WO2007074992A1

WO2007074992A1 - Method for detecting malicious code changes from hacking of program loaded and executed on memory through network

Info

Publication number: WO2007074992A1
Application number: PCT/KR2006/005582
Authority: WO
Inventors: Hee An Park
Original assignee: Ahn Lab, Inc.
Priority date: 2005-12-26
Filing date: 2006-12-19
Publication date: 2007-07-05
Also published as: KR100663034B1

Abstract

A method for detecting malicious code changes from hacking of a program loaded and executed on the memory through a network comprising the following steps of: creating a first data for confirming errors with regard to the program code area that a server wishes to protect; transmitting a request message created based on the first data for confirming errors to a client; creating a second data for confirming errors with regard to the code area according to the request message at the client; transmitting an answer message created based on the second data for confirming errors to the server; and comparing the first data for confirming errors with the second data for confirming errors at the server.

Description

METHOD FOR DETECTING MALICIOUS CODE CHANGES

FROM HACKING OF PROGRAM LOADED AND EXECUTED

ON MEMORY THROUGH NETWORK

Technical Field

[1] The present invention relates to a method for detecting malicious code changes from hacking of a program loaded and executed on the memory through a network.

More particularly, the present invention relates to a method for detecting malicious code changes from hacking of a program loaded and executed on the memory under the client-server model in real time. [2]

Background Art [3] A program provided at a server in general under client-server model is often executed at a client terminal in real time. At this time, a hacking is tried to hinder from fulfilling the original objective of the program in execution. [4] A hacking method is divided into a method that prohibits from executing the intended original objective of a program by creating a crack in the code of executing the program that exists in a file type, and a method that makes changes in a program that is loaded on the memory for execution. [5] Among all the above, a method of the latter gets more problematic in recent days in that this method will bring about a fatal damage that is similar to the effect of the former, and the latter is more effective in hacking in real time, thus a preventative measure is necessary. [6] Accordingly, the present invention will provide a new method for detecting malicious code changes from hacking of a program loaded and executed on the memory through a network. [7]

Disclosure of Invention

Technical Problem [8] An objective of the present invention is to provide a method for detecting malicious code changes from hacking of a program loaded and executed on the memory through a network under client-server model. [9]

Technical Solution [10] For accomplishing the above and other objectives of the present invention, a method for detecting malicious code changes from hacking of a program loaded and executed on the memory through a network according to the present invention comprises the following steps of: creating a first data for confirming errors with regard to the program code area that a server wishes to protect; transmitting a request message created based on the first data for confirming errors to a client; creating a second data for confirming errors with regard to the code area according to the request message at the client; transmitting an answer message created based on the second data for confirming errors to the server; and comparing the first data for confirming errors with the second data for confirming errors at the server.

[11] Both the first data for confirming errors and the second data for confirming errors may be created with regard to the entire area of the program to be protected or with regard to a part of the code area by extracting the starting point and ending point of at least one function constituting a program.

[12] At least one part of the code area exists, and both the first data for confirming errors and the second data for confirming errors may be created with regard to a part of each of the code area.

[13] An ending point is the area where a return code is extracted in prearranged numbers by executing a disassembling step from a starting point, a point right before the starting point of a different function after the starting point of the different function is extracted by executing a disassembling step from the starting point of the different function, and the ending point is the point away from a starting point by a prefixed length.

[14] The first data for confirming errors and the second data for confirming errors comprises an instruction constituting a function, or further comprises an operand constituting a function.

[15] A CRC (Cyclic Redundancy Check) data, a Check Sum data, or a Hash data are used as a first data for confirming errors and a second data for confirming errors.

[16] Both the request message and the answer message are encrypted and transmitted based on session key shared by a server and a client, both the request message and the answer message are decrypted based on the session key, and thereby security in data transmission is duly considered.

[17] The present invention will be apparent with reference to the detailed description and the drawing attached herein.

[18]

Brief Description of the Drawings

[19] Fig. 1 is a flowchart of a method for detecting malicious code changes from hacking of a program loaded and executed on the memory through a network under client- server model according to the present invention. [20] The present invention will be described in detail in the following with reference to the drawing attached herein. [21]

Best Mode for Carrying Out the Invention

[22] The present invention relates to a method for detecting an outside attack that changes a program code is loaded on the memory when the program code that is executed through a network under client-server model.

[23] The present invention communicates data by transmitting a request message and an answer message between a client and a server under client-server model. Further, a session key is shared for encrypting and decrypting of data in transmission for a security purpose.

[24] Whether a program code is modified or not is detected in the present invention by the following steps of: creating a first data for confirming errors at a server with regard to the executing the program code, creating a second data for confirming errors corresponding to the first data for confirming errors, and comparing the first data for confirming errors and the second data for confirming errors.

[25] The first data for confirming errors and the second data for confirming errors in accordance with the present invention are selected from the group consisting of a CRC (Cyclic Redundancy Check) data, a Check Sum data, and a Hash data that contain an instruction only or both an instruction and an operand.

[26] Fig. 1 illustrates a method for detecting malicious code changes from hacking of a program loaded and executed on the memory through a network under client-server model according to the present invention.

[27] With reference to Fig. 1, a first data for confirming errors with regard to the program code area on the memory is firstly created when the program that a server wishes to protect is loaded and executed on the memory at step 101.

[28] At this time, the first data for confirming errors may be created with regard to the entire program code to be protected or with regard to a part of the program code. When creating for parts, more than one part may be set up.

[29] In case of setting up parts of the code area, functions in a fixed number may be selected from the functions constituting the program for executing. The number of functions are determined depending on the number of the functions that constitutes the code to be protected and thereby is set up particularly according to the program to be protected. In other words, if a part of the code to be protected is comprised of ten functions, the ten functions shall be selected. Further, it may be all right to select a part of the memory address at which executing code is loaded.

[30] In respect of a method of selecting a function, an ending point of a function is determined by executing a disassembling step from starting point. At this time, ending point may be the point where a return code is extracted in a prescribed number during the process of disassembling. Further, if a starting point of a different function is detected, a point right before the starting point may be set up as an ending point of the function. As far as a method of establishing an ending point is concerned, a point which is away from the starting point of a function by a certain length may be the ending point. Not to mention, the length shall fall within the scope of the entire code area.

[31] In this manner, an instruction in charge of real calculation of a function is drawn out by executing a disassembling step from a starting point to an ending point, and a first d ata for confirming errors is created to include the instruction. At this time, the first data for confirming errors including an instruction further comprises an operand which executes a function for calculation. In case that an address may be relocated when an operand is loaded on the memory, the first data for confirming errors may be created in consideration of the address which is relocated.

[32] Likewise, when a first data for confirming errors is created, a request message corresponding to the first data for confirming errors is transmitted to a client. At this time, when creating a request message at the server, the content of the request message is that a second data for confirming errors shall have a random order based on the first data for confirming errors. The request message is preferably transmitted in an encrypted form based on a session key in consideration of security during data communication.

[33] At step 103, a client creates a second data for confirming errors corresponding to the first data for confirming errors according to the request message. At this time, if the request message is encrypted, the encrypted request message is decrypted based on the session key. The second data for confirming errors creates a second data for confirming errors including an instruction that is detected at applicable area while executing the disassembling step requested by the server from starting point of the memory address to ending point. At this time, if there is a request message, a second data for confirming errors is created including not only an instruction but also an operand.

[34] With respect to a list of the memory address included in the request message, a second data for confirming errors with respect to each address is created, and the second data for confirming errors can be created by arranging in a random order according to the request of a request message.

[35] The client creates an answer message at step 104, based on the second data for confirming errors created in that manner, and transmits the answer message to the server. At this time, an answer message may be encrypted and transmitted in the same manner as in a request message.

[36] At the following step 105 after the server receives the answer message, the first data for confirming errors and the second data for confirming errors are compared, and thereafter it is determined whether both are identical or not. At this time, if an answer message is found out to be encrypted, the answer message is decrypted and thereafter the original second data for confirming error is restored.

[37] As a result of the comparison, if the first data for confirming errors and the second data for confirming errors are identical, a program may run continuously as in step 106, and thereafter whether a code on the memory is changed or not is periodically or randomly inspected from step 101 regarding the code area to be protected if there is a need for that.

[38] If the first data for confirming errors is different from the second data for confirming errors, an alert procedure is executed in the way that a warning message is transmitted to the client terminal or a connection with the server is lost at step 107, based on the detection of malicious code changes by an attack from outside.

[39] Simple changes and modifications of the present invention can be easily carried out by those who are ordinarily skilled in the art, and the changes and modifications are deemed to be with the scope of the present invention.

Claims

[1] A method for detecting malicious code changes from hacking of a program loaded and executed on the memory through a network comprising the steps of: creating a first data for confirming errors with regard to a program code area that a server wishes to protect; transmitting a request message created based on the first data for confirming errors to a client; creating a second data for confirming errors with regard to the code area according to the request message at the client; transmitting an answer message created based on the second data for confirming errors to the server; and comparing the first data for confirming errors with the second data for confirming errors at the server. [2] The method as defined in Claim 1, wherein both said first data for confirming errors and said second data for confirming errors are created with regard to the entire code area of the program to be protected. [3] The method as defined in Claim 1, wherein said first data for confirming errors and said second data for confirming errors are created with regard to the part of the code area by extracting a starting point and an ending point of at least one function constituting the program. [4] The method as defined in Claim 1, wherein at least one of said part of the code area exists, and wherein both said first data for confirming errors and said second data for confirming errors are created with regard to parts of each of the code area. [5] The method for as defined in Claim 3 or 4, wherein said ending point is the point where a return code is extracted in fixed numbers by executing disassembling from a starting point. [6] The method as defined in Claim 3 or 4, wherein said ending point is right before the starting point of a different function when the starting point of the different function is extracted by executing disassembling from the starting point. [7] The method as defined in Claim 3 or 4, wherein said ending point is the point away from the starting point by a prearranged length. [8] The method as defined in Claim 3 or 4, wherein said first data for confirming errors and said second data for confirming errors comprises an instruction constituting the function. [9] The method as defined in Claim 8, wherein said first data for confirming errors and said second data for confirming errors further comprise an operand con- stituting the function. [10] The method as defined in Claim 1, wherein said first data for confirming errors and said second data for confirming errors are a CRC (Cyclic Redundancy

Check) data. [11] The method as defined in Claim 1, wherein said first data for confirming errors and said second data from confirming errors are a Check Sum data. [12] The method as defined in Claim 1, wherein said first data for confirming errors and said second data for confirming errors are a Hash data. [13] The method as defined in Claim 1, wherein said request message is encrypted and transmitted based on the session key shared by the server and the client. [14] The method as defined in Claim 13, further comprising a step of decrypting the request message in an encrypted form at the client where the request message in an encrypted form is received. [15] The method as defined in Claim 14, wherein said answer message is encrypted and transmitted based on the session key shared by the server and the client. [16] The method defined in Claim 15, further comprising a step of decrypting said answer message in an encrypted form at the server where said answer message in an encrypted form is received.