Computer system and method for preventing dynamic-link library injection attack

Patent metadata

Field	Value
Publication number	US-8966511-B2
Application number	US-88569510-A
Country	US
Kind code	B2
Filing date	Sep 20, 2010
Priority date	Jan 18, 2010
Publication date	Feb 24, 2015
Grant date	Feb 24, 2015

Abstract

A computer system and method for preventing a Dynamic-Link Library (DLL) injection attack are provided. The computer system monitors an operation where a process attempts to dynamically link an executable code library to another process, and intercepts the dynamic link of the executable code library.

First claim

What is claimed is:

1. A computer system comprising:
a monitoring unit configured to monitor an injection operation by which a first process attempts to dynamically link an executable code library to a second process, the monitoring unit comprising a connection checking unit configured to determine that the injection operation occurs by determining that the first process attempts to create a thread in the second process, and by determining that a function of the created thread that is yet to be executed by the second process, will cause the second process to load the executable code library to the second process; and
an intercept unit configured to intercept the dynamic link of the
executable code library in response to the injection operation occurring,
wherein the connection checking unit further checks whether the second process differs from the first process and whether a parameter of the function to be executed by the thread is a name of the executable code library,
wherein the connection checking unit further checks whether the second process differs from the first process and whether a parameter of the function to be executed by the thread is name of the executable code library.

2. The computer system of claim 1 , wherein the monitoring unit further comprises a call determination unit configured to determine whether a thread creation function is called, and
the parameter of the function is obtained by function hooking at a point in time when the thread creation function is called.

3. The computer system of claim 1 , wherein the intercept unit comprises:
a termination unit configured to terminate a thread that is created in association with the injection operation.

4. The computer system of claim 1 , wherein the intercept unit terminates a thread created in association with the injection operation and intercepts the link.

5. The computer system of claim 1 , further comprising:
an interface unit to receive a user's input and to determine whether to operate the monitoring unit based on the user's input.

6. The computer system of claim 1 , further comprising:
an interface unit to output information about an occurrence of the injection operation using an output device.

7. The computer system of claim 1 , wherein the executable code library comprises a Dynamic Link Library (DLL) and the injection operation comprises a DLL injection.

8. A method of preventing a library injection attack in a computer system, the method comprising:
monitoring an injection operation by which a first process attempts to dynamically link an executable code library to a second process, the monitoring comprising determining that the injection operation occurs by determining that the first process attempts to create a thread in the second process, and by determining that a function of the created thread that is yet to be executed by the second process, will cause the second process to load the executable code library to the second process; and
intercepting the dynamic link of the executable code library in response to the injection operation occurring,
wherein the monitoring further checks whether the second process differs from the first process and whether a parameter of the function to be executed by the thread is name of the executable code library.

9. The method of claim 8 , wherein the monitoring further comprises determining whether a thread creation function is called, and
the parameter of the function is obtained by function hooking at a point in time when the thread creation function is called.

10. The method of claim 8 , wherein the intercepting comprises terminating a thread that is created in association with the injection operation.

11. The method of claim 8 , wherein the intercepting comprises terminating a thread created in association with the injection operation, and intercepting the link.

12. The method of claim 8 , further comprising:
determining whether to monitor the injection operation based on a user's input.

13. The method of claim 8 , further comprising:
outputting information concerning an occurrence of the injection operation using an output device.

14. A non-transitory computer-readable storage medium storing a program to cause a processor to execute a method of preventing a library injection attack in a computer system, the method comprising:
monitoring an injection operation by which a first process attempts to dynamically link an executable code library to a second process, the monitoring comprising determining that the injection operation occurs by determining that the first process attempts to create a thread in the second process, and by determining that a function of the thread that is yet to be executed by the second process, will cause the second process to load the executable code library to the second process; and
intercepting the link of the executable code library in response to the injection operation occurring,
wherein the monitoring further checks whether the second process differs from the first process and whether a parameter of the function to be executed by the thread is name of the executable code library.

15. The computer readable storage medium of claim 14 , wherein the monitoring further comprises determining whether a thread creation function is called, and
the parameter of the function is obtained by function hooking at a point in time when the thread creation function is called.

Assignees

• Kim Eun Ah
• Jin Weon Il
• Kim Hwan Joon
• Samsung Electronics Co Ltd

Inventors

• Kim Eun Ah
• Jin Weon Il
• Kim Hwan Joon

Classifications

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F9/44521

  Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading · CPC title