Functional patching/hooking detection and prevention
A method for preventing malicious attacks on software, using the patching method, includes providing a database of malicious known patches (malware). The database contains characteristic signatures of the malware. The method also includes detecting whether a patch is malicious by comparing it with a signature in the database and performing one or more activities needed to prevent the malicious patch from performing undesired activities.
1. A method for preventing malicious attacks on software that use a patching method, comprising the steps of:
i) providing a first database of legitimate known patches, said first database containing characteristic signatures of said legitimate know patches;
ii) providing a second database of malware in the form of malicious known patches, the second database containing characteristic signatures of said malware;
iii) detecting whether an inspected patch within a running process is malicious by comparing the patch with a signature in said first database, and if a match is found, determining that said inspected patch is legitimate;
iv) if a mismatch is found while comparing the patch with a signature is said first database, further comparing the patch with a signature in said second database, and if a match is found, determining that said inspected patch is malicious and performing one or more activities needed to prevent said malicious patch from performing undesired activities by making changes to said malicious patch or deleting said malicious patch; and
v) if a mismatch is found while comparing the patch with a signature in said second database, determining that said inspected patch is unknown.
2. A method according to claim 1 , wherein performing an activity needed to prevent said malicious patch from performing undesired activities comprises one or more of the following steps:
making changes to said malicious patch to prevent the malicious patch from performing undesired activities,
deleting the malicious patch or alerting a user or a server, or alerting both the user and the server, of the presence of the malicious patch.
3. The method according to claim 1 , wherein the software is a browser.
4. A method according to claim 1 , wherein performing an activity needed to prevent said malicious patch from performing undesired activities comprises reporting the presence of the malicious patch to a receiving entity.
5. A method according to claim 4 , wherein said receiving entity is selected from one or more of a remote software agent, a local software agent, or a user.
6. A method according to claim 1 , further comprising providing in a database information regarding where to look for a next patch when a legitimate patch is found.
7. The method according to claim 6 , wherein the process is repeated until no match is found in the database.
8. A method according to claim 1 , further comprising providing in a database information on how to represent code being examined as a continuous code, when a patch is matched.
9. The method according to claim 8 , wherein the process is repeated until no match is found in the database.