate corrective actions, such as performing a countermeasure, terminating the software application, generating a warning message, terminating another software application that may have caused the corruption, and/or cleaning (or correcting) the corrupted memory buffer. Additionally (or alternatively), the detection engine 330 may return an error code indicating that the requested action failed, and/or that the execution of the current routine should be aborted.

[0039] The data store 340 stores data used by the client system 110. Examples of such data include information related to the computer files residing on the client system 110 (e.g., tests for detecting software object corruption), results of previously detected software object corruption, and information about the security system 120 (e.g., the IP address). The data store 340 may be a relational database or any other type of database.

Overview of Methodology for the Security Module

[0040] FIG. 4 is a flow diagram illustrating a process 400 for the security module 115 to detect software object corruption in a running software application, according to one embodiment. Other embodiments can include different and/or additional steps than the ones described herein.

[0041] The client system 110 launches 410 a target software application. The security module 115 monitors the execution of the target application and diverts 420 the execution to the detection engine 330. In one embodiment, the security module 115 identifies one or more execution points in the target software application, and replaces instructions at the identified execution points with redirection instructions that pass control to the detection engine 330. In addition to (or instead of) replacing instructions, the security module 115 may register a callback routine that passes control to the detection engine 330 with the operating system or the executing process. Once the detection engine 330 obtains control, it examines the execution environment of the target application, and detects 430 software object corruption by inspecting pointers of the software objects used by the target application. Examples of the pointers are the v-table pointer and pointers in the v-table. The detection step 430 is illustrated in FIG. 5 and described in detail below.

[0042] Referring now to FIG. 5, a flow diagram illustrating a process 500 for the detection engine 330 to detect software object corruption, according to one embodiment. Other embodiments can include different and/or additional steps than the ones described herein at different sequences. As shown, the detection engine 330 first checks 510 the pointers for invalid pointer values such as the NULL pointer value. The detection engine 330 then checks 520 for invalid bit patterns in the pointer values and/or content in the memory referred by the pointers, checks 530 for duplicate pointer values, checks 540 for pointer values pointing to memory regions with inconsistent memory attributes, checks 550 for pointer in the v-table pointing to the address of the v-table, checks 560 for repeated NOP instructions in the pointer values and/or content in the memory referred by the pointers, and checks 570 for pointer values outside a predictable range.

[0043] Referring back to FIG. 4, the security module 115 determines whether a software object is corrupted based on the result of the process 500. It is noted that not all tests illustrated in FIG. 5 are necessary to be applied, and the security module 115 may make the determination based on outcomes of one or more such tests. If no software object corruption is detected, the security module 115 resumes 440 the execution of the target application by passing the control back to the target application (e.g., through a jump command). Otherwise, if one or more software object corruption is detected, the security module 115 applies 450 an appropriate corrective action, such as terminating the software application, generating a warning message, correcting the corrupted memory buffer, and/or returning an error code indicating that the operation has failed.

[0044] The security module 115 may periodically interrupt the execution of the target application to detect software object corruption (e.g., at predefined intervals or events, or prior to using certain software objects). As a result, the security module 115 can timely detect software object corruption and implement corrective actions, thereby preventing malicious exploitation of such corruption.

Additional Embodiments

[0045] In one embodiment, instead of (or in addition to) replacing or inserting redirection instructions to a software application while the software application is in execution, the security module 115 can replace or add in the redirection instructions before the software application runs. In addition, the described technique can be used for other purposes such as debugging and memory integrity validation, and the redirection instructions (or the detection instructions) can be integrated into the software application during compilation.

[0046] Some portions of above description describe the embodiments in terms of algorithmic processes or operations. These algorithmic descriptions and representations are commonly used by those skilled in the data processing arts to convey the substance of their work effectively to others skilled in the art. These operations, while described functionally, computationally, or logically, are understood to be implemented by computer programs comprising instructions for execution by a processor or equivalent electrical circuits, microcode, or the like. Furthermore, it has also proven convenient at times, to refer to these arrangements of functional operations as modules, without loss of generality. The described operations and their associated modules may be embodied in software, firmware, hardware, or any combinations thereof.

[0047] As used herein any reference to “one embodiment” or “an embodiment” means that a particular element, feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. The appearances of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment.

[0048] Some embodiments may be described using the expression “coupled” and “connected” along with their derivatives. It should be understood that these terms are not intended as synonyms for each other. For example, some embodiments may be described using the term “connected” to indicate that two or more elements are in direct physical or electrical contact with each other. In another example, some embodiments may be described using the term “coupled” to indicate that two or more elements are in direct physical or electrical contact. The term “coupled,” however, may also mean that two or more elements are not in direct contact with each other, but yet still co-operate or interact with each other. The embodiments are not limited in this context.

[0049] As used herein, the terms “comprises,” “comprising,” “includes,” “including,” “has,” “having” or any other variation thereof, are intended to cover a non-exclusive inclusion. For example, a process, method, article, or apparatus that comprises a list of elements is not necessarily limited to only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Further, unless expressly stated to the contrary, “or” refers to an inclusive or and not to an exclusive or. For example, a condition A or B is satisfied by any one of the following: A is true (or present) and B is false (or not present), A is false (or not present) and B is true (or present), and both A and B are true (or present).

[0050] In addition, use of the “a” or “an” are employed to describe elements and components of the embodiments herein. This is done merely for convenience and to give a general sense of the disclosure. This description should be read to include one or at least one and the singular also includes the plural unless it is obvious that it is meant otherwise.

[0051] Upon reading this disclosure, those of skill in the art will appreciate still additional alternative structural and functional designs for a system and a process for detecting software object corruption. Thus, while particular embodiments and applications have been illustrated and described, it is to be understood that the present invention is not limited to the precise construction and components disclosed herein and that various modifications, changes and variations which will be apparent to those skilled in the art may be made in the arrangement, operation and details of the method and apparatus disclosed herein without departing from the spirit and scope as defined in the appended claims.