Collecting malware samples via unauthorized download protection
View Patent ↗A hook is set for one or more downloading functions. Subsequently, code is executed within an application process. Responsive to the executed code calling one of the hooked functions to download code, a return address of the called function is examined. If the return address is within a memory area not marked executable, the code is permitted to be downloaded and the downloaded code is submitted to a security server for analysis.
1. A method of capturing data on a client computer for submission to a security server, the method comprising:
hooking, by the computer, one or more downloading functions that can be called by code executing on the computer to download data via a network;
responsive to a hooked downloading function being called, identifying, by the computer, a return address of code that called the hooked downloading function, the code executing on the computer in a web browser process;
determining, by the computer, whether the code corresponding to the return address is in a heap memory area of the browser process;
responsive to the return address being within the heap memory area of the browser process, the computer:
permitting downloading of data from a remote computer via the network by the downloading function called by the code;
preventing further execution of the code; and
submitting the downloaded data to a remote security server via the network for analysis at the remote security server; and
responsive to the return address not being within a memory area marked executable, the computer:
consulting a user-specified policy to determine an action to take; and
responsive to consulting the policy, performing at least one of returning an error code and displaying an alert.
2. The method of claim 1 , wherein the hooked downloading functions include a function from the group of UrlDownloadToFileA, UrlDownloadToFileW, UrlDownloadToCacheFileA, and UrlDownloadToCacheFileW.
3. The method of claim 1 , further comprising denying, by the computer, execution of the downloaded data responsive to the return address being within the heap memory area of the browser process.
4. A non-transitory computer-readable storage medium having executable computer program logic embodied therein for capturing data on a client computer for submission to a security server, the computer program logic performing actions comprising:
hooking one or more downloading functions that can be called by code executing on the computer to download data via a network;
responsive to a hooked downloading function being called, identifying a return address of code that computer that called the hooked downloading function, the code executing on the computer in a web browser process;
determining whether the code corresponding to the return address is in a heap memory area of the browser process;
responsive to the return address being within the heap memory area of the browser process, the computer:
permitting downloading of data from a remote computer via a network by the downloading function called by the code;
preventing further execution of the code; and
submitting the downloaded data to a remote security server via the network for analysis at the remote security server; and
responsive to the return address not being within a memory area marked executable, the computer:
consulting a user-specified policy to determine an action to take; and
responsive to consulting the policy, performing at least one of returning an error code and displaying an alert.
5. The computer-readable storage medium of claim 4 , wherein the hooked downloading functions include a function from the group of UrlDownloadToFileA, UrlDownloadToFileW, UrlDownloadToCacheFileA, and UrlDownloadToCacheFileW.
6. The computer-readable storage medium of claim 4 , wherein the code is downloaded over the network.
7. The computer-readable storage medium of claim 4 , the computer program logic further comprising denying execution of the downloaded data responsive to the return address being within the heap memory area of the browser process.
8. A computer adapted to capture data for submission to a security server, the computer comprising:
a non-transitory computer-readable storage medium storing executable computer program modules comprising:
a hooking module for hooking one or more downloading functions that can be called by code executing on the computer to download data via a network;
a code checking module for:
identifying a return address of code that called the hooked downloading function, responsive to a hooked downloading function being called, the code executing on the computer in a web browser process, and
determining whether the code corresponding to the return address is in a heap memory area of the browser process; and
a response module for:
performing actions comprising the following, responsive to the code checking module determining that the return address is within the heap memory area of the browser process;
permitting downloading of data from a remote computer via a network by the downloading function called by the code;
preventing further execution of the code; and
submitting the downloaded data to a remote security server via the network for analysis at the remote security server; and
performing actions comprising the following, responsive to the code checking module determining that the return address is not within a memory area marked executable:
consulting a user-specified policy to determine an action to take; and
responsive to consulting the policy, performing at least one of returning an error code and displaying an alert.
9. The computer of claim 8 , wherein the hooked downloading functions include a function from the group of UrlDownloadToFileA, UrlDownloadToFileW, UrlDownloadToCacheFileA, and UrlDownloadToCacheFileW.
10. The computer of claim 8 , wherein the code is downloaded over the network.
11. The computer of claim 8 , the actions of the response module further comprising denying execution of the downloaded data responsive to the return address being within the heap memory area of the browser process.