System, methods, and media for protecting network devices from malicious rich text format (RTF) files
Mechanisms, which can include systems, method, and media, for protecting network devices from malicious rich text format (RTF) files are provided, the mechanisms comprising: intercepting an RTF file destined for a network device; parsing the RTF file to identify a plurality of objects in the RTF file; checking a first object of the plurality of objects for a first heuristic; based upon an outcome of the checking of the first object for the first heuristic, increasing a cumulative weight by a first weight value; comparing the cumulative weight against at least one threshold to classify the RTF file; and based on the classification of the RTF file, taking a protective action on the RTF file.
1. A system for protecting network devices from malicious rich text format (RTF) files, comprising:
memory; and
a hardware processor coupled to the memory and configured to:
intercept an RTF file destined for a network device;
parse the RTF file to identify a plurality of objects in the RTF file;
check a first object of the plurality of objects for a first heuristic;
based upon an outcome of the checking of the first object for the first heuristic, increase a cumulative weight by a first weight value;
compare the cumulative weight against at least one threshold to classify the RTF file;
based on the classification of the RTF file, take a protective action on the RTF file: and
for each of a plurality of non-object-linking-and-embedding control words in the RTF file:
identify the non-object-linking-and-embedding control word in the RTF file; and
check a data stream associated with the non-object-linking-and-embedding control word for at least one of: static shell code; dynamic shellcode; an embedded file; a Flash file; encryption; a sledge, and return-oriented- programming code.
2. The system of claim 1 , wherein the hardware processor is further configured to:
based upon the outcome of the checking of the first object for the first heuristic, check the first object for a second heuristic; and
based upon an outcome of the checking of the first object for the second heuristic, increase the cumulative weight by a second weight value.
3. The system of claim 1 , wherein the protective action includes quarantining the RTF file.
4. The system of claim 1 , wherein the hardware processor is further configured to:
identify overlay data in the RTF file;
determine a length of the overlay data; and
increase the cumulative weight if the length of the overlay data is greater than a threshold.
5. The system of claim 1 , wherein the hardware processor is further configured to:
identify a MicrosoftTM Office Open XML (MS-OOXML) file in the RTF file; and
increase the cumulative weight based on the contents of the MS-OOXML file.
6. The system of claim 1 , wherein the hardware processor is further configured to:
identify a MicrosoftTM Compound File Binary (MS-CFB) file in the RTF file; and
increase the cumulative weight based on the contents of the MS-CFB file.
7. A method for protecting network devices from malicious rich text format (RTF) files, comprising:
intercepting an RTF file destined for a network device;
parsing the RTF file to identify a plurality of objects in the RTF file;
checking a first object of the plurality of objects for a first heuristic;
based upon an outcome of the checking of the first object for the first heuristic, increasing a cumulative weight by a first weight value;
comparing the cumulative weight against at least one threshold to classify the RTF file;
based on the classification of the RTF file, taking a protective action on the RTF file; and for each of a plurality of non-object-linking-and-embedding control words in the RTF file:
identifying the non-object-linking-and-embedding control word in the RTF file; and
checking a data stream associated with the non-object-linking-and-embedding control word for at least one of: static shell code; dynamic shellcode; an embedded file; a Flash file; encryption; a sledge, and return-oriented-programming code.
8. The method of claim 7 , further comprising:
based upon the outcome of the checking of the first object for the first heuristic, checking the first object for a second heuristic; and
based upon an outcome of the checking of the first object for the second heuristic, increasing the cumulative weight by a second weight value.
9. The method of claim 7 , wherein the protective action includes quarantining the RTF file.
10. The method of claim 7 , further comprising:
identifying overlay data in the RTF file;
determining a length of the overlay data; and
increasing the cumulative weight if the length of the overlay data is greater than a threshold.
11. The method of claim 7 , further comprising:
identifying a MicrosoftTM Office Open XML (MS-OOXML) file in the RTF file; and
increasing the cumulative weight based on the contents of the MS-OOXML file.
12. The method of claim 7 , further comprising:
identifying a MicrosoftTM Compound File Binary (MS-CFB) file in the RTF file; and
increasing the cumulative weight based on the contents of the MS-CFB file.
13. A non-transitory computer-readable medium containing computer executable instructions that, when executed by a processor, cause the processor to perform a method for protecting network devices from malicious rich text format (RTF) files, the method comprising:
intercepting an RTF file destined for a network device;
parsing the RTF file to identify a plurality of objects in the RTF file;
checking a first object of the plurality of objects for a first heuristic;
based upon an outcome of the checking of the first object for the first heuristic, increasing a cumulative weight by a first weight value;
comparing the cumulative weight against at least one threshold to classify the RTF file;
based on the classification of the RTF file, taking a protective action on the RTF file; and
for each of a plurality of non-object-linking-and-embedding control words in the RTF file:
identifying the non-object-linking-and-embedding control word in the RTF file; and
checking a data stream associated with the non-object-linking-and-embedding control word for at least one of: static shell code; dynamic shellcode; an embedded file; a Flash file; encryption; a sledge, and return-oriented-programming code.
14. The non-transitory computer-readable medium of claim 13 , wherein the method further comprises:
based upon the outcome of the checking of the first object for the first heuristic, checking the first object for a second heuristic; and
based upon an outcome of the checking of the first object for the second heuristic, increasing the cumulative weight by a second weight value.
15. The non-transitory computer-readable medium of claim 13 , wherein the protective action includes quarantining the RTF file.
16. The non-transitory computer-readable medium of claim 13 , wherein the method further comprises:
identifying overlay data in the RTF file;
determining a length of the overlay data; and
increasing the cumulative weight if the length of the overlay data is greater than a threshold.
17. The non-transitory computer-readable medium claim 13 , wherein the method further comprises:
identifying a MicrosoftTM Office Open XML (MS-OOXML) file in the RTF file; and
increasing the cumulative weight based on the contents of the MS-OOXML file.