Detecting stack pivots using stack artifact verification
Examples of the present disclosure describe systems and methods for detecting and mitigating stack pivoting using stack artifact verification. In aspects, function hooks may be added to one or more functions. When a hooked function executes, artifacts relating to the hooked function may be left on the stack memory (“stack”). The location of the artifacts on the stack may be stored in a local storage area. Each time a hook in a hooked function is subsequently executed, protection may be executed to determine whether an artifact remains in the location stored in the local storage area. If the artifact is no longer in the same location, a stack pivot may be detected and one or more remedial actions may be automatically performed.
1. A non-transitory computer-readable media storing computer executable instructions for:
identifying, at a first time, a first location of an artifact in stack memory, wherein stack memory is associated with a plurality of different locations and the first location is one of the plurality of locations, and wherein the first location represents a previously identified location of the artifact associated with that stack memory;
evaluating, at a second time, the stack memory, wherein the evaluation comprises determining the first location of the artifact is not currently found in the stack memory; and
based on determining the first location is no longer found in the stack memory, performing one or more remedial actions.
2. The non-transitory computer-readable media of claim 1 , wherein the first location is a first return address of a function.
3. The non-transitory computer-readable media of claim 1 , wherein the artifact is added to the stack memory in response to initializing a thread.
4. The non-transitory computer-readable media of claim 1 , wherein the artifact is associated with a thread incorporating hooking functionality.
5. The non-transitory computer-readable media of claim 4 , wherein identifying the first location comprises evaluating the stack memory for the first location when the hooking functionality is executed.
6. The non-transitory computer-readable media of claim 4 , further comprising comparing the first location to a second location of the plurality of different locations, wherein the comparing further comprises evaluating the stack memory for the second location when the hooking functionality is executed.
7. The non-transitory computer-readable media of claim 4 , wherein the hooking functionality is added to one or more checkpoints in software code, and wherein the hooking functionality enables intercepting messages passed between two or more components.
8. The non-transitory computer-readable media of claim 4 , wherein the artifact is associated with a thread creation function for creating the thread, wherein the thread creation function comprises the hooking functionality.
9. The non-transitory computer-readable media of claim 1 , further comprising comparing the first location to a second location of the plurality of different locations, wherein the comparing further comprises accessing a data storage location comprising a second location.
10. The non-transitory computer-readable media of claim 1 , wherein the artifact corresponds to a return address of a calling function.
11. The non-transitory computer-readable media of claim 1 , further comprising comparing the first location to a second location of the plurality of different locations, wherein the comparing further comprises using one or more pattern matching utilities to determine whether the first location matches a second location.
12. The non-transitory computer-readable media of claim 1 , wherein, when it is determined that the first location does not match a second location, determining that a stack pivot exploit has occurred.
13. The non-transitory computer-readable media of claim 1 , wherein the one or more remedial actions comprise at least one of: displaying a warning, terminating a process, modifying a set of privileges, and quarantining a file associated with a process.
14. A system, comprising:
a processor; and
a non-transitory computer readable medium, comprising instructions for:
identifying a first location of an artifact in stack memory at a first time, wherein stack memory is associated with different locations and the first location is one of the locations, and wherein the first location represents a previously identified location of the artifact in that stack memory;
evaluating, at a second time, the stack memory, wherein the evaluation comprises:
determining a current location of the artifact in the stack memory, and
determining that the artifact is not currently associated with the identified first location in the stack memory; and
based on determining the artifact is not currently associated with the first location in the stack memory, performing one or more remedial actions.
15. The system of claim 14 , wherein the first location is associated with a return address.
16. The system of claim 14 , wherein the artifact is added to the stack memory when executing a thread.
17. The system of claim 16 , wherein the thread incorporates a function hook.
18. The system of claim 17 , wherein the first location is identified when the function hook is executed.
19. The system of claim 17 , wherein the first location is compared to a second location when the function hook is executed.