Information security techniques including detection, interdiction and/or mitigation of memory injection attacks
View Patent ↗Methods of detecting malicious code injected into memory of a computer system are disclosed. The memory injection detection methods may include enumerating memory regions of an address space in memory of computer system to create memory region address information. The memory region address information may be compared to loaded module address information to facilitate detection of malicious code memory injection.
1. A method comprising:
(a) enumerating, based on a query of an operating executive of a computer system, a plurality of memory regions of an address space in memory of the computer system, thereby creating memory region address information; and
(b) scanning memory of the computer system for a memory injection, wherein the scanning step comprises:
(i) determining whether a first memory region of the plurality of memory regions corresponds to any of a plurality of loaded modules registered with the operating executive, wherein the determining step comprises:
examining the plurality of loaded modules for loaded module address information; and
comparing the memory region address information to the loaded module address information, wherein start and end addresses of each loaded module of the plurality of loaded modules are compared to start and end addresses of the first memory region; and
(ii) wherein, when the first memory region does not correspond to any of the plurality of loaded, determining whether the first memory region contains library indicative coding, the first memory region does not correspond to any of the plurality of loaded modules when each loaded module from the plurality of loaded modules lies completely outside the start and end address of first memory region; and
(iii) wherein, when the first memory region contains library indicative coding, generating a memory injection alarm.
2. The method of claim 1 , wherein, when the first memory region corresponds to one of the plurality of loaded modules, determining whether that loaded module is mapped from a file system of the computer system.
3. The method of claim 2 , wherein the memory injection alarm is a first memory injection alarm, and wherein, when the loaded module is not mapped from a file system of the computer system, generating a second memory injection alarm.
4. The method of claim 3 , wherein the first memory injection alarm is indicative of a reflective dynamic link library memory injection.
5. A method comprising:
(a) enumerating, based on a query of an operating executive of a computer system, a plurality of memory regions of an address space in memory of the computer system, thereby creating memory region address information; and
(b) scanning memory of the computer system for a memory injection, wherein the scanning step comprises:
(i) determining whether a first memory region of the plurality of memory regions corresponds to any of a plurality of loaded modules registered with the operating executive, wherein the determining step comprises:
examining the plurality of loaded modules for loaded module address information; and
comparing the memory region address information associated with the first memory region to the loaded module address information, wherein start and end addresses of each loaded module of the plurality of loaded modules are compared to start and end addresses of the first memory region; and
(ii) wherein, when the first memory region corresponds to one of the plurality of loaded modules, determining whether that loaded module is mapped from a file system of the computer system, the first memory region does not correspond to that loaded module when that loaded module lies completely outside the start and end address of first memory region; and
(iii) wherein, when the loaded module is not mapped from a file system of the computer system, generating a memory injection alarm.
6. The method of claim 5 , wherein the scanning step comprises:
determining whether the first memory region is in use by ensuring that it is committed memory; and
wherein, when the first memory region is in use, determining whether the first memory region corresponds to any of the plurality of loaded modules.
7. The method of claim 5 , wherein the scanning step comprises:
determining whether the first memory region is at least one of a read, write, or executable region or was initially allocated as at least one of a read, write, or executable region; and
wherein, when the first memory region is at least one of a read, write, or executable region or was initially allocated as at least one of a read, write, or executable region, determining whether the first memory region contains library indicative coding.
8. The method of claim 5 , wherein the operating executive includes an operating system.
9. The method of claim 5 , wherein the query comprises:
obtaining a process handle for each process executing on the computer system; and
based on the obtained process handle, querying the operating executive to obtain at least a respective base address and size for each of successive memory regions within the address space of the respective process.
10. The method of claim 9 , wherein the querying step comprises: obtaining from the operating executive an identifier for the respective file system object, if any, from which content of a particular memory region is mapped.
11. The method of claim 9 , wherein the process handle obtaining includes:
maintaining a shadow process table in correspondence with start of new processes or threads; and accessing the maintained shadow process table.
12. The method of claim 9 , wherein the process handle obtaining includes:
accessing a process table maintained by the operating executive.
13. The method of claim 5 , wherein the comparing step is performed at successive times during operation of the computer system.
14. The method of claim 5 , comprising:
at least for memory regions allocated to a given process, performing the comparing step in response to an event, wherein the event is at least one of:
(i) start of a new process or thread;
(ii) a network-facing socket operation;
(iii) creation of a new binary on a file system; or
(iv) the expiration of a polling timer.
15. The method of claim 5 , wherein the query comprises walking a call stack.
16. The method of claim 5 , further comprising: performing at least the comparing and the determining in kernel code.
17. The method of claim 5 ,
wherein for at least some executions, the comparing is limited to those address space regions having a trust-execute protection object.
18. The method of claim 5 , wherein the enumerating step comprises:
enumerating, based on the query, the plurality of loaded modules, thereby creating loaded module address information.
19. The method of claim 5 , wherein
when a loaded module from the plurality of loaded modules spans the first memory region, or partially overlaps the first memory region, then the loaded module corresponds to the first memory region.
20. A security method for a computational system, the method comprising:
querying an operating executive of the computational system to populate a data structure that enumerates regions of an address space allocated to processes executing on the computational system;
querying the operating executive to populate a data structure that enumerates a set of loaded modules registered with the operating executive;
comparing the enumerated address space regions against the enumerated set of loaded modules, the comparing comprising comparing start and end addresses of each loaded module of the set of loaded modules to start and end addresses of the enumerated address space regions;
for those of the enumerated address space regions that correspond to a loaded module registered with the operating executive, checking for absence of a mapping from a file system object, the enumerated address space region from the enumerated address space regions does not correspond to a loaded module from the set of loaded modules when that loaded module lies completely outside the start and end address of the enumerated address space region; and
responsive to detection of no mapping from a file system object, generating a detection event.
21. The method of claim 1 , wherein the enumerating comprises populating entries in at least one process tracking table.