System, method, and computer program product for reacting in response to a detection of an attempt to store a configuration file and an executable file on a removable device

Patent metadata

Field	Value
Publication number	US-9531748-B2
Application number	US-201414578543-A
Country	US
Kind code	B2
Filing date	Dec 22, 2014
Priority date	Jun 27, 2008
Publication date	Dec 27, 2016
Grant date	Dec 27, 2016

Abstract

A system, method, and computer program product are provided for reacting in response to a detection of an attempt to store a configuration file and an executable file on a removable device. In use, a first device removably coupled to a second device is identified. Additionally, an attempt to store on the first device a configuration file for the first device and an executable file is detected. Further, a reaction is performed in response to the detection of the attempt.

First claim

What is claimed is:

1. A non-transitory, tangible, computer readable medium comprising one or more instructions that, when executed on a processor, configure the processor to perform operations comprising:
monitoring, by a security system, file copy or create operations directed to a removable storage device to detect an attempt by a program on a first device to store a configuration file and an executable file on the removable storage device; and,
in response to detecting the attempt, displaying, by the security system, an alert including at least a part of text in the configuration file, wherein the part of the text in the configuration file identifies that the executable file is to be executed via the configuration file.

2. The non-transitory, tangible, computer readable medium of claim 1 , wherein the security system does not have a malware signature for the program.

3. The non-transitory, tangible, computer readable medium of claim 1 , wherein the operations further comprise:
flagging the program for a review by the security system in response to a selection to prevent the attempt to store the configuration file and the executable file on the removable storage device.

4. The non-transitory, tangible, computer readable medium of claim 1 , wherein the operations further comprise:
preventing a storage of the configuration file and the executable file on the removable storage device.

5. The non-transitory, tangible, computer readable medium of claim 1 , wherein the configuration file includes one or more instructions for an operating system of a second device to run the executable file upon the removable storage device being coupled to the second device.

6. The non-transitory, tangible, computer readable medium of claim 1 , wherein the configuration file includes a file for configuring software on a second device.

7. The non-transitory, tangible, computer readable medium of claim 1 , wherein the configuration file includes a setup information (INF) file.

8. The non-transitory, tangible, computer readable medium of claim 1 , wherein the configuration file is a text-based configuration file.

9. The non-transitory, tangible, computer readable medium of claim 1 , wherein the operations further comprise:
displaying one or more of the following: a name, a location, and a source of the configuration file.

10. The non-transitory, tangible, computer readable medium of claim 1 , wherein the alert comprises one or more of the following: a name, a location, a source, and content of the executable file.

11. The non-transitory, tangible, computer readable medium of claim 1 , wherein the executable file includes one or more of the following: a malware file, a virus software file, an adware file, and a spyware file.

12. The non-transitory, tangible, computer readable medium of claim 1 , wherein the removable storage device is removably coupled to the first device via a universal serial bus (USB) connection or an Institute of Electrical and Electronics Engineers (IEEE) 1394 connection.

13. The non-transitory, tangible, computer readable medium of claim 1 , wherein the removable storage device is removably coupled to the first device via a Bluetooth wireless connection or a network connection.

14. The non-transitory, tangible, computer readable medium of claim 1 , wherein the removable storage device includes one or more of the following: a portable hard drive device, a flash-based memory device, a shared network drive, and a portable music player.

15. The non-transitory, tangible, computer readable medium of claim 1 , wherein the operations further comprise:
monitoring, by the security system, ports of the first device to identify that the removable storage device coupled to the first device.

16. A device, comprising:
a processor, and
a memory having instructions stored thereon, wherein the instructions are executable by the processor to cause the device to
monitor, by a security system, file copy or create operations directed to a removable storage device to detect an attempt by a program on the device to store a configuration file and an executable file on the removable storage device; and,
in response to detecting the attempt, display, by the security system, an alert including at least a part of text in the configuration file, wherein the part of the text in the configuration file identifies that the executable file is to be executed via the configuration file.

17. The device of claim 16 , wherein the security system does not have a malware signature for the program.

18. A method, comprising:
monitoring, by a security system, file copy or create operations directed to a removable storage device to detect an attempt by a program on a device to store a configuration file and an executable file on the removable storage device; and,
in response to detecting the attempt, displaying, by the security system, an alert including at least a part of text in the configuration file, wherein the part of the text in the configuration file identifies that the executable file is to be executed via the configuration file.

19. The method of claim 18 , wherein the security system does not have a malware signature for the program.

Assignees

• Mcafee Inc

Inventors

• Kumar Lokesh
• Ramachetty Harinath V

Classifications

• H04W12/08

  Access security · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title