Abstract:
A configuration information manager monitors attempts by processes to update non-structured storage of system configuration information, such as plain text files which contain system configuration information. When such an attempt is made, the configuration information manager makes a copy of the target file, and redirects the write operation to this copy. The configuration information manager then analyzes the process that did the writing, as well as the content that was written. If the process and/or the content is deemed to be suspicious, the changes will be logged and discarded, thus protecting the system. Should the changes be deemed legitimate, then the configuration information manager folds them into the real file, typically in an annotated manner, so as enable subsequent reversion of the changes as desired.

Description:
TECHNICAL FIELD 
     This invention pertains generally to computer security, and more specifically to providing protection for non-structured storage of system configuration information, without preventing legitimate access. 
     BACKGROUND 
     Generally, computer operating system configuration information is stored in a structured manner, such that access thereto is controlled at a system level. However, in some systems, certain system configuration information is stored in an unstructured manner, such as a plain text file without access regulations. In Microsoft Windows®, the HOSTS file is one such example. The Windows HOSTS file allows for Domain Name Service (“DNS”) override of domains to Internet Protocol (“IP”) addresses. It is a plain text file, with each record appearing on a single line. Each record consists of an IP address in the form of xxx.xxx.xxx.xxx, followed by a textual domain name. Any attempt by an application to access the domain will be redirected to the corresponding IP address. 
     The Windows HOSTS file is a frequent target of attack for malicious code. This file is commonly abused by malicious code to deny security software access to its Internet locations, as well as by phishing schemes. This file is shared amongst all users and applications on the system, and there are many legitimate reasons to make changes to it. These facts, coupled with its “plain text” format, make protecting the HOSTS file very difficult. What is needed are methods, systems and computer readable media for providing protection for non-structured storage of system configuration information, without preventing legitimate access. 
     SUMMARY OF INVENTION 
     Computer-implemented methods, computer systems and computer-readable media monitor attempts by processes to update non-structured storage of system configuration information, such as plain text files which contain system configuration information. When such an attempt is made, a configuration information manager makes a copy of the target file, and redirects the write operation to this copy. The configuration information manager then analyzes the process that did the writing, as well as the content that was written. If the process and/or the content is deemed to be suspicious, the changes will be logged and discarded, thus protecting the system. Should the changes be deemed legitimate, then the configuration information manager folds them into the real file, typically in an annotated manner, noting information such as the time and day of the change, and the user and application responsible for it. This way, should an application later be determined to be malicious, or should a user or system administrator wish to undo the changes, the changes can be removed in a structured fashion. 
     The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art in view of the drawing, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram illustrating a high level overview of the general operation of a configuration information manager, according to some embodiments of the present invention. 
         FIG. 2  is a block diagram illustrating a configuration information manager processing attempted changes to a configuration file, according to some embodiments of the present invention. 
     
    
    
     The Figures depicts embodiments of the present invention for purposes of illustration only. One skilled in the art will readily recognize from the following discussion that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles of the invention described herein. 
     DETAILED DESCRIPTION 
       FIG. 1  illustrates a configuration information manager  101  protecting non-structured storage of system configuration information  103 , according to some embodiments of the present invention. It is to be understood that although the configuration information manager  101  is illustrated as a single entity, as the term is used herein a configuration information manager  101  refers to a collection of functionalities which can be implemented as software, hardware, firmware or any combination of these. Where a configuration information manager  101  is implemented as software, it can be implemented as a standalone program, but can also be implemented in other ways, for example as part of a larger program, as a plurality of separate programs, as a kernel loadable module, as one or more device drivers or as one or more statically or dynamically linked libraries. 
     As illustrated in  FIG. 1 , the configuration information manager  101  protects non-structured storage of system configuration information  103 , such as plain text files  105  that contain system configuration information  103 . The configuration information manager  101  detects attempts by processes  107  to write to such files  105 . Computer programming techniques for detecting attempts to write to specific files  105  and for controlling the subsequent processing are known to those of ordinary skill in the relevant art, and the implementation mechanics for applying such techniques within the context of the present invention will be readily apparent to those of ordinary skill in the relevant art in light of this specification. For example, in one embodiment system calls for write operations are intercepted, and if an intercepted call targets a file  105  of interest, a wrapper executes the desired functionality to manage the access. In other embodiments, the detection and management of attempts to write to files  105  of interest are handled by a file system filter driver. Other specific instantiations of the functionality described herein are also possible, and within the scope of the present invention. 
     It is to be understood that the specific file  105  or files  105  to monitor is a design choice, which can vary from embodiment to embodiment. For example, in some embodiments of the present invention, the configuration information manager  101  detects and manages attempts by processes  107  to write to some or all plain text files  105  that contain system configuration information  103 . In other embodiments, the monitored files  105  are more narrowly defined, for example one or more files  105  that associate network addresses with domain names, such as the Windows HOSTS file  105 . The present invention is not limited to any specific file  105 , storage format or operating system. 
     When the configuration information manager  101  detects an attempt by a process  107  to write to a protected file  105 , the configuration information manager  101  redirects the write operation to a copy  109  of the file  105 . In different embodiments, the configuration information manager  101  can make an actual copy  109  of the file  105 , or provide a default copy  109  as desired. The default copy  109  can comprise nothing more than a default file to which to direct the write operation. Providing the latter can make the subsequent analysis of the written content  111  easier. Regardless, the configuration information manager  101  analyzes the content  111  that was written to the copy  109  of the file  105 , and the process  107  that performed the writing, in order to determine whether the update attempted by the process  107  is legitimate. 
     Analyzing the process  107  that wrote to the copy  109  can comprise operations such as checking whether the process  107  is on a list of known suspicious processes  107 , scanning the process  107  for malicious code signatures, scanning the process  107  for suspicious heuristics and observing actions performed by the process  107  to check for suspicious activity. Other examples of process  107  analysis will be readily apparent to those of ordinary skill in the relevant art in light of this specification, and are within the scope of the present invention. 
     Analyzing the content  111  that was written by the process  107  can comprise operations such as determining whether the content  111  contains malicious code (e.g., by scanning the content  111  for relevant heuristics or signatures) or determining whether the content contains a network address that is known to be suspicious. Other examples of content  111  analysis will be readily apparent to those of ordinary skill in the relevant art in light of this specification, and are within the scope of the present invention. 
     The configuration information manager  101  determines whether to incorporate the content  111  that was written to the copy  109  into the file  105  based on the results of analyzing the written content  111  and the process  107  that did the writing. For example, the configuration information manager  101  can determine not to incorporate the content  111  into the file  105  responsive to determining that the process  107  is sufficiently suspicious, that the content  111  is sufficiently suspicious, and/or that a combination of the process  107  and the content  111  is sufficiently suspicious. On the other hand, the configuration information manager  101  can determine to incorporate the content  111  into the file  105  responsive to determining that neither the process  107  nor the content  111  are sufficiently suspicious. 
     In other words, if the configuration information manager  101  determines that under the totality of the circumstances the update to the system configuration information  103  appears legitimate, it allows the update to proceed. On the other hand, if the update appears to be malicious, the configuration information manager  101  blocks the update. It is to be understood that the threshold level that comprises “sufficiently suspicious” is a variable design parameter that can be adjusted up and down as a function of the desired balance between robustness of protection and ease of update access. 
     As illustrated in  FIG. 2 , where the configuration information manager  101  determines not to incorporate the content  111  into the file  105 , the configuration information manager  101  can simply discard the copy  109 , thereby preserving the original state of the file  105  and protecting the system. In some embodiments of the present invention, under these circumstances the configuration information manager  101  logs the attempt to write the content  111  to the file  105 . The configuration information manager  101  can do this, for example, by writing relevant information  201  concerning the update attempt to a log file  203 . The log  203  can be analyzed, e.g., to glean additional information regarding malicious code. 
     Where the configuration information manager  101  determines to incorporate the content  111  into the file  105 , the configuration information manager  101  writes the content  111  to the file  105 . In some embodiments, the configuration information manager  101  also writes annotations  205  to the file  105 . The annotations  205  can identify information such as the day and time the change was made, and the user and process  107  that made the change. In such embodiments, if the configuration information manager  101  subsequently determines to back the content  111  out of the file  105 , the configuration information manager  101  uses the annotations  205  to remove the content  111 . The configuration information manager  101  can determine to do this in responsive to, for example, later determining that the process  107  or content is malicious, or receiving a directive from a user or a system administrator. 
     Computer programming techniques for annotating file updates are known to those of ordinary skill in the relevant art, and the implementation mechanics thereof within the context of the present invention will be readily apparent to those of such a skill level in light of this specification. For example, in some embodiments the annotations  205  are written to the file  105  as comments in a format supported by the specific file type (the Windows HOSTS file  105 , for example, supports comments in the form of lines beginning with a # character). 
     As will be understood by those familiar with the art, the invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Likewise, the particular naming and division of the modules, agents, managers, functions, procedures, actions, layers, features, attributes, methodologies and other aspects are not mandatory or significant, and the mechanisms that implement the invention or its features may have different names, divisions and/or formats. Furthermore, as will be apparent to one of ordinary skill in the relevant art, the modules, agents, managers, functions, procedures, actions, layers, features, attributes, methodologies and other aspects of the invention can be implemented as software, hardware, firmware or any combination of the three. Of course, wherever a component of the present invention is implemented as software, the component can be implemented as a script, as a standalone program, as part of a larger program, as a plurality of separate scripts and/or programs, as a statically or dynamically linked library, as a kernel loadable module, as a device driver, and/or in every and any other way known now or in the future to those of skill in the art of computer programming. Additionally, the present invention is in no way limited to implementation in any specific programming language, or for any specific operating system or environment. As will be readily apparent to those of ordinary skill in the relevant art, any form of tangible computer readable storage medium can be used in this context, such as magnetic or optical storage media. As will be readily apparent to those of ordinary skill in the relevant art, as used herein, the term “computer readable storage medium” does not mean an electrical signal separate from an underlying physical medium. It will be further readily apparent to those of ordinary skill in the relevant art that the terms “computer system” and “computing device” means one or more computers configured and/or programmed to execute the described functionality. Accordingly, the disclosure of the present invention is intended to be illustrative, but not limiting, of the scope of the invention, which is set forth in the following claims.