Systems and methods for detecting unknown vulnerabilities in computing processes

1. A computer-implemented method for detecting unknown vulnerabilities in computing processes, at least a portion of the method being performed by a server comprising at least one processor, the method comprising:

obtaining, by the server, telemetry data from a computing device on which a computing process crashed while running within a computing environment, wherein the telemetry data:

is related to the computing process that crashed while running within the computing environment; and

comprises a crash dump, a call stack of the computing environment, and a trace of an application program interface called by the computing process;

searching the telemetry data at the server for evidence of any vulnerabilities that potentially led the computing process to crash while running within the computing environment on the computing device;

identifying, while searching the telemetry data at the server, evidence of a vulnerability of the computing process, wherein the evidence of the vulnerability comprises a pattern identified across the telemetry data that indicates that:

the call stack included an exception handler of the computing process and overflowed while the computing process was running within the computing environment; and

the exception handler of the computing process was overwritten as a result of the call stack overflowing;

determining, by the server, that the vulnerability represents a zero-day vulnerability that is not yet known to exist within the computing process by:

querying a database that includes a running list of vulnerabilities known to affect certain computing processes; and

determining, based at least in part on the query, that the database does not identify the computing process as having the vulnerability; and

in response to identifying the evidence of the computing process's vulnerability and determining that the vulnerability represents a zero-day vulnerability that is not yet known to exist within the computing process, performing at least one security action to hinder any potentially malicious exploitation of the computing process's vulnerability.

2. The method of claim 1 , wherein logging the telemetry data comprises at least one of:

creating a crash dump;

recording a call stack of the computing environment;

tracing at least one API called by the computing process; and

identifying which call stack of the computing environment was involved in the crash of the computing process.

3. The method of claim 1 , further comprising determining that the computing process crashed while running within the computing environment by detecting the overflow of the call stack within the computing environment while the computing process is running within the computing environment.

4. The method of claim 1 , wherein identifying the evidence of the computing process's vulnerability further comprises determining, based at least in part on the telemetry data, that a virtual address of the computing process on the call stack within the computing environment was overwritten while the computing process was running within the computing environment.

5. The method of claim 1 , wherein performing the security action in response to identifying the evidence of the computing process's vulnerability comprises at least one of:

notifying a vendor of the computing process about the computing process's vulnerability;

adding a record of the computing process's vulnerability to a database that identifies known vulnerabilities of certain computing processes; and

modifying a computer security system to monitor for any attempts to exploit the computing process's vulnerability.

6. The method of claim 1 , further comprising monitoring the computing environment on the computing device by logging the telemetry data with at least one of:

an Application Programming Interface (API) hook;

a packet capture component;

a file system monitor; and

a network switch.

7. The method of claim 6 , wherein logging the telemetry data with the API hook comprises at least one:

inserting a hook within an API that is commonly called during malicious attacks; and

inserting a hook within a code path that leads to an API that is commonly called during malicious attacks.

8. A system for detecting unknown vulnerabilities in computing processes, the system comprising:

a monitoring module, stored in memory, that:

obtains telemetry data from a computing device on which a computing process crashed while running within a computing environment, wherein the telemetry data:

is related to the computing process that crashed while running within the computing environment; and

comprises a crash dump, a call stack of the computing environment, and a trace of an application program interface called by the computing process;

an analysis module, stored in memory, that:

searches the telemetry data for evidence of any vulnerabilities that potentially led the computing process to crash while running within the computing environment on the computing device;

identifies, while searching the telemetry data, evidence of a vulnerability of the computing process, wherein the evidence of the vulnerability comprises a pattern identified across the telemetry data that indicates that:

the call stack included an exception handler of the computing process and overflowed while the computing process was running within the computing environment; and

the exception handler of the computing process was overwritten as a result of the call stack overflowing;

determines that the vulnerability represents a zero-day vulnerability that is not yet known to exist within the computing process by:

querying a database that includes a running list of vulnerabilities known to affect certain computing processes; and

determining, based at least in part on the query, that the database does not identify the computing process as having the vulnerability;

a security module, stored in memory, that performs at least one security action to hinder any potentially malicious exploitation of the computing process's vulnerability in response to the identification of the evidence and the determination that the vulnerability represents a zero-day vulnerability that is not yet known to exist within the computing process; and

at least one physical processor that executes the monitoring module, the analysis module, and the security module.

9. The system of claim 8 , wherein the monitoring module logs the telemetry data by at least one of:

creating a crash dump;

recording a call stack of the computing environment;

tracing at least one API called by the computing process; and

identifying which call stack of the computing environment was involved in the crash of the computing process.

10. The system of claim 8 , wherein the monitoring module determines that the computing process crashed by detecting the overflow of the call stack within the computing environment while the computing process is running within the computing environment.

11. The system of claim 8 , wherein the analysis module identifies the evidence of the computing process's vulnerability by determining, based at least in part on the telemetry data, that a virtual address of the computing process on the call stack within the computing environment was overwritten while the computing process was running within the computing environment.

12. The system of claim 8 , wherein the monitoring module logs the telemetry data with at least one of:

an Application Programming Interface (API) hook;

a packet capture component;

a file system monitor; and

a network switch.

13. The system of claim 12 , wherein the monitoring module logs the telemetry data with the API hook by at least one:

inserting a hook within an API that is commonly called during malicious attacks; and

inserting a hook within a code path that leads to an API that is commonly called during malicious attacks.

14. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a server, cause the server to:

obtain, by the server, telemetry data from a computing device on which a computing process crashed while running within a computing environment, wherein the telemetry data:

is related to the computing process that crashed while running within the computing environment; and

comprises a crash dump, a call stack of the computing environment, and a trace of an application program interface called by the computing process;

search the telemetry data at the server for evidence of any vulnerabilities that potentially led the computing process to crash while running within the computing environment on the computing device;

identify, while searching the telemetry data at the server, evidence of a vulnerability of the computing process, wherein the evidence of the vulnerability comprises a pattern identified across the telemetry data that indicates that:

the call stack included an exception handler of the computing process and overflowed while the computing process was running within the computing environment; and

the exception handler of the computing process was overwritten as a result of the call stack overflowing;

determine, by the server, that the vulnerability represents a zero-day vulnerability that is not yet known to exist within the computing process by:

querying a database that includes a running list of vulnerabilities known to affect certain computing processes; and

determining, based at least in part on the query, that the database does not identify the computing process as having the vulnerability; and

perform at least one security action to hinder any potentially malicious exploitation of the computing process's vulnerability represents a zero-day vulnerability that in response to identifying the evidence of the computing process's vulnerability and determining that the vulnerability is not yet known to exist within the computing process.