Executable Process Hijack Detection via Suspended Thread Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In managed computer environments, users with limited rights can potentially embed dangerous code, such as macros or embedded scripts, to circumvent security checks and gain unauthorized access by exploiting the ability to run applications like Microsoft Excel, which allows embedded programs to make system calls, posing a security vulnerability.
Innovation Solution
A method is implemented to check the authenticity of an executable process by comparing its headers and contents with a mapped image, terminating the process if discrepancies are found, and generating an event or warning to prevent unauthorized execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users are given limited rights to perform certain actions, then security is improved, but users cannot circumvent security checks and audit features
Solution Approach 1:
The system performs preliminary actions by creating the initial thread in a suspended state before execution begins. This allows security checks to be performed on the thread's code before it runs, preventing unauthorized code execution while maintaining legitimate user access to applications.
Solution Approach 2:
The suspended thread acts as an intermediary between the user's application code and the operating system. By suspending the thread and checking its code before execution, the system mediates between user access rights and security requirements, allowing legitimate code to execute while blocking malicious code.
2Adaptability or versatility
If embedded macros or code are allowed to run, then application functionality is improved, but security vulnerability increases due to potential code hijacking
Solution Approach 1:
The system performs preliminary security checks on embedded code before execution by suspending the initial thread and verifying its code integrity. This allows applications to use embedded macros and code while preventing security vulnerabilities through pre-execution verification.
Solution Approach 2:
The system implements feedback by continuously monitoring thread execution and comparing actual thread code against the original mapped code. When discrepancies are detected indicating code hijacking, the system terminates the thread, providing feedback that prevents harmful code execution while allowing legitimate functionality.
3Reliability
If code execution is monitored and verified, then security is improved, but system complexity increases due to additional checking mechanisms
Solution Approach 1:
The system segments the verification process into distinct phases: mapping the initial thread to a suspended state, performing security checks on the thread's code, and only then allowing execution. This segmentation makes the complex security monitoring manageable by breaking it down into discrete, controllable steps.
Solution Approach 2:
The system creates a copy of the thread in a suspended state for security verification before the actual execution begins. This copying approach allows security checks to be performed on a duplicate without interfering with the original thread's execution, simplifying the verification process while maintaining security.
4Measurement precision
If threads are created in suspended state for security checks, then code authenticity is improved, but execution time increases due to additional mapping and comparison operations
Solution Approach 1:
The system performs security verification as a preliminary action before thread execution begins. By mapping the thread to a suspended state and performing authenticity checks before execution, the system ensures code authenticity while minimizing time loss by completing verification upfront rather than during execution.
Solution Approach 2:
The system rushes through the security verification process quickly by using efficient comparison methods and suspended state mapping. This allows rapid authentication of code before execution, minimizing the time penalty while maintaining high measurement precision for code authenticity.
Data Source
AI summary
Disclosed is a method of checking the authenticity of an executable process including at least one section. The method includes, when an initial thread of the executable process is created in a suspended state, mapping from storage a copy of the executable process into a spare memory area, where it will not be executed. The method also includes comparing a header of a first section of the executable process with a header of a first section of the copy. The method further includes terminating the executable process when the header of the first section of the executable process and the header of the first section of the copy are not identical.