System and method for discovering application tampering

Abstract

A system and method for early detection of compromised client devices includes a tamper detection service configured to monitor modifications to resource access privileges over time to identify anomalous changes indicative of a compromised jailbroken state of a client device. For example, the tamper detection service can monitor a jailbroken state of system files over time to expose attempts to hide a jailbroken state of a protected resource. To verify whether malware is attempting to hide a jailbroken state of a protected resource, the tamper detection process can initiate multiple different resource accesses to the protected resource to determine whether different accessibility results are returned that are indicative of a compromised device.

Description

[0001] Cross-references to related applications

[0002] This application claims priority to U.S. Patent Application Serial No. 16 / 576,303, filed September 19, 2019, entitled “SYSTEM AND METHOD FOR APPLICATION TAMPER DISCOVERY” (published May 5, 2020, under U.S. Patent No. 10,642,979). The contents of the aforementioned patent application are incorporated herein by reference in their entirety. Background Technology

[0003] Online device manufacturers typically incorporate security features into their products to prevent malicious third-party exploitation of these devices. Exploitation of computing devices involves hacking the device by exploiting weaknesses in the operating system, applications, libraries, or other software code. This could involve adding code to transfer personal information for malicious purposes. Such exploitation can occur when a customer uses a client device to access a malicious or compromised website. Malicious or compromised websites can deploy exploit kits on client devices, which include software that can be used to release attacks on various browser vulnerabilities by deploying malware on the victim's computer.

[0004] Client devices prevent malware by strictly controlling access to their hardware and software resources. Circumventing these protections includes jailbreaking the client device. Jailbreaking is a process that removes software and hardware restrictions from a device to allow root access to the iOS operating system, allowing the download and execution of unauthorized applications, extensions, and themes unavailable through the official Apple App Store. For example, Cydia... TM It is a third-party app store that offers unapproved modified and altered applications and games for protected purposes. Equipment usage.

[0005] Jailbroken devices may interact with various applications provided by service providers, thus jeopardizing the security of the service provider's infrastructure. Therefore, service providers can implement security protocols including jailbreak detection mechanisms configured to block access to jailbroken client devices. For example, a jailbreak detection mechanism might attempt to access restricted or otherwise protected resources, such as the operating system root directory, and successfully access protected resources reflecting the jailbreak state of the client device. Applications available in the Cydia repository and deployed by hackers have implemented countermeasures configured to intercept jailbreak detection mechanisms to mask the jailbreak state of client devices. For example, malware can "hook" jailbreak detection communication between application servers and client devices by intercepting file system queries and returning incorrect access states to hide the jailbreak state of restricted files. The goal is to discover a system and method for quickly and accurately identifying compromised client devices to protect the service provider's infrastructure. Summary of the Invention

[0006] According to one aspect, a method for detecting compromised client devices includes the step of monitoring the client device executing an application, wherein the client device may include a set of protected resources that are not accessible to the application. The method includes the step of identifying exposed resources, wherein exposed resources may include protected resources with modified privilege levels to make the protected resources accessible to the application. The method may include the steps of maintaining a record of exposed resources and detecting hidden resources, wherein hidden resources are available to the application but are hidden from the record of exposed resources. The method includes selectively disabling the application in response to the detection of hidden resources.

[0007] In some embodiments, the protected resource set may be a protected resource set including system files, directories, libraries, variables, databases, functions, applications, services, other restricted resources, or combinations thereof. Monitoring the protected resource set may include issuing a series of access requests to the protected resource set, the series of access requests including an access request for each protected resource in the protected resource set, the access request including a first access function.

[0008] In some embodiments, the step of monitoring a protected resource set may include the following steps: periodically issuing a series of access requests to the protected resource set using a first access function to provide a series of time points of exposed resources, wherein records of exposed resources may include the series of time points of exposed resources. The step of detecting hidden resources may include the following steps: comparing the series of time points of exposed resources to identify potential hidden resources, including previously exposed resources that are subsequently hidden from the list of time points of exposed resources.

[0009] In some embodiments, the step of detecting a hidden resource may include the following steps: determining whether a potentially hidden resource is hidden by issuing a second access request to the potentially hidden resource, the second access request including a second access function, and determining that the potentially hidden resource is hidden in response to a potentially hidden resource accessible using the second access function. The method further includes the step of selectively disabling access, which includes disabling application access to a client device, a server, or both when it is determined that the potentially hidden resource is hidden.

[0010] In some embodiments, the second access function may include program code at a different level than the first access function. In some embodiments, the second access function may include program code functions at a lower level than the first access function. In some embodiments, the first access function may be a high-level language file access function, including one of Java, FORTRAN, Objective-C, Swift, Pascal, or other access functions, and the second access function may be a low-level access function, including one of machine code, assembly code, or operating system code. Implementations of the technology may include hardware, methods, or processes, or computer software on a computer-accessible medium.

[0011] According to another aspect, a tamper detection server includes a processor and a non-transitory storage device coupled to the processor, which includes program code. During operation of the tamper detection server, executed by the processor, the program code can be operated to determine that the privilege level of a protected resource of a client device executing an application communicating with a service provider has been modified. For the client device, the program code can maintain a record of exposed resources, each exposed resource corresponding to a protected resource with a modified privilege level, and monitor the record of exposed resources to detect hidden resources corresponding to previously exposed resources, which are subsequently hidden from the record of exposed resources. The program code can also be operated to determine whether the hidden resource is associated with malicious activity and, if it is determined that the hidden resource is associated with malicious activity, selectively disable the application.

[0012] In some embodiments, the protected resource may include application files of the operating system of the client device executing the application. The tamper detection server can determine that the privilege level of the protected resource has been modified using first access function program code.

[0013] In some embodiments, program code that monitors records of exposed resources to detect hidden resources may include program code configured to perform the following steps: periodically executing first access function program code to generate a series of time-point access results; and detecting changes in the series of time-point access results. The program code may further detect potentially hidden resources that were previously included in the series of time-point access results and subsequently hidden from the records of exposed resources. The program code may be configured to perform the following step: using second access function program code to determine whether a potentially hidden resource is hidden, the second access function program code including program code at a different level than the first access function program code. In some embodiments, the first access function may be a high-level language file access function, including one of Java, FORTRAN, Objective-C, Swift, Pascal, or other access functions, and the second access function may be a low-level access function, including one of machine code, assembly code, or operating system code.

[0014] According to another aspect, a method for detecting malicious activity on a client device executing an application by a server includes the following steps: in response to successful access to a protected resource in a protected resource set of the client device using a high-level programming language access function, determining that the privilege level of the protected resource has been modified. The method further includes the steps of: maintaining a list of protected resources with modified privilege levels as an exposed resource record, and monitoring the exposed resource record over time to detect potentially hidden resources, including modified privilege level protected resources hidden from the exposed resource record. The method also includes the steps of: in response to successful access to a potentially hidden resource using a low-level programming language access function, determining that the potentially hidden resource is a hidden resource associated with malicious activity, and selectively disabling the application's access to the server when the hidden resource is detected.

[0015] In various embodiments, the protected resources may be related to the client device's operating system, and the step of determining that the privilege level of the protected resources has been modified can indicate that the client device is a jailbroken device. Determining that potentially hidden resources are hidden can indicate that the client device is a hooked client device.

[0016] In some embodiments, the step of monitoring exposed resource records over time to detect potentially hidden resources may include the following steps: periodically accessing a set of protected resources using high-level programming language access functions to identify accessible protected resources, storing multiple time-point lists of accessible protected resources, and comparing the multiple time-point lists of accessible protected resources to identify changes, including identifying omissions of previously accessible protected resources from subsequently generated time-point lists, including potentially hidden resources.

[0017] This arrangement enables service providers to quickly identify and isolate malicious jailbroken devices, thereby improving security. Attached Figure Description

[0018] Figure 1 This is a block diagram of one embodiment of a service provider network that includes client devices configured with tamper detection services as disclosed herein;

[0019] Figure 2 This is a block diagram of an embodiment of a service provider network configured with servers as disclosed herein for tamper detection services;

[0020] Figure 3A and 3B This is a data flow diagram illustrating one embodiment of the communication flow of a tamper detection service as disclosed herein;

[0021] Figure 4 The exemplary jailbreak logs disclosed in this article are shown in a timeline representation.

[0022] Figure 5 This is a data flow diagram illustrating one embodiment of the communication flow of a tamper detection service as disclosed herein;

[0023] Figure 6 This is a flowchart of one embodiment of the tamper detection process disclosed in this article;

[0024] Figure 7 This is a flowchart of another embodiment of the tamper detection process disclosed in this article; and

[0025] Figure 8 This is a block diagram illustrating exemplary components that can be used to support the tamper detection functions disclosed herein in a client device and / or application server. Detailed Implementation

[0026] A system and method for early detection of compromised client devices, including a tamper detection service configured to monitor changes in the jailbreak state of the client device over time to detect efforts by malware to hide the jailbreak state of the client device for malicious purposes.

[0027] In one embodiment, the tamper detection service stores jailbreak records for at least one client device. These records include a list of time points showing the jailbreak status of a protected set of resources on the client device. This protected set of resources includes, but is not limited to, system files, directories, libraries, variables, databases, functions, applications, services, or other resources, or resources with restricted access. Therefore, the jailbreak records provide information about which resources in the protected system resource set have been exposed or jailbroken through unauthorized modification of access privileges for the protected resources.

[0028] Depending on the specifics, tamper detection services monitor changes in the jailbreak status of protected resources over time to expose attempts by malicious actors to conceal this status. For example, a tamper detection service can monitor a range of lists of jailbreak states to detect changes in resource accessibility. Specifically, it can monitor a series of lists to identify when jailbroken files revert to a non-jailbroken state, indicating unusual activity on compromised client devices.

[0029] Therefore, tamper detection services can include methods for verifying the jailbreak status of client devices, such as determining whether multiple access functions return the same or different results by launching multiple different access functions, each targeting the same protected resource. Different results returned by multiple access functions indicate that at least one access function may have been hooked, and the client device may be compromised. Thus, tamper detection services provide an effective method for quickly distinguishing between voluntary and malicious jailbreaks, enabling rapid and accurate isolation of compromised client devices.

[0030] These and other features will now be described with reference to the accompanying drawings, wherein the same reference numerals are consistently used to refer to the same elements. Referring generally to the symbols and terminology used herein, the following detailed description can be presented according to program procedures executed on a computer or computer network. Those skilled in the art use these procedures to describe and represent in order to most effectively convey the substance of their work to others skilled in the art.

[0031] Here, a process is generally considered to be a self-consistent sequence of operations that leads to a desired result. These operations require physical manipulation of physical quantities. Typically, though not always, these quantities are in the form of electrical, magnetic, or optical signals that can be stored, transmitted, combined, compared, and otherwise manipulated. It has proven convenient to sometimes refer to these signals as bits, values, elements, symbols, characters, terms, numbers, etc., primarily for reasons of common usage. However, it should be noted that all of these and similar terms are associated with appropriate physical quantities and are merely convenient labels applicable to those quantities.

[0032] Furthermore, the operations performed typically refer to terms such as addition or comparison, which are generally associated with mental operations performed by a human operator. In any of the operations described herein that form part of one or more embodiments, such ability of a human operator is not required, or in most cases preferred. Instead, these operations are machine operations. Useful machines for performing the operations of the various embodiments include general-purpose digital computers or similar devices.

[0033] Various embodiments also relate to apparatus or systems for performing these operations. The apparatus may be specifically constructed for the desired purpose, or may comprise a general-purpose computer selectively activated or reconfigured by a computer program stored in a computer. The processes presented herein are inherently independent of a particular computer or other apparatus. Various general-purpose machines may be used with programs written in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to perform the desired method steps. The required structures for various machines will be shown in the given description.

[0034] Referring now to the accompanying drawings, in which the same reference numerals are used throughout to refer to the same elements. In the following description, numerous specific details are set forth for purposes of explanation, to provide a thorough understanding thereof. However, it will be apparent, however, that novel embodiments may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form for ease of description. It is intended to cover all modifications, equivalents, and substitutions consistent with the claimed subject matter.

[0035] Figure 1 An embodiment of a system 100 is illustrated, comprising a client device 110 coupled to a service provider 120 via network 115 and a third-party device 180. The client device 110 may include a network-enabled computer that communicates with the service provider 120 via networks 115 and 125 to access service provider content and services. The third-party device 180 may download a vulnerability package 175 to the client device 110, wherein the vulnerability package 175 includes a toolkit configured to exploit vulnerabilities in system 100 to spread malware. As described in more detail below, the tamper detection service disclosed herein detects vulnerability packages, thereby enabling rapid isolation of malware from service provider 120 and improving overall system security.

[0036] As described herein, network-enabled computers such as client device 110 may include, but are not limited to, computer devices, or communication devices including, such as servers, network devices, personal computers (PCs), workstations, mobile devices, telephones, handheld PCs, personal digital assistants (PDAs), thin client devices, fat client devices, internet browsers, or other devices.

[0037] Therefore, client device 110 may include processor 101 and memory 102, and it is understood that the processing circuitry may include additional components that perform the functions described herein, including processors, memory, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and tamper-proof hardware. Client device 110 may also include display and input devices. The display may be any type of device for presenting visual information, such as computer monitors, flat panel displays, and mobile device screens, including liquid crystal displays, light-emitting diode displays, plasma panels, and cathode ray tube displays. Input devices may include any device available and supported by the user equipment for inputting information into the user equipment, such as touchscreens, keyboards, mice, cursor control devices, microphones, digital cameras, video recorders, or camcorders. These devices can be used to input information and interact with the software and other devices described herein.

[0038] In some embodiments, the client device 110 may also be a mobile device, such as a device from [unclear - likely a mobile device]. This applies to iPhones, iPods, and iPads running Apple's iOS operating system. Generally, the discussion in this specification focuses on jailbreak detection based on the Apple iOS operating system. However, it should be understood that the principles disclosed herein for monitoring changes in resource access privileges and using different access functions to verify resource accessibility can be modified to work on devices running different operating system software, such as those running Microsoft's... Any device running the Mobile operating system, and / or any other smartphone or similar wearable mobile device, can achieve similar beneficial results.

[0039] Client device 110 can operate using operating system code 108, libraries 109, and other data 111. In some embodiments, the client may include a thin client application specifically adapted to communicate with service provider 120. The thin client application may be stored in the memory of the client device and, when executed by the client device, can be operated to control the interface between the client device and the service provider application, thereby allowing users at the client device to access service provider content and services. The thin client application may include various functions configured for communicating with service provider 120.

[0040] The working directory 106 (which may also be referred to herein as the “sandbox”) may be associated with each application executed by the client device 110. In general, the working directory 106 defines the access privileges granted to a particular application and is therefore a protection mechanism that allows access only to those resources of the operating system / device required to run that application (i.e., code 108, libraries 109, and other data files 111).

[0041] By restricting access to sensitive resources on an application-by-application basis, Working Directory 106 provides a last line of defense against theft, corruption, or deletion of user data or system hardware hijacking should an attacker successfully exploit a security vulnerability in an application running on a client device. Access to any resource not explicitly requested in the application's project definition and available in the Working Directory is denied by the system at runtime.

[0042] Jailbreaking involves circumventing these protections to enable the integration of third-party functions with existing licensed applications. Some jailbreaks are performed voluntarily by the owner of client device 110, for example, enabling the owner to download publicly available functions, libraries, features, etc., to enhance existing application functions. Some jailbreaks are malicious, such as those described above, when a third party 180 downloads exploit package 175 to client device 110. For example, the exploit package may include malware configured to integrate with and infect applications running on client device 110 to gain access to information and / or functions provided by client device 110 and / or service provider 120. Typically, exploit package 175 may attempt to impose itself on client applications, for example, gaining access to the application and bypassing application flows to enter modified, infected application functions.

[0043] To manipulate the client application in this manner, vulnerability package 175 circumvents client device protections designed to limit interference with the application using jailbreaking code (e.g., code with functions similar to Cydia's Impactor) and downloads vulnerability package 175 to the client device's storage 102. The vulnerability package may also include program code configured to counter the service provider's jailbreak detection mechanism, including but not limited to implementing hook code to bypass system resource access requests and returning a forged access status to hide the jailbreak status of protected files from the jailbreak detection mechanism.

[0044] The tamper detection functions disclosed in the various embodiments herein can be used to protect system 100 by detecting malware jailbreak detection countermeasures, thereby enabling rapid isolation of infected client devices 110.

[0045] In some embodiments, tamper detection program code can monitor working directory 106 for changes in access privileges. Monitoring working directory 106 may include requesting access to a predetermined set of protected resources. The predetermined set of protected resources may include, but is not limited to, system files, directories, libraries, variables, databases, functions, applications, services, or other resources or combinations thereof with restricted access.

[0046] The tamper detection program code 107 can periodically save a list of access results for a predetermined set of protected resources as one or more time-point jailbreak records 103 on the device, where the access results indicate whether unauthorized access to the protected resources was successful. The tamper detection program code 107 can further monitor a series of jailbreak records 103 to identify patterns of change in the jailbreak state that suggest a compromised client device. The tamper detection program code 107 can verify the jailbreak state, for example, by performing multiple different read operations to determine whether access to protected resources is permissible. These and other functions of the tamper detection program code are described in more detail with reference to Figures 3-7.

[0047] In some examples, network 115 can be one or more of a wireless network, a wired network, or any combination of wireless and wired networks, and can be configured to connect client device 110 to service provider 120. For example, network 115 may include one or more of the following: fiber optic network, passive optical network, cable network, Internet network, satellite network, wireless local area network (WLAN), Global System for Mobile Communications (GSMO), personal communication service, personal area network, wireless application protocol, multimedia messaging service, enhanced messaging service, short message service, time division multiple access based system, code division multiple access based system, D-AMPS, Wi-Fi, fixed wireless data, IEEE 802.11b, 802.15.1, 802.11n and 802.11g, Bluetooth, NFC, radio frequency identification (RFID), Wi-Fi, etc.

[0048] Furthermore, network 115 may include, but is not limited to, telephone lines, fiber optic cables, IEEE Ethernet 902.3, wide area networks (“WAN”), wireless personal area networks (“WPAN”), local area networks (“LAN”), or global networks such as the Internet. Additionally, network 115 may support Internet networks, wireless communication networks, cellular networks, etc., or any combination thereof. Network 115 may also include one network or any number of the aforementioned exemplary network types operating independently or collaboratively with each other. Network 115 may utilize one or more protocols coupled to one or more network elements in its communication manner. Network 115 may be converted to or converted from other protocols to one or more protocols of network devices.

[0049] It should be understood that, depending on one or more examples, network 115 may be part of multiple interconnected networks, such as, for example, the Internet, a service provider's private network 125, a cable television network, a corporate network (such as a credit card association network), and a home network. Furthermore, private network 125 may be implemented as a virtual private network layered on network 115.

[0050] In one embodiment, service provider 120 is an enterprise that provides computer-based services to clients via network 115. The combination of software and hardware that provides service provider-specific services to clients is referred to herein as a "server," which can communicate via the service provider's private network 125, typically referred to as a corporate or enterprise network. As described above regarding network 115, private network 125 can include wireless networks, wired networks, or any combination of wireless and wired networks.

[0051] Software services can be embodied in applications running on electronic devices, such as desktop applications running on the operating system of a computing device, mobile applications running on the mobile operating system of a mobile device, or web applications running on browser components of a mobile or desktop operating system. Those skilled in the art will understand how to design, build, and deploy software applications on any type of electronic device. In some embodiments, the application may be a browser application running on the device's operating system.

[0052] exist Figure 1 In the system, service provider 120 is shown as including application server 150. Although only one application server 150 is shown, it should be understood that service provider 120 may provide numerous application services to clients and may include numerous application servers. Although application server 150 is shown as a discrete device, it is understood that applications and servers may be distributed throughout the enterprise, or, in the case of distributed resources such as “cloud” resources, may be distributed as physical or virtual servers throughout network 115. Application provider 150 may support one or more application services provided by service provider 120, such as account management services.

[0053] Database 130 includes data storage resources that can be used to store customer accounts, credentials, and other authentication information, as well as other data for use by application servers. Database 130 may consist of coupled data resources, including any combination of local storage, distributed data center storage, or cloud-based storage, wherein the data resources include non-transitory tangible storage media excluding carrier waves or transmission of data signals.

[0054] Figure 2This is a diagram of a computer system 200 that includes multiple client devices 210, 230 coupled to a service provider 220 via network 215. Figure 1 On the contrary, Figure 2 In this embodiment, tamper detection is performed by service provider 220, although it is understood that various elements of the tamper detection process may be implemented by one or more client devices 210, 230, service provider 220, or both in cooperation.

[0055] exist Figure 2 In this embodiment, client device 210 includes a processor 201 and a memory 202 configured to store a working directory 206 that provides applications executing on client device 210 with access to a portion of a source code tree 208. Client device 210 is shown to be infected by a vulnerability package 275 stored in memory 202. For example, vulnerability package 275 may include a combination of jailbreak code and malware configured to interfere with and impose client / server communication supporting applications executing on client device 210.

[0056] Client device 230 includes a processor 231 and memory 232, configured to store a working directory 236 that provides applications running on client device 230 with access to a portion of source code tree 238. Working directories 206 and 236 can vary depending on the type, operation, and privilege level of the applications they support. Client device 230 is shown to include jailbreak code 276 and third-party applications 278. It is understood that clients may often seek to install unauthorized third-party applications on their client devices. Since device manufacturers discourage this practice, device owners may seek voluntary circumvention by downloading jailbreak code 276. The Impactor code, provided by Cydia, is a program that can be used for jailbreak code delivery.

[0057] Therefore, merely examining the jailbreak status of client device resources is insufficient to fully describe their compromised state. Typically, malware may attempt to conceal the jailbreak status of a client device, for example, by intercepting jailbreak detection mechanisms during a process known as "hooking." As described in more detail below, the tamper detection service disclosed herein can distinguish between voluntary jailbreaks and malicious jailbreaks (such as at client device 210) by effectively identifying hooking behavior and isolating hooked devices.

[0058] In one embodiment, service provider 220 includes an enterprise network 225 that couples the resources of service provider 220 to network 215. These resources include an application server 280 and a tamper detection server 250 configured to support one or more application services of client devices 210, 230.

[0059] According to one embodiment, the tamper detection server 250 of service provider 220 can populate and manage client jailbreak profiles 222 stored in data storage 202, as described with respect to Figures 3-7. In one embodiment, for each coupled client device, the client jailbreak profile includes one or more jailbreak records. Each jailbreak record may include a list of jailbreak states, each entry in the list being associated with the jailbreak state of a protected resource of the client device at a given point in time. In one embodiment, a jailbreak state of TRUE indicates successful access to a protected resource, indicating that the resource has been exposed, for example, jailbroken. A jailbreak state of FALSE indicates that access to a protected resource was unsuccessful.

[0060] Figure 3A and 3B The illustration shows a representative sequential access to the sandbox 320 of a client device by a tamper detection application 310, for example, using access requests from high-level languages ​​(HLLs) such as Objective-C and Swift. Figure 3A and 3B The image shows an Objective-C example access request for a "FileManager fileExistsAtPath:" request to the protected root directory " / var / tmp". In the exemplary file inspection, for the request... Figure 3A The response `FileManagerfileExistsAtPath: / var / tmp` returning TRUE indicates that the restricted directory is accessible and the client device has been jailbroken. Once the service provider identifies a jailbroken device, the application may restrict access to system resources while determining whether the client device is compromised.

[0061] As mentioned earlier, hackers familiar with such jailbreak detection mechanisms could potentially hook the FileManagerfileExistsAtPath request: " / var / tmp". Figure 3B The image shows malware 330 intercepting root directory reads and returning a FALSE response, effectively hiding the jailbreak status of " / var / tmp" from the server. According to one aspect, this allows for monitoring the jailbreak status of protected resources over time, which can be used to identify malware activity on compromised client devices.

[0062] Figure 4Jailbreak records 410, 420, and 430 at four consecutive time points on the client device are shown. In one embodiment, jailbreak records can be generated during tamper detection by recording the accessibility results of a set of protected resources, each of which was accessed during a jailbreak check on the client device. Jailbreak checks can be performed periodically, for example, including but not limited to each application access, or at various triggering events, such as each access to a function or data source, or according to other criteria.

[0063] During each jailbreak check, the tamper detection service can use high-level language (HLL) access functions to access the protected set of resources to monitor and log changes in their accessibility. A high-level language (HLL) is a programming language, such as Java, FORTRAN, Objective-C, Swift, Pascal, etc., that enables programmers to write programs that are more or less independent of a particular type of computer. These languages ​​are considered high-level languages ​​because they are closer to human language and further removed from machine language. In contrast, assembly languages ​​are considered low-level because they are very close to machine language.

[0064] Changes in accessibility to protected resources over time can indicate that a client device has been compromised. In one embodiment, a lower-level language access function can be used to verify changes in accessibility over time to ensure that malware or other malicious software is not concealing changes in the accessibility status of protected resources, thereby masking the compromised state of the client device.

[0065] For example, in Figure 4 In the diagram, the Swift high-level access function "FileManager.fileExists(atPath…)" is shown for initial jailbreak detection purposes. As an example only, jailbreak record 410 stores the results of access requests to a set of protected resources, including the root directory " / var / tmp", the operating system root directory " / ", and the initialization file " / init". At time T0, the jailbreak access request returns FALSE results in entries 412 and 414 of record 410 in response to attempts to access " / var / tmp", " / ", and " / init". At time T1, the jailbreak access request returns TRUE results in entries 422 and 424 of record 420. At time T2, the jailbreak access request again returns FALSE results in entries 432 and 434 of record 430.

[0066] According to one aspect, the tamper detection process monitors such temporal changes in the jailbreak state of a set of protected resources to detect potentially hidden jailbreak resources, including protected resources that were known to be exposed but are no longer identified as exposed. Since malware may attempt to hide the true jailbreak state of resources, the tamper detection service disclosed herein can initiate multiple reads on identified potentially hidden jailbreak resources to determine whether the potentially hidden resource is truly no longer jailbroken, or whether malware is hiding the jailbreak state of the resource. In some embodiments, multiple reads can use different types of access functions, such as variations in type, form, language, complexity, etc., to determine whether different access results are returned, indicating that the service provider's access request has been hooked.

[0067] For example, now refer to Figure 5 Because hooking into a client device involves the identification and interception of jailbreak checking mechanisms, in some embodiments, different access functions can be used for secondary or additional attempts to access potentially hidden resources. These access functions may be identified by malware or communicate using different software layers. In some embodiments, secondary access can occur simultaneously with or sequentially with the initial jailbreak check. In some embodiments, the different access functions can be different access functions available at different levels of program code, such as high-level functions and low-level functions. Examples of low-level functions can include, for example, computational languages ​​more closely related to computer instruction sets, such as machine code, assembly code, operating system code, DOS commands, and other system-level commands. In other embodiments, the different access functions can be different high-level language access functions. In some embodiments, the different access functions can include a combination of high-level and low-level language access functions.

[0068] exist Figure 5 In the example, client sandbox 520 returns "FALSE" in response to the tamper detection application 510's FileManager:fileExists(atPath(" / var / tmp") access request. (See also: Regarding...) Figure 3B As described, when " / var / tmp" is actually jailbroken and truly exposed, but the malware attempts to hide the jailbreak status from the service provider, it may incorrectly provide such a FALSE response after the malware's FileManager:fileExists(atPath(" / var / tmp")) request is hooked.

[0069] This may be followed (or simultaneously) by lower-level access requests, such as an openDir(" / var / tmp") request, to verify the jailbreak status of the files. Figure 5In this case, a return value of TRUE indicates that " / var / tmp" is truly exposed and that malware hiding the jailbreak status of " / var / tmp" is being executed on the client device. Mismatches between the read results of different access functions can be used to quickly expose compromised clients.

[0070] Figure 6 This is a flowchart illustrating exemplary steps of a tamper detection process 600 for detecting compromised client devices, wherein the client device executes an application that includes one or more protected resources. At step 610, the tamper detection service monitors the client device's execution of the application, wherein the client device includes a set of protected resources that are normally inaccessible to the application. At step 620, the process monitors the set of protected resources to identify exposed resources, including protected resources with modified privilege levels to make them accessible to the application. At step 630, the tamper detection process maintains a record of the exposed resources. In some embodiments, the process may maintain only a list of files that have been jailbroken. In other embodiments, the process may save the state of access requests for each file in the set of protected resources (e.g., ...). Figure 4 (as described in TRUE or FALSE). Alternative methods for tracking the identifier of the exposed resource are considered within the scope of this exposure.

[0071] At step 640, the process detects hidden resources that can be used by the application but are hidden from the record of exposed resources. At step 650, in response to the detection of hidden resources, the tamper detection can selectively disable the application to isolate the compromised client device from the service provider's system.

[0072] For example, malicious activity can be inferred when an accessibility pattern indicates unauthorized manipulation of access privileges to a protected resource. This pattern could be, for example, the disappearance of jailbreak files from the jailbreak resource log. The method could include, at step 650, selectively disabling application access to the server when it is determined that file removal is associated with malicious activity.

[0073] Figure 7An embodiment of a tamper detection process 700 that can be used to detect malicious activity on a client device is illustrated. At step 710, the process includes determining that the privilege level of a protected resource in a protected resource set of the client device has been modified in response to successful access to a protected resource using a high-level programming language access function. At step 720, the process includes maintaining a list of protected resources with modified privilege levels as exposed resource records. At step 730, the exposed resource records are monitored over time to detect potentially hidden resources, including protected resources with modified privilege levels that are hidden from the exposed resource records. At step 740, the process determines that a potentially hidden resource is a hidden resource associated with malicious activity in response to successful access to a potentially hidden resource using a lower-level programming language access function. At step 750, when a hidden resource is detected, the process selectively disables application access to the server.

[0074] As mentioned above, the tamper detection process can be implemented entirely or partially by the client device. The client device can proactively provide its jailbreak status to the service provider, or it can store jailbreak records that can be read by the service provider's application.

[0075] Therefore, the tamper detection process includes monitoring the jailbreak status of the client device to identify patterns indicating a compromised device. The tamper detection process may also include performing multiple read functions on the client device's protected resources to verify the jailbreak status, for example, to overcome issues related to device hooking. These processes can be used individually or in combination and can be used in tamper detection systems provided by the client device, the service provider, or a combination of both. Such an arrangement improves the ability to quickly identify and repair compromised clients and protect the computing environment.

[0076] Figure 8 An embodiment of an exemplary computing architecture 900 is shown that can form the basis of client devices 110, 210, 230 and / or application servers 150, 280 and tamper detection server 250. In various embodiments, the computing architecture 900 may include or be implemented as part of an electronic device that includes... Figure 7 The computing architecture 900 is configured to implement all the logic, applications, systems, methods, devices, and functions described herein, with or without the components shown.

[0077] The computing system 902 includes various common computing elements, such as one or more processors, multi-core processors, coprocessors, memory units, chipsets, controllers, peripherals, interfaces, oscillators, timing devices, video cards, sound cards, multimedia input / output (I / O) components, power supplies, etc. However, embodiments are not limited to those implemented by the computing system 902.

[0078] like Figure 8 As shown, the computing system 902 includes a processor 904, a system memory 906, and a system bus 908. The processor 904 can be any of various commercial computer processors. Dual microprocessors, multi-core processors, and other multiprocessor architectures can also be used as the processor 904.

[0079] System bus 908 provides interfaces for system components, including but not limited to system memory 906 to processor 904. Components can be controlled by interfaces; for example, disk devices can be controlled by interfaces 924, 926, and 928 according to their various protocols. Network communication can be controlled by network adapter 956. System memory 906 can include various types of computer-readable storage media in the form of one or more high-speed memory cells including non-volatile memory 910 and / or volatile memory 912. The Basic Input / Output System (BIOS) can be stored in non-volatile memory 910.

[0080] The computing system 902 may include various types of computer-readable storage media in the form of one or more low-speed memory units, including an internal (or external) hard disk drive (HDD) 914, a floppy disk drive (FDD) 916 for reading or writing to a removable disk 918, and an optical disk drive 920 for reading or writing to a removable optical disk 922 (e.g., a CD-ROM or DVD). The drives and associated computer-readable media provide volatile and / or non-volatile storage of data, data structures, computer-executable instructions, etc. For example, numerous program modules may be stored in the drives and memory units 910, 912, including an operating system 930, one or more application programs 932 (including... Figure 5 and 6 (The tamper detection program processing), other program modules 934 and program data 936.

[0081] Users can input commands and information into the computing system 902 through one or more wired / wireless input devices (e.g., keyboard 938 and pointing devices such as mouse 940). Other input devices may include microphones, infrared (IR) remote controls, radio frequency (RF) remote controls, game pads, styluses, card readers, dongles, fingerprint readers, gloves, graphics tablets, joysticks, keyboards, retinal readers, touchscreens (e.g., capacitive, resistive, etc.), trackballs, trackpads, sensors, styluses, etc. These and other input devices are typically connected to the processor 904 via an input device interface 942 coupled to the system bus 908 but connectable via other interfaces.

[0082] Monitor 944 or other types of display devices are also connected to system bus 908 via an interface such as video adapter 946. Computing system 902 can operate in a networked environment using logical connections to one or more remote computers (such as remote computer 948 including memory / storage device 950) via wired and / or wireless communications. The described logical connections include wired / wireless connections to local area network (LAN) 952 and / or larger networks (e.g., wide area network (WAN) 954). Computing system 902 can also be operated to communicate with wired and wireless devices or entities using the IEEE 802 series of standards. One or more aspects of at least one embodiment can be implemented by representative instructions stored on a machine-readable medium representing various logic within a processor, which, when read by a machine, causes the machine to manufacture logic to perform the techniques described herein.

[0083] As used herein, the terms “system,” “component,” and “unit” mean a computer-related entity, hardware, a combination of hardware and software, software, or software in execution, examples of which are described herein. For example, a component can be, but is not limited to, a process running on a processor, a processor, a hard disk drive, multiple storage drives, non-transitory computer-readable media (optical and / or magnetic storage media), an object, an executable file, a thread of execution, a program, and / or a computer. For instance, an application running on a server and the server itself can both be components. One or more components may reside in a process and / or a thread of execution, and components may be localized on a single computer and / or distributed across two or more computers.

[0084] Furthermore, components can communicate and couple with each other to coordinate operation through various types of communication media. Coordination may involve one-way or two-way information exchange. For example, components can transmit information in the form of transmitted signals via a communication medium. This information can be implemented as signals assigned to various signal lines. In this assignment, each message is a signal. However, other embodiments may alternatively employ data messages. Such data messages can be sent through various connections. Exemplary connections include parallel interfaces, serial interfaces, and bus interfaces.

[0085] Embodiments may be described using the expressions "an embodiment" or "one embodiment" and their derivatives. These terms mean that a particular feature, structure, or characteristic described in connection with an embodiment is included in at least one embodiment. The phrase "in one embodiment" appearing in different places in the specification does not necessarily refer to the same embodiment. Furthermore, unless otherwise stated, the foregoing features are considered to be used together in any combination. Thus, any feature discussed individually may be used in combination with each other unless it is noted that these features are incompatible with each other.

[0086] Referring generally to the symbols and terminology used herein, the detailed descriptions herein may be presented in the form of functional blocks or units that can be implemented as procedural programs that execute on a computer or computer network. Those skilled in the art use these procedural descriptions and representations to most effectively convey the substance of their work to others skilled in the art.

[0087] Here, a program is generally considered to be a self-consistent sequence of operations that leads to the desired result. These operations require physical manipulation of physical quantities. Typically, though not always, these quantities are in the form of electrical, magnetic, or optical signals that can be stored, transmitted, combined, compared, and otherwise manipulated. It has proven convenient to sometimes refer to these signals as bits, values, elements, symbols, characters, terms, numbers, etc., primarily for reasons of common usage. However, it should be noted that all of these and similar terms are associated with appropriate physical quantities and are merely convenient labels applicable to those quantities.

[0088] Furthermore, the operations performed typically refer to terms such as addition or comparison, which are generally associated with mental operations performed by a human operator. In any of the operations described herein that form part of one or more embodiments, such ability of a human operator is not required, or in most cases preferred. Instead, these operations are machine operations. Useful machines for performing the operations of the various embodiments include general-purpose digital computers or similar devices.

[0089] Some embodiments may be described using the expressions “coupled” and “connected”, and their derivatives. These terms are not necessarily synonyms. For example, some embodiments may be described using the terms “connected” and / or “coupled” to indicate that two or more elements are in direct physical or electrical contact with each other. However, the term “coupled” may also mean that two or more elements are not in direct contact with each other, but still cooperate or interact with each other.

[0090] It is important to emphasize that this abstract of the disclosure is provided to allow the reader to quickly determine the essence of the technical disclosure. This statement is submitted on the premise that it is not intended to interpret or limit the scope or meaning of the claims. Furthermore, in the foregoing detailed description, various features are combined in a single embodiment to simplify the disclosure. The approach of this disclosure should not be construed as reflecting an intention that the claimed embodiment requires more features than expressly recited in each claim. Rather, as reflected in the following claims, the subject matter of the invention does not consist of all features of a single disclosed embodiment. Therefore, the following claims are incorporated herein by reference, wherein each claim exists independently as a separate embodiment. In the appended claims, the terms “comprising” and “wherein” are used as their respective concise English equivalents. Furthermore, the terms “first,” “second,” “third,” etc., are used merely as labels and are not intended to impose numerical requirements on their objects.

[0091] The above description includes examples of the disclosed architecture. It is certainly impossible to describe every conceivable combination of components and / or methods, but those skilled in the art will recognize that many further combinations and permutations are possible. Therefore, the architecture of this invention is intended to encompass all such changes, modifications, and variations falling within the spirit and scope of the appended claims.

Claims

1. A computer-implemented method for discovering application tampering, comprising: performing, by a processor of a mobile device, a first function on a set of protected resources, the first function comprising attempting to access each protected resource in the set of protected resources and generating a first function access result; performing, by the processor of the mobile device, a second function on the set of protected resources, the second function comprising attempting to access each protected resource in the set of protected resources and generating a second function access result, wherein the first function and the second function are different, wherein the second function comprises a different level of program code than the first function; wherein the second function comprises a lower level of program code function than the first function; determining, by the processor of the mobile device, a difference between the first function access result and the second function access result; and responsive to determining the difference between the first function access result and the second function access result, selectively disabling an application.

2. The computer-implemented method of claim 1, wherein, selectively disabling access comprises disabling access of the application to the mobile device, a server, or both.

3. The computer-implemented method of claim 1, wherein, the set of protected resources comprises at least one of a system file, a directory, a library, a variable, a database, a function, an application, a service, or a combination thereof.

4. The computer-implemented method of claim 1, wherein, performing the first function comprises issuing a series of access requests to the set of protected resources, the series of access requests comprising an access request to each protected resource in the set of protected resources.

5. The computer-implemented method of claim 1, wherein, performing the second function comprises issuing a series of lower level access requests to the set of protected resources, the series of lower level access requests comprising a lower level access request to each protected resource in the set of protected resources.

6. The computer-implemented method of claim 1, wherein, the first function comprises a high level language resource access function of Java, FORTRAN, Objective-C, Swift, or Pascal, and the second function comprises a low level language resource access function of machine code, assembly code, or operating system code.

7. A computing device for discovering application tampering, comprising: a memory for storing instructions; a processing circuit coupled with the memory, the processing circuit configured to execute the instructions to perform the following steps: performing a first function on a set of protected resources, the first function attempting to access each protected resource in the set of protected resources and generating a first result; performing a second function on the set of protected resources, the second function attempting to access each protected resource in the set of protected resources and generating a second result, wherein the second function comprises a different level of program code than the first function; wherein the second function comprises a lower level of program code function than the first function; detecting a difference between the first result and the second result; and responsive to determining the difference, selectively disabling access of the application to a mobile device, a server, or both.

8. The computing device of claim 7, wherein, the set of protected resources comprises at least one of a system file, a directory, a library, a variable, a database, a function, an application, a service, or a combination thereof.

9. The computing device of claim 7, wherein, the processing circuitry to execute the first function to issue a series of access requests to the set of protected resources, the series of access requests including an access request to each protected resource in the set of protected resources.

10. The computing device of claim 7, wherein, the processing circuitry to execute the second function to issue a series of lower level access requests to the set of protected resources, the series of lower level access requests including a lower level access request to each protected resource in the set of protected resources.

11. The computing device of claim 7, wherein, the first function comprising a high level language resource access function in Java, FORTRAN, Objective-C, Swift, or Pascal, and the second function comprising a low level language resource access function in machine code, assembly code, or operating system code.

12. A non-transitory computer readable medium for detecting application tampering, comprising a set of instructions that, in response to being executed on a computing system, cause the computing system to perform the following steps: performing a first function and a second function on a set of protected resources, the first function generating a first result based on attempting to access each protected resource in the set of protected resources, and the second function generating a second result based on trying to access each protected resource in the set of protected resources, wherein, the second function comprising a different level of program code than the first function; wherein the second function comprises a lower level of program code function than the first function; comparing the first result and the second result; in response to detecting a difference between the first result and the second result, selectively disabling access by the application to a mobile device, a server, or both.

13. The non-transitory computer-readable medium of claim 12, wherein, the second function comprising a different level of program code than the first function.

14. The non-transitory computer-readable medium of claim 12, wherein, the computing system to: execute the first function to issue a series of access requests to the set of protected resources, the series of access requests including an access request to each protected resource in the set of protected resources; and execute the second function to issue a series of lower level access requests to the set of protected resources, the series of lower level access requests including a lower level access request to each protected resource in the set of protected resources.

Images