Evaluating installers and installer payloads
A reputation of an installer may be determined based on contextual information including its source (e.g., its publisher), a cryptographic signature or certificate, a process that carried out its download, a user that initiated its download, whether the installer has been previously vetted by a security policy, and so forth. A corresponding reputation may then be inferred for each of the computer objects contained within the installer, such that the reputation remains with the computer objects if/when they are unpacked on an endpoint. Each of the computer objects may then be unpacked for individual analysis (e.g., a static analysis) regarding each object's compliance with a security policy, thereby producing a second reputation for each computer object. A decision whether to execute the installer/objects, e.g., during an installation process, may then be made by reconciling the reputation of the installer and the second reputation for each computer object.
1. A method for evaluating computer objects supplied in an installer for unpacking and execution on a computing device, the method comprising:
receiving an installer on an endpoint, the installer containing one or more packed computer objects;
determining a reputation of the installer;
unpacking each of the packed computer objects on the endpoint to provide one or more unpacked computer objects, wherein unpacking includes creating a signature for each of the packed computer objects before unpacking;
associating the reputation of the installer with each of the one or more unpacked computer objects such that the reputation of the installer is inherited as a first reputation of each of the one or more unpacked computer objects;
in a secure environment, analyzing each of the unpacked computer objects to evaluate compliance with a security policy and provide a second reputation, wherein analyzing each of the unpacked computer objects includes looking up information using the signature for one or more of the packed computer objects;
for each of the one or more unpacked computer objects, reconciling the first reputation and the second reputation to a reconciled reputation, the reconciled reputation based on weighting each of the first reputation and the second reputation according to confidence in the respective reputation;
providing a determination regarding whether to permit or deny execution of each of the one or more unpacked computer objects on the endpoint based on the reconciled reputation; and
based on the determination, permitting or denying execution of each of the one or more unpacked computer objects on the endpoint.
2. The method of claim 1 wherein analyzing each of the unpacked computer objects includes performing a static analysis of one or more of the unpacked computer objects.
3. The method of claim 2 wherein analyzing each of the unpacked computer objects includes determining a signature for one or more of the unpacked computer objects.
4. The method of claim 3 wherein the signature includes a checksum.
5. The method of claim 2 wherein analyzing each of the unpacked computer objects includes retrieving the second reputation from a remote database.
6. The method of claim 2 wherein analyzing each of the unpacked computer objects includes an evaluation of a publisher reputation for one or more of the unpacked computer objects.
7. The method of claim 2 wherein analyzing each of the unpacked computer objects includes an evaluation of a certificate or cryptographic signature associated with one or more of the unpacked computer objects.
8. The method of claim 1 further comprising monitoring execution of each of the unpacked computer objects for possible security threats or compliance with the security policy.
9. The method of claim 8 further comprising updating the reputation of the installer when monitoring execution leads to a detection of a security threat or noncompliance with the security policy.
10. The method of claim 8 wherein monitoring execution of each of the unpacked computer objects takes place in at least one of a sandboxed environment, a virtualized environment, or an emulated environment.
11. The method of claim 1 further comprising updating the reputation of the installer when the second reputation indicates noncompliance with the security policy or detection of a security threat.
12. The method of claim 1 wherein determining the reputation of the installer includes determining a source of the installer and using the source to determine the reputation.
13. The method of claim 12 wherein the source of the installer is determined from one or more of a signature, a certificate, and a location on a network.
14. The method of claim 1 wherein reconciling the first reputation and the second reputation includes prioritizing the first reputation of the installer when the first reputation indicates a trusted vendor.
15. The method of claim 1 wherein reconciling the first reputation and the second reputation includes prioritizing the second reputation of one of the unpacked computer objects when the second reputation indicates known malicious code.
16. The method of claim 1 wherein one of the unpacked computer objects is a second installer.
17. A computer program product comprising non-transitory computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
receiving, on an endpoint, an installer containing one or more packed computer objects;
determining a reputation of the installer;
unpacking each of the packed computer objects to provide one or more unpacked computer objects, wherein unpacking includes creating a signature for each of the packed computer objects before unpacking;
associating the reputation of the installer with each of the one or more unpacked computer objects such that the reputation of the installer is inherited as a first reputation of each of the one or more unpacked computer objects;
in a secure environment, analyzing each of the unpacked computer objects to evaluate compliance with a security policy and provide a second reputation, wherein analyzing each of the unpacked computer objects includes looking up information using the signature for one or more of the packed computer objects;
for each of the one or more unpacked computer objects, reconciling the first reputation and the second reputation to a reconciled reputation, the reconciled reputation based on weighting each of the first reputation and the second reputation according to confidence in the respective reputation;
providing a determination regarding whether to permit or deny execution of each of the one or more unpacked computer objects on a device based on the reconciled reputation; and
based on the determination, permitting or denying execution of each of the one or more unpacked computer objects on the device.
18. A system for evaluating computer objects supplied in an installer for unpacking and execution on a computing device, the system comprising:
a processor; and
a non-transitory computer-readable medium comprising computer executable instructions, the computer executable instructions when executing on the processor performs operations comprising
receiving, on the computing device, an installer containing one or more packed computer objects;
determining a reputation of the installer;
unpacking each of the packed computer objects to provide one or more unpacked computer objects, wherein unpacking includes creating a signature for each of the packed computer objects before unpacking;
associating the reputation of the installer with each of the one or more unpacked computer objects such that the reputation of the installer is inherited as a first reputation of each of the one or more unpacked computer objects;
in a secure environment, determining a second reputation of the one or more unpacked computer objects, wherein determining the second reputation of the one or more unpacked computer objects includes looking up information using the signature for one or more of the packed computer objects; and
for each of the one or more unpacked computer objects, reconciling the first reputation and the second reputation to a reconciled reputation, the reconciled reputation based on weighting each of the first reputation and the second reputation according to confidence in the respective reputation;
providing a determination regarding whether to permit or deny execution of each of the one or more unpacked computer objects on the computing device based on the reconciled reputation; and
based on the determination, permitting or denying execution of each of the one or more unpacked computer objects on the computing device.
19. The system of claim 18 wherein determining the first reputation includes one or more of calculating a signature for the installer and evaluating a source of the installer, and wherein determining the second reputation includes one or more of calculating a signature for the one or more packed computer objects, calculating a signature for the one or more unpacked computer objects, performing a behavior analysis of one or more unpacked computer objects, and executing the one or more unpacked computer objects in a sandbox.