Automatic detection of vulnerability exploits

An embodiment of the invention provides an apparatus and method for automatic detection of a vulnerability exploit. The apparatus and method are configured to post a security vulnerability warning indicating a vulnerability of software; provide an exploit detector; and use the exploit detector to detect an attempted exploit that targets the vulnerability.

TECHNICAL FIELD

Embodiments of the invention relate generally to the automatic detection of vulnerability exploits.

BACKGROUND

Vulnerabilities have been found in various types of software such as, for example, operating systems and software applications. The term “vulnerability” refers to a security defect in a system or software so that an attacker can potentially violate the confidentiality, integrity, operations, availability, access control, and/or data of the system or software. Vulnerabilities may result from bugs or design flaws in the system or software.

Security bulletins are issued by software vendors and security fixes (e.g., software patches which are updates to software) are typically applied to software, as a response to a discovered vulnerability in software. For example, Microsoft Corporation provides software updates or security patches in, for example, WINDOWS® update. However, applying a security fix to a system (e.g., server) may require downtime and re-booting of the system and may disrupt or make unavailable the services provided by the system. This disruption or system unavailability can lead to added cost for the user of the system.

System administrators often bundle the security fixes together that they download/receive, and may apply these bundled fixes on a pre-scheduled cycle in order to reduce the time that they spend in applying the fixes. However, some security fixes may be required to apply to the system before the pre-scheduled cycle, particularly if the discovered software vulnerability has a high severity (e.g., there is a high likelihood that exploits will occur on the vulnerability and/or the damage that an exploit can cause is high).

Security bulletins are placed by software vendors in customer-accessible databases and provide additional details that describe, for example, a discovered software vulnerability, the severity and urgency of the problem (e.g., if the vulnerability requires a critical update), likelihood of an exploit and the spread of the exploit, the potential damage that a vulnerability exploit can cause to the system or software, instructions on the security fixes (e.g., patches), and/or the like. However, the posting of security bulletins also potentially provides information to potential hackers on how to exploit the discovered vulnerability. Additionally, an administrator (or user) may not necessarily apply a security fix to a system, immediately or at all, because the administrator may need to first test the security fix for potential harm to the system and/or applying the security fix will cause downtime or disruption to the system.

In a highly-used or highly-available system (e.g., servers that are used or accessed by many computers), the cost of having the system as unavailable can be high. As a result, an administrator may wait for a certain period of time before applying the security fix to the system in order to delay the downtime or to schedule the downtime when few users are accessing the system. Furthermore, in other network systems, a network administrator would push the security fix downstream to individual users of computers, and these individual users may not necessarily apply the fixes or may delay in applying the fixes to their individual computers. Additionally, some administrators or users might delay in applying the security fix if the system is protected by a firewall.

As a result, the above constraints (and other possible constraints) may prevent administrators (and/or users) in applying the security fixes, immediately or at all. The administrators are making their decisions on when to apply the fixes based on the relative risks of quickly applying the fixes versus the relative risks of delaying in applying the fixes. In other words, the administrators are weighing the cost of immediately applying the fixes (which leads to costs/expenses associated with, e.g., system downtime) versus the cost of potential damage to the system if the vulnerability is exploited by a hacker. The decision of administrators to delay in applying the security fix takes into account the expected severity of vulnerability exploit damage and the probability of an exploit occurrence.

There is a need to solve the problem of protecting a system from vulnerability exploits, between the time when a vendor posts a security bulletin for a discovered vulnerability and the time when a security fix for the discovered vulnerability is actually applied to the system.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

FIG. 1is a block diagram of an apparatus (system)100in accordance with an embodiment of the invention. A system105is connected to a network110. The system105can be, for example, a server or a computer. The network110is, for example, a public network such as a wide area network (e.g., Internet).

The system105includes standard hardware elements115that are used in computing operations or data transmissions. For example, the hardware elements115includes a processor120, one or more memory devices125, storage devices130such as disks, ports140, a disk driver145, a network driver150, and/or other known hardware elements that are used in computing devices.

The system105also includes software elements such as, for example, an operating system155that performs management functions and other functions that are known to those skilled in the art.

As previously discussed above in the background section, a software vendor will post a security bulletin160after a vulnerability is discovered in a software or system that is provided by the vendor to customers. The security bulletin160is typically posted in a publicly-accessible database165or email list. A particular security bulletin160may provide additional details that describe, for example, a discovered software vulnerability, the severity and urgency of the problem (e.g., if the vulnerability requires a critical update), likelihood of an exploit and the spread of the exploit, the potential damage that a vulnerability exploit can cause to the system or software, instructions on the security fixes (e.g., patches), and/or the like.

The vendor can provide a security fix170from a server175. Typically, the security fix170can be downloaded by the customer from the server175to the system105via network110. The security fix170can be, for example, a software patch or software update, and is designed to protect software in the system105from exploits that are designed to attack the vulnerability that is posted in the security bulletin160. The administrator of server105can install the security fix170to the system105in order to protect the system105from exploits that are designed to attack the vulnerability that has been posted in the security bulletin160. Various security fixes that protect particular software (e.g., operating systems software) from discovered vulnerabilities of the particular software are well known to those skilled in the art.

In an embodiment of the invention, an exploit detector180is transmitted along with the security fix170from a source node (e.g., server175) to a destination node (e.g., system105). In other instances, the exploit detector180can be transmitted immediately after (or subsequently after) the security fix170is transmitted from the source node to the destination node.

After the exploit detector180is installed into the system105and launched by a standard software launcher182, the exploit detector180can detect a current exploit (or attempted exploit)181that is attacking a vulnerability in the system105. As mentioned above, this vulnerability was posted in the security bulletin160. An exploit181can be generated typically by a hacker who may be operating a node183(e.g., server) and this hacker may be aware of the vulnerability that is posted in the security bulletin160. It is possible that the hacker may alternatively design (reverse-engineer) an exploit181from the security fix170that is designed to attack the vulnerability that has been posted in the security bulletin160.

The exploit detector180is code that can be programmed by use of standard programming languages (e.g., C, C++, shell script, or Pascal) and can be programmed by use of standard programming techniques that are known to those skilled in the art.

The exploit detector180can be customized by the vendor's personnel who understand the security fix170and the particular vulnerability that is disclosed in the security bulletin160. The exploit detector180can detect the particular vulnerability exploits181that are disclosed in the security bulletin160. The administrator can install the exploit detector180(manually or automatically via a tool) into the system105if the administrator has not yet been able to apply the security fix170to the system105due to the constraints that have been discussed above in the background section. The exploit detector180automatically detects an exploit181(or an occurrence of a previous exploit181or attempted exploit) that attacks the particular vulnerability that is identified in the posted security bulletin160. The administrator of system105is aware that the system105is vulnerable (or/and software in the system105is vulnerable) to the particular exploit181that is disclosed by the security bulletin160, because he/she has not yet applied the security fix170that is designed to protect the system105from the exploit181.

A standard software launcher182can start the execution of the exploit detector180and may also be used to disable or delete the exploit detector180after the administrator has installed the security fix170on the system105. Software launchers are used in commercially available computers and are implemented in various forms.

As an example operation, assume that the security bulletin160posts a security vulnerability that has been discovered by a vendor of software that is installed in the system105. For example, the security bulletin160discloses a vulnerability for the operating software155. A standard software updates tool184can notify the administrator of the system105about the posted security bulletin160and the availability of a security fix170for the vulnerability. Software updates tools are provided in various commercially-available operating systems such as, for example, HP-UX® from HEWLETT-PACKARD COMPANY or WINDOWS® from MICROSOFT CORPORATION. As a further example, if the security bulletin160indicates that the operating system155has the vulnerability of being exploited by spyware or spamware, then the security fix170can protect the operating system from spyware or spamware. Methods for protecting software programs from particular vulnerabilities (e.g., spyware or spamware attacks) are known to those skilled in the art. For example, the exploit detector180can monitor for system state changes (in system105or in the software itself) or network patterns from network110, by use of a standard host-based firewall pattern analyzer in the firewall185or Host-based Intrusion Detection System (such as, e.g., HP-UX HostIDS). Therefore, block185can additionally or alternatively include the features of a commercially-available host based Intrusion Detection System.

As an example, the HostIDS product can limit access to the system105if the detector180detects an attack. The required security fix170(e.g., patch) would then be installed. As other examples, it is also within the scope of embodiments of the invention for automatic, recommended, or computer assisted actions that are well known to those skilled in the art to, for example: install the security fix170, disable the system105or shut the system down, take the system105off the network, add firewall rules (e.g., so that the firewall restricts the system's network access), use HostIDS intervention to limit access to the system by use of methods that are known to those skilled in the art, and/or isolate the system105in other ways that are known to those skilled in the art, when the detector180detects an attack.

The exploit detector180may also include code that generates a notification187that an administrator189can view via, for example, a user interface in the system105. The notification187can indicate that an exploit181is occurring or has occurred. The administrator can then perform an appropriate response if an exploit is occurring or has occurred, such as, for example, installing the security fix170immediately and without further delay.

Those skilled in the art can use known methods to program an exploit detector180to detect an exploit (e.g., spyware or spamware attack) that is attacking the operating system155or that may have infected the operating system155, and to program the exploit detector180to generate the notification187. The implementation details of programming code (such as the exploit detector180) to detect a known exploit (e.g., spyware or spamware attack or other types of attacks) are known to those skilled in the art and can differ depending on the type of attack.

Since the security bulletin160has been publicly posted at time T1(FIG. 2), a potential hacker can develop (reverse-engineer) and release an exploit181that can attack the vulnerability that is noted in the security bulletin160. As discussed above, various constraints may prevent an administrator in applying the security fix170that protects against the exploit181, until at subsequent time T2. Therefore, there is a delay interval, Tdelay=T2−T1, where the security bulletin has been publicly posted and the system105does not yet have the security fix170installed and is therefore vulnerable to the particular exploit181that has been posted in the security bulleting160. The delay interval, Tdelaycan have a value in minutes, hours, days, weeks, or months, depending on the time length that the administrator delays in applying the security fix170due to various example constraints that have been discussed above. As also discussed above, it is a common practice by administrators to apply software fixes on a scheduled cycle which can be, for example, every few weeks or months.

Vendors typically recommend that the security fix should be applied by their customers as soon as possible after the security bulletin is posted at time T1. However, as discussed above, due to various constraints, administrators or users may delay or not even apply the security fix after the time T1or at all, particularly if the system is a high-availability system or if the system is protected by a firewall. The exploit detector180helps to reduce the risk when the administrator delays in applying the security fix170and also informs the administrator when an actual attack occurs with relation to the vulnerability. With this solution, systems can be protected completely from some attacks, if the exploit detector180is designed to block the particular attack181or if the administrator can react quickly enough to block an attack by, for example, adjusting the firewall rules of a firewall to protect against the attack181.

At a minimum, the exploit detector180can detect the occurrence of an attack181before the security fix170is applied to the system105at time T2. Since the administrator is notified by the exploit detector180that an attack181occurred before time T2, the administrator can perform corrective action to fix the damages from the attack181and take protective action such as, e.g., immediately installing the security fix170to the system105. For example, if the exploit detector180detects a spyware or spamware that has infected the operating system155due to an attack181during the delay interval Tdelay, then the administrator can use anti-spyware software or anti-spamware software to remove the spyware or spamware that has infected the operating system155, and apply the security fix170to prevent future exploits181to the operating system155, or reinstall the operating system and application software from a known uncompromised source. Therefore, the exploit detector180can provide at least partial protection from an attack181that can occur before the system105is brought down for updates during time T2.

As mentioned above, the exploit detector180can be configured to monitor for system state changes or network patterns using a host-based firewall pattern analyzer (in this case, the detector might modify a firewall185rule and set up a notification187). Since the firewall rule is modified, the firewall185could automatically respond by blocking or slowing down access of network traffic to particular ports140.

As discussed above, an embodiment of the invention allows administrators, who may have reason to delay in applying fixes170for security bulletins160(such as until time T2which starts a maintenance window), to detect actual exploits181of the vulnerability by use of the detectors180that can be installed in the system105. These detectors180would allow the administrators to know when waiting for a maintenance window is too risky even after they previously made that decision to delay the installation of a security fix170until time T2.

If the exploit detector180has detected an occurring exploit181or has detected an exploit181that had already occurred in the system105, then the administrator can optionally take corrective action or protective action to respond to the occurring exploit or previous exploit. For example, the administrator can immediately apply the security fix170or other software application for fixing any damages that may have been caused by an exploit181.

If the exploit detector180detects frequent attacks, then the administrator can shorten the delay interval Tdelayby applying the security fix170sooner rather than later, as a future procedure for the system105.

Embodiments of the invention provide various advantages. For example, the approach discussed above allows systems to maintain up-time and avoid the risk of system breakage due to the installation of security fixes which may break the system or cause unexpected harm in the system, while allowing the system to monitor and detect attempted exploits181of the security defects which remain temporarily unpatched on the system. As also discussed above, system up-time requirements and testing intervals (for security fixes) often delay administrators from immediately installing the security fixes. This delay leaves systems vulnerable to attack. By installing the exploit detector180which can specifically detect the particular vulnerability that is posted in a particular security bulletin160, the administrator189has at least some assurance of notification if their system is attacked by a known exploit181and if their system has not yet been installed with the security fix170for that exploit181. In a best case scenario, the exploit can be stopped by the detector180, the host-based firewall185, or helper software190(e.g., anti-spamware or anti-spyware software) that can be installed by the administrator. In the lesser case scenario, the administrator is at least notified by the exploit detector180that he or she has waited too long to apply the security fix170because an exploit181has occurred during the delay interval Tdelay, and the administrator can take corrective action to fix the damage that has been caused by the exploit181.

Note further that intrusion detection systems differ from embodiments of the invention because intrusion detection systems are designed for monitoring a wide range of suspicious network traffic and are not designed to monitor a specific exploit that is specifically disclosed by the security bulletin160and that is to be prevented by the security fix170. Additionally, an intrusion detection system is not tied directly to a security fix170(e.g., patch) because the use of an intrusion detection system is completely independent from the developments of security fixes development and is completely independent from vulnerability announcements in security bulletins160.

Note further that intrusion prevention systems differ from embodiments of the invention because intrusion prevention systems are also not designed to respond to a specific exploit that is specifically disclosed by the security bulletin and that is to be prevented by the security fix. While this invention could be implemented as extensions to Intrusion Detection or Prevention Systems, doing so would go beyond the current state of the art in the field.

FIG. 3is a flow diagram of a method300in accordance with an embodiment of the invention. In block305, the vendor of software can post a security bulletin (or other types of security vulnerability warning) indicating a vulnerability for the software or system that has been installed with the software.

In block310, the vendor can provide an exploit detector to detect an exploit to the vulnerability and a security fix to protect the software from the exploit. The user of the system with the software can then download the exploit detector and the security fix.

Blocks305and310are shown as separate blocks inFIG. 3, and may vary in order or may concurrently occur. Typically, the exploit detector is included with the posting of the security bulletin, or the exploit detector may be available for use before or after the vulnerability is publicized.

In block315, the user can install the exploit detector on the system, where the exploit detector detects exploits that occur before the user can install the security fix on the system. As discussed above, there may be one or more constraints that prevent the user to immediately install the security fix on the system.

In block320, the exploit detector detects any exploits to the vulnerability. Therefore, the exploit detector permits the user of the system to determine if an exploit to the vulnerability is detected prior to installation of the security fix on the system.

In block325, the user can optionally perform a response (or have the system automatically perform a response), as discussed above, based on any detected exploits to the vulnerability. For example, the user (or system) can immediately install the security fix170to the system or/and disable or isolate the system105, if an exploit has been detected by the exploit detector or/and if an exploit is being detected by the exploit detector.

It is also within the scope of the present invention to implement a program or code that can be stored in a machine-readable or computer-readable medium to permit a computer to perform any of the inventive techniques described above, or a program or code that can be stored in an article of manufacture that includes a computer readable medium on which computer-readable instructions for carrying out embodiments of the inventive techniques are stored. Other variations and modifications of the above-described embodiments and methods are possible in light of the teaching discussed herein.