Systems, methods and media for managing process image hijacks
View Patent ↗Disclosed is a method of checking the authenticity of an executable process including at least one section. The method includes, when an initial thread of the executable process is created in a suspended state, mapping from storage a copy of the executable process into a spare memory area, where it will not be executed. The method also includes comparing a header of a first section of the executable process with a header of a first section of the copy. The method further includes terminating the executable process when the header of the first section of the executable process and the header of the first section of the copy are not identical.
1. A method of checking for authenticity of an executable process, comprising:
when an initial thread of an executable process mapped to a first area of a memory is created in a suspended state, mapping from a disk storage an image of the executable process to a second area of the memory, wherein the image of the executable process is not for execution;
comparing a header of a first section of the executable process mapped to the first area of the memory with a header of a first section of the image of the executable process mapped to the second area of the memory; and
terminating the executable process when the header of the first section of the executable process is not identical to the header of the first section of the image of the executable process.
2. The method of claim 1 , further comprising,
when the header of the first section of the executable process is identical to the header of the first section of the image of the executable process, comparing a number of sections included in the executable process with a number of sections included in the image of the executable process; and
terminating the executable process when the number of sections included in the executable process is not identical to the number of sections included in the image of the executable process.
3. The method of claim 2 , further comprising generating a first event when the executable process is terminated.
4. The method of claim 2 , further comprising,
when the number of sections included in the executable process is identical to the number of sections included in the image of the executable process, comparing headers of remaining sections of the executable process with headers of remaining sections of the image of the executable process; and
terminating the executable process when a header of any of the remaining sections of the executable process is not identical to a header of a corresponding section in the remaining sections of the image of the executable process.
5. The method of claim 4 , further comprising generating a second event when the executable process is terminated.
6. The method of claim 4 , further comprising,
when the headers of the remaining sections of the executable process are identical to the headers of the remaining sections of the image of the executable process, comparing contents of all sections of the executable process with contents of all sections of the image of the executable process; and
terminating the executable process when content of any section of the executable process is not identical to content of a corresponding section of the image of the executable process.
7. The method of claim 6 , further comprising generating a third event when the executable process is terminated.
8. The method of claim 7 , wherein the third event includes an alarm that can be raised for a user or an administrator.
9. A non-transitory computer readable medium having executable instructions operable to cause an apparatus to:
when an initial thread of an executable process mapped to a first area of a memory is created in a suspended state, map from a disk storage an image of the executable process to a second area of the memory, wherein the image of the executable process is not for execution;
compare a header of a first section of the executable process mapped to the first area of the memory with a header of a first section of the image of the executable process mapped to the second area of the memory; and
terminate the executable process when the header of the first section of the executable process is not identical to the header of the first section of the image of the executable process.
10. The computer readable medium of claim 9 , wherein the executable instructions are further operable to cause the apparatus to,
when the header of the first section of the executable process is identical to the header of the first section of the image of the executable process, compare a number of sections included in the executable process with a number of sections included in the image of the executable process; and
terminate the executable process when the number of sections included in the executable process is not identical to the number of sections included in the image of the executable process.
11. The computer readable medium of claim 10 , wherein the executable instructions are further operable to cause the apparatus to generate a first event when the executable process is terminated.
12. The computer readable medium of claim 10 , wherein the executable instructions are further operable to cause the apparatus to,
when the number of sections included in the executable process is identical to the number of sections included in the image of the executable process, compare headers of remaining sections of the executable process with headers of remaining sections of the image of the executable process; and
terminate the executable process when a header of any of the remaining sections of the executable process is not identical to a header of a corresponding section in the remaining sections of the image of the executable process.
13. The computer readable medium of claim 12 , wherein the executable instructions are further operable to cause the apparatus to generate a second event when the executable process is terminated.
14. The computer readable medium of claim 12 , wherein the executable instructions are further operable to cause the apparatus to,
when the headers of the remaining sections of the executable process are identical to the headers of the remaining sections of the image of the executable process, compare contents of all sections of the executable process with contents of all sections of the image of the executable process; and
terminate the executable process when content of any section of the executable process is not identical to content of a corresponding section of the image of the executable process.
15. The computer readable medium of claim 14 , wherein the executable instructions are further operable to cause the apparatus to generate a third event when the executable process is terminated.
16. An apparatus for checking authenticity of an executable process, comprising:
a memory capable of storing data; and
a processor configured for using the data such that the apparatus:
when an initial thread of an executable process mapped to a first area of a memory is created in a suspended state, maps from a disk storage an image of the executable process to a second area of the memory, where the image of the executable process is not for execution;
compares a header of a first section of the executable process mapped to the first area of the memory with a header of a first section of the image of the executable process mapped to the second area of the memory; and
terminates the executable process when the header of the first section of the executable process is not identical to the header of the first section of the image of the executable process.
17. The apparatus of claim 16 , wherein the processor is further configured for using the data such that the apparatus,
when the header of the first section of the executable process is identical to the header of the first section of the image of the executable process, compares a number of sections included in the executable process with a number of sections included in the image of the executable process; and
terminates the executable process when the number of sections included in the executable process is not identical to the number of sections included in the image of the executable process.
18. The apparatus of claim 17 , wherein the processor is further configured for using the data such that the apparatus generates a first event when the executable process is terminated.
19. The apparatus of claim 17 , wherein the processor is further configured for using the data such that the apparatus,
when the number of sections included in the executable process is identical to the number of sections included in the image of the executable process, compares headers of remaining sections of the executable process with headers of remaining sections of the image of the executable process; and
terminates the executable process when a header of any of the remaining sections of the executable process is not identical to a header of a corresponding section in the remaining sections of the image of the executable process.
20. The apparatus of claim 19 , wherein the processor is further configured for using the data such that the apparatus,
when the headers of the remaining sections of the executable process are identical to the headers of the remaining sections of the image of the executable process, compares contents of all sections of the executable process with contents of all sections of the image of the executable process; and
terminates the executable process when content of any section of the executable process is not identical to content of a corresponding section of the image of the executable process.