Protecting a Computer Device From Escalation of Privilege Attacks

Patent metadata

Field	Value
Publication number	US-2019325133-A1
Application number	US-201916382578-A
Country	US
Kind code	A1
Filing date	Apr 12, 2019
Priority date	Apr 18, 2018
Publication date	Oct 24, 2019
Grant date	—

Abstract

A computer device has a kernel driver in a kernel mode of the operating system which records an access token as initially associated with a user process. Later, the user process presents its access token when requesting certain operations through the operating system. The kernel driver detects that the user process has been subject to an escalation of privilege attack by evaluating the access token in its presented form as against the initially recorded access token and, in response, performs a mitigation action such as suspending the user process.

First claim

1 . A method of protecting a computer device against an escalation of privilege attack, comprising:
recording, by a kernel driver, an initial access token of a user process which executes on the computer device, and capturing a current access token as presented by the user process at a later point in time when requesting an operation through an operating system of the computer device; and detecting, by the kernel driver, that the user process has been subject to an escalation of privilege attack by evaluating the current access token against the initial access token and, in response, performing a mitigation action with respect to the user process.

2 . The method of claim 1 , wherein the recording comprises storing information of the initial access token in a token cache.

3 . The method of claim 1 , wherein the recording comprises recording a process identity (PID) of the user process and a memory address of the initial access token.

4 . The method of claim 1 , wherein the recording comprises recording the initial access token responsive to creation of the user process by the operating system.

5 . The method of claim 1 , further comprising registering a callback with the operating system to provide a notification of process creation, and recording the initial access token responsive to the callback.

6 . The method of claim 1 , wherein the capturing is responsive to the user process attempting to perform an operation on the computer device which activates any of a set of trigger points which have been established with the operating system.

7 . The method of claim 1 , further comprising establishing a set of trigger points with the operating system of the computer device using one or more callbacks.

8 . The method of claim 7 , wherein the trigger points comprise any one or more of:
creation of a child process of the user process; creation of a remote thread that runs in an address space of another process; requesting access to a system registry managed by the operating system; loading an image of executable code into a memory of the computer device; and requesting access to a file system of the computer device.

9 . The method of claim 1 , wherein the detecting comprises comparing a memory address of the current access token against a memory address of the initial access token.

10 . The method of claim 1 , wherein the detecting comprises probing one or more fields of the current access token.

11 . The method of claim 1 , wherein the detecting comprises comparing one or more fields of the current access token against corresponding fields in the initial access token.

12 . The method of claim 1 , wherein the mitigation action includes suspending the user process.

13 . The method of claim 1 , further comprising any one or more of:
performing custom messaging with a user of the computer device in relation to a suspected escalation of privilege attack; performing auditing of the user process responsive to detecting a suspected escalation of privilege attack; and terminating the user process.

14 . A computer device, comprising:
a kernel driver in a kernel mode supported by an operating system of the computer device, wherein the kernel driver is configured to perform operations including:
recording, in a token cache accessible to the kernel driver, an access token of a user process which will execute on the computer device;
obtaining a current access token as presented by the user process when requesting an operation through the operating system of the computer device; and
detecting that the user process has been subject to an escalation of privilege attack by evaluating the current access token of the user process with reference to the access token as recorded in the token cache and, in response, causing a mitigation action with respect to the user process.

15 . The computer device of claim 14 , wherein the detecting includes receiving notification of creation of a child process of the user process and determining that an access token for the child process differs from the access token of its parent process as recorded in the token cache for the user process.

16 . The computer device of claim 14 , wherein the detecting includes monitoring for creation of a remote thread by receiving notification of a request to create a thread by a calling thread of the user process, and evaluating the thread, when that thread that is to run in an address space of another process, using the current access token of the user process for the calling thread.

17 . The computer device of claim 14 , wherein the detecting includes monitoring for a request by the user process to access to a system registry managed by the operating system.

18 . The computer device of claim 14 , wherein the detecting includes monitoring for a request by the user process to load an image of executable code into a memory of the computer device.

19 . The computer device of claim 14 , wherein the detecting includes monitoring for a request by the user process to access to a file system of the computer device.

20 . A non-transitory computer-readable medium having instructions recorded thereon which when executed cause a computer device to perform operations including:
recording an access token of a user process which will execute on the computer device; obtaining the access token of the user process as presented by when requesting an operation through an operating system of the computer device; detecting that the user process has been subject to an escalation of privilege attack by evaluating the access token as presented with reference to the access token as recorded; and performing a mitigation action with respect to the user process in response to detecting the escalation of privilege attack.

Assignees

• Avecto Ltd

Inventors

• Goodridge John
• Couser Thomas

Classifications

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F2221/2113

  Multi-level security, e.g. mandatory access control · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title