System, method, and computer program product for preventing a modification to a domain name system setting
View Patent ↗A system, method, and computer program product are provided for preventing a modification to a domain name system setting. In use, an attempt to modify a domain name system setting is detected. Additionally, a source of the attempt and an attribute of the modification are verified. Further, the modification to the domain name system setting is prevented, based on the verification.
1. A system, comprising:
a processor;
a memory configured to store a domain name system setting; and
logic, wherein the logic is configured to:
detect an attempt for modification of the domain name system setting stored within the memory;
identify an attribute of the modification;
verify a source of the attempt by generating a hash of the source in order to compare the source against a whitelist including predetermined non-malicious sources;
verify the attribute of the modification by comparing the attribute of the modification against at least one of a whitelist including known good attributes and a blacklist including known at least potentially malicious attributes; and
prevent the modification of the domain name system setting responsive to the verifying of the source of the attempt being indicative that the source is a potentially malicious source and the verifying of the attribute of the modification being indicative that the attribute of the modification is a potentially malicious attribute.
2. The system of claim 1 , wherein the logic is further configured to retrieve at least one of the whitelist including predetermined non-malicious sources, the whitelist including known good attributes, and the blacklist including known at least potentially malicious attributes from the memory.
3. The system of claim 1 , wherein the logic is further configured to retrieve at least one of the whitelist including predetermined non-malicious sources, the whitelist including known good attributes, and the blacklist including known at least potentially malicious attributes from a database.
4. The system of claim 1 , wherein the logic is further configured to retrieve at least one of the whitelist including predetermined non-malicious sources, the whitelist including known good attributes, and the blacklist including known at least potentially malicious attributes from a server.
5. The system of claim 1 , wherein the domain name system setting includes a setting of a value in a registry.
6. The system of claim 1 , wherein the domain name system setting includes an Internet Protocol (IP) address setting.
7. The system of claim 1 , wherein the attempt for modification of the domain name system setting includes an attempt to change or replace an Internet Protocol (IP) address to a malicious IP address.
8. The system of claim 1 , wherein the attempt for modification of the domain name system setting includes an attempted write operation to the domain name system setting.
9. The system of claim 1 , wherein the attempt for modification of the domain name system setting includes an attempted create operation of the domain name system setting.
10. The system of claim 1 , wherein the logic is further configured to intercept the attempt for modification of the domain name system setting.
11. The system of claim 1 , wherein the source of the attempt includes a process.
12. The system of claim 1 , wherein the source of the attempt includes a file.
13. The system of claim 1 , wherein the source of the attempt is further verified by comparing the source of the attempt against a blacklist containing known at least potentially malicious sources.
14. The system of claim 1 , wherein the whitelist includes predetermined non-malicious sources including a list of hashes of the predetermined non-malicious sources.
15. The system of claim 14 , wherein the logic is further configured to verify the source of the attempt by comparing the hash of the source against the list of hashes of the predetermined non-malicious sources.
16. The system of claim 1 , wherein the source of the attempt is verified at a first server and the attribute of the modification is verified at a second server.
17. The system of claim 1 , wherein the source of the attempt and the attribute of the modification are verified at a single server.
18. The system of claim 1 , wherein preventing modification of the domain name system setting includes blocking the modification of the domain name system setting.
19. The system of claim 1 , wherein preventing modification of the domain name system setting includes undoing the modification of the domain name system setting.
20. The system of claim 1 , wherein preventing modification of the domain name system setting includes removing the source of the attempt.