Method and system for protecting computerized systems from malicious code
The invention relates to a method for providing a computerized system which is protected from malicious programs coming from an external source, the method comprises the steps of (a) secretly, and in a manner unknown to authors of external programs, modifying one or more essential elements at the protected system in a manner which causes all running programs to fail, unless they are subjected to a compatible modification which enables them to run properly; and (b) modifying each program at the computerized system which is known to be benign in order to comply with said modification of one or more essential elements, thereby to enable it to be executed properly.
1. A method for providing a computerized system which is protected from malicious programs coming from an external source, the method comprises steps of:
a) secretly, and in a manner unknown to authors of external programs, modifying on a temporal basis at a central security authority one or more essential elements of an operating system of the computerized system in a manner which causes all running programs to fail due to an exception which indicates an illegal operation, unless they are subjected to a compatible modification which enables them to run properly; and
b) modifying also on the temporal basis at said central security authority each program which is known to be benign in order to comply with said modification of one or more essential elements, thereby to enable proper execution of the program, and running the modified program at the computerized system;
which is adapted for a static linking, wherein said modification at the computerized system involves modification to at least one service routine and to a wrapper routine in a standard library, and wherein said modification to each of the benign programs is a compatible modification to a signature of the program;
or
which is adapted for a dynamic linking, wherein said modification at the computerized system involves maintaining two copies of a dynamic standard library, a first copy of the dynamic standard library under its original name, and a second copy of the dynamic standard library under a modified name, and wherein said modification to each of the benign programs is a compatible modification to call said modified copy of the dynamic standard library.
2. Method according to claim 1 , wherein said modifications involve a modification to one or more essential elements at the operating system, and to each benign program.
3. Method according to claim 1 , wherein when a program that does not comply with said modifications is found, the program is halted or sent to a sandbox, and an alert is raised.
4. Method according to claim 1 , wherein said modifications involve a modification to the operating system at said computerized system, and wherein said modification to each benign program involves a compatible modification to an instruction set used by the program.
5. Method according to claim 1 , wherein said modifications involve a modification to an instruction set of a processor at said computerized system, and wherein said modification to each benign program involves a compatible modification to the instruction set used by the program.
6. Method according to claim 1 , which further includes a stub to detect programs that do not comply with said modification at the computerized system.
7. Method according to claim 1 which is adapted for a dynamic linking, wherein said modification at the computerized system involves modification to the wrapper routine in a user mode and to a system call service routing in a kernel mode, and wherein said modification to each of the benign programs is a compatible modification to signatures of one or more system call invocations.
8. Method according to claim 1 wherein said modification at the computerized system involves modification to the names of one or more methods in a dynamic link library, and wherein each of the benign programs are modified to conform with said modification in said dynamic link library.
9. Method according to claim 5 , wherein the processor is a physical processor.
10. Method according to claim 5 , wherein the processor is a virtual processor or a hypervisor.
11. Method according to claim 1 , wherein said modifications are made on the temporal basis, each time a different subset of essential elements and respective parameters are selected for modification.
12. Method according to claim 1 , wherein the modification to said program further involves recompilation and or relinking of the program.
13. Method according to claim 4 , wherein the modification to said operating system further involves recompilation and or relinking of the operating system.
14. Method according to claim 1 , wherein said modifications to one or more essential elements involve modifications to a virtual machine, and wherein said modification to each benign program involves a compatible modification to a bytecode used by the program.
15. Method according to claim 1 , wherein said modifications to one or more essential elements involve modifications to a JIT compiler, and wherein said modification to each benign program involves a compatible modification to a bytecode used by the program.
16. Method according to claim 5 , wherein the modification of the instruction set is performed by utilizing a microcode update facility available on various modern processors.