Security against physical keystroke simulation
A computer-implemented method includes detecting, by a computing device, a request from a macro included in a document file that is open in a software application executing on the computing device, where the macro comprises executable code and where the document file further includes non-executable document content. The method further includes determining if the request includes simulation of a physical keystroke based on detecting that the request includes a function call to a function that synthesizes keystrokes. The method further includes responsive to determining that the request includes simulation of the physical keystroke, preventing the request from being satisfied.
1 . A computer-implemented method comprising:
detecting, by a computing device, a request from a macro included in a document file that is open in a software application executing on the computing device, wherein the macro comprises interpretable code and wherein the document file further includes non-executable document content;
modifying code associated with a dynamic library loaded in memory of the computing device, such that, responsive to the request including simulation of a physical keystroke by a function call to a function in the dynamic library that synthesizes keystrokes, a jump instruction to security code is executed;
determining if the request includes simulation of the physical keystroke based on detecting that the request includes the function call to the function that synthesizes keystrokes and based on determining that the function call originates with an address of a memory location from heap memory of the computing device; and
responsive to determining that the request includes simulation of the physical keystroke, preventing the request from being satisfied by executing the jump instruction to the security code, wherein execution of the security code causes termination of the macro.
2 . The computer-implemented method of claim 1 , wherein the execution of the security code further includes executing security software to scan the computing device for malware.
3 . The computer-implemented method of claim 1 , wherein the function call to the dynamic library includes a NtUserSendInput function.
4 . The computer-implemented method of claim 1 , further comprising responsive to determining that the request does not include simulation of the physical keystroke, satisfying the request.
5 . The computer-implemented method of claim 1 , wherein the execution of the security code further causes terminating execution of the software application, and the method further comprises causing a user interface to be displayed by the computing device, wherein the user interface includes a warning that the document file cannot be opened.
6 . The computer-implemented method of claim 1 , further comprising causing a user interface to be displayed that includes a warning about the macro.
7 . The computer-implemented method of claim 1 , further comprising determining, based on a policy associated with the computing device, to terminate the software application.
8 . The computer-implemented method of claim 1 , further comprising:
generating a fingerprint based on the document file, wherein the fingerprint is based at least in part on the macro in the document file and wherein the fingerprint is obtained using a hash function;
determining that the fingerprint matches a stored fingerprint associated with a permission to mimic physical keystrokes; and
in response to determining that the fingerprint matches the stored fingerprint, permitting the request to be fulfilled.
9 . A computing device comprising:
one or more processors; and
one or more memories in communication with the one or more processors, with instructions stored thereon that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
detecting a request from a macro included in a document file that is open in a software application executing on the computing device, wherein the macro comprises executable code and wherein the document file further includes non-executable document content;
modifying code associated with a dynamic library loaded in memory of the computing device, such that, responsive to the request including simulation of a physical keystroke by a function call to a function in the dynamic library that synthesizes keystrokes, a jump instruction to security code is executed;
determining if the request includes simulation of the physical keystroke based on detecting that the request includes the function call to the function that synthesizes keystrokes and based on determining that the function call originates with an address of a memory location from heap memory of the computing device; and
responsive to determining that request includes simulation of the physical keystroke, preventing the request from being satisfied by executing the jump instruction to the security code, wherein execution of the security code causes termination of the macro.
10 . The computing device of claim 9 , wherein the function call to the dynamic library includes a NtUserSendInput function.
11 . The computing device of claim 10 , wherein the operations further include:
generating a fingerprint based on the document file, wherein the fingerprint is based at least in part on the macro in the document file and wherein the fingerprint is obtained using a hash function;
determining that the fingerprint matches a stored fingerprint associated with a permission to mimic physical keystrokes; and
in response to determining that the fingerprint matches the stored fingerprint, permitting the request to be fulfilled.
12 . The computing device of claim 9 , wherein the operations further include responsive to determining that the request does not include simulation of the physical keystroke, satisfying the request.
13 . The computing device of claim 9 , wherein the security code includes terminating execution of the software application and the operations further include causing a user interface to be displayed that includes a warning that the document file cannot be opened.
14 . The computing device of claim 9 , wherein the operations further include causing a user interface to be displayed that includes a warning about the macro.
15 . The computing device of claim 9 , wherein the operations further include determining, based on a policy associated with the computing device, to terminate the software application.
16 . A computer-program product that includes one or more non-transitory computer-readable media with instructions stored thereon that, when executed by a computing device, cause the computing device to perform operations comprising:
detecting a request from a macro included in a document file that is open in a software application executing on the computing device, wherein the macro comprises executable code and wherein the document file further includes non-executable document content;
modifying code associated with a dynamic library loaded in memory of the computing device, such that, responsive to the request including simulation of a physical keystroke by a function call to a function in the dynamic library that synthesizes keystrokes, a jump instruction to security code is executed;
determining if the request includes simulation of the physical keystroke based on detecting that the request includes the function call to the function that synthesizes keystrokes and based on determining that the function call originates with an address of a memory location from heap memory of the computing device; and
responsive to determining that request includes simulation of the physical keystroke, preventing the request from being satisfied by executing the jump instruction to the security code, wherein execution of the security code causes termination of the macro.
17 . The computer-program product of claim 16 , wherein the execution of the security code further includes executing security software to scan the computing device for malware.
18 . The computer-program product of claim 16 , wherein the operations further include:
generating a fingerprint based on the document file, wherein the fingerprint is based at least in part on the macro in the document file and wherein the fingerprint is obtained using a hash function;
determining that the fingerprint matches a stored fingerprint associated with a permission to mimic physical keystrokes; and
in response to determining that the fingerprint matches the stored fingerprint, permitting the request to be fulfilled.
19 . The computer-program product of claim 16 , wherein the operations further include responsive to determining that the request does not include simulation of the physical keystroke, satisfying the request.
20 . The computer-program product of claim 16 , wherein the security code includes terminating execution of the software application and the operations further include causing a user interface to be displayed that includes a warning that the document file cannot be opened.