Protecting computing devices from a malicious process by exposing false information
Various automated techniques are described herein for protecting computing devices from malicious code injection and execution by providing a malicious process with incorrect information regarding the type and/or version and/or other characteristics of the operating system and/or the targeted program and/or the targeted computing device. The falsified information tricks the malicious process into injecting shellcode that is incompatible with the targeted operating system, program and/or computing device. When the incompatible, injected shellcode attempts to execute, it fails as a result of the incompatibility, thereby protecting the computing device.
1. A method for protecting a computing device from shellcode injection and execution, comprising:
detecting a query that requests information about at least one of an operating system or a first computing process executing on the computing device, the query being issued from a second computing process;
falsifying the information about the at least one of the operating system or the first computing process; and
providing the falsified information to the second computing process, wherein the falsified information causes execution of a shellcode to fail, the shellcode comprising code that has been injected into the first computing process and that is associated with the second computing process.
2. The method of claim 1 , wherein the information comprises at least one of:
a type of the at least one of the operating system or the first computing process;
a version of the at least one of the operating system or the first computing process; or
an identifier of the at least one of the operating system or the first computing process.
3. The method of claim 1 , wherein the second computing process comprises at least one of:
a malicious website;
a network scanner; or
a malicious macro.
4. The method of claim 1 , wherein the detecting step comprises:
hooking a procedure call issued from the second computing process that requests the information.
5. The method of claim 1 , wherein execution of the shellcode causes an exception to be thrown by the first computing device.
6. The method of claim 5 , further comprising:
determining that a malicious attack has occurred in response to detecting the exception; and
performing an action to neutralize the shellcode.
7. The method of claim 6 , wherein the performing step comprises:
terminating the shellcode;
suspending the shellcode;
activating an anti-virus program;
recording to an event log an event that indicates that the shellcode attempted execution; or
prompting a user of the computing device to specify an operation to perform.
8. A system, comprising:
one or more processors; and
a memory coupled to the one or more processors, the memory storing instructions, which, when executed by the one or more processors, cause the one or more processors to perform operations, the operations comprising:
detecting a query that requests information about at least one of an operating system or a first computing process executing on the computing device, the query being issued from a second computing process;
falsifying the information about the at least one of the operating system or the first computing process; and
providing the falsified information to the second computing process, wherein the falsified information causes execution of a shellcode to fail, the shellcode comprising code that has been injected into the first computing process and that is associated with the second computing process.
9. The system of claim 8 , wherein the information comprises at least one of:
a type of the at least one of the operating system or the first computing process;
a version of the at least one of the operating system or the first computing process; or
an identifier of the at least one of the operating system or the first computing process.
10. The system of claim 8 , wherein the second computing process comprises at least one of:
a malicious website;
a network scanner; or
a malicious macro.
11. The system of claim 8 , wherein the detecting step comprises:
hooking a procedure call issued from the second computing process that requests the information.
12. The system of claim 8 , wherein execution of the shellcode causes an exception to be thrown by the first computing device.
13. The system of claim 12 , the operations further comprising:
determining that a malicious attack has occurred in response to detecting the exception; and
performing an action to neutralize the shellcode.
14. The system of claim 13 , wherein the performing step comprises:
terminating the shellcode;
suspending the shellcode;
activating an anti-virus program;
recording to an event log an event that indicates that the shellcode attempted execution; or
prompting a user of the computing device to specify an operation to perform.
15. A computer-readable storage medium having program instructions recorded thereon that, when executed by a processing device, perform a method for protecting a computing device from shellcode injection and execution, the method comprising:
detecting a query that requests information about at least one of an operating system or a first computing process executing on the computing device, the query being issued from a second computing process;
falsifying the information about the at least one of the operating system or the first computing process; and
providing the falsified information to the second computing process, wherein the falsified information causes execution of a shellcode to fail, the shellcode comprising code that has been injected into the first computing process and that is associated with the second computing process.
16. The computer-readable storage medium of claim 15 , wherein the information comprises at least one of:
a type of the at least one of the operating system or the first computing process;
a version of the at least one of the operating system or the first computing process; or
an identifier of the at least one of the operating system or the first computing process.
17. The computer-readable storage medium of claim 15 , wherein the second computing process comprises at least one of:
a malicious website;
a network scanner; or
a malicious macro.
18. The computer-readable storage medium of claim 15 , wherein the detecting step comprises:
hooking a procedure call issued from the second computing process that requests the information.
19. The computer-readable storage medium of claim 15 , wherein execution of the shellcode causes an exception to be thrown by the first computing device.
20. The computer-readable storage medium of claim 19 , wherein the method further comprises:
determining that a malicious attack has occurred in response to detecting the exception; and
performing an action to neutralize the shellcode.