Securely launching files downloaded to potentially unsafe locations on a computer system
AssigneeSymantec Corporation
InventorDaniel J. Kowalyshyn
Life of this patent
Estimating the term…
Abstract
The present disclosure relates to protecting computer systems from installation of rogue shared libraries when executable files are launched. An example method generally includes detecting that a downloaded file has been written to an insecure location on the computing device. A computing device determines that the downloaded file includes at least a first executable component and, upon determining that the downloaded file includes executable components, generates a copy of the executable component in a protected repository on the computing device. The computing device overwrites the contents of the executable component with at least instructions to launch the copy of the downloaded file from the protected repository.
Claims20
A method for managing shared libraries loaded into memory when launching executable programs downloaded to an insecure location on a computing device, comprising:
- detecting that a downloaded file has been written to the insecure location on the computing device;
- determining that the downloaded file includes an executable component;
- generating a copy of the executable component to a protected repository on the computing device;
- and
- overwriting contents of the executable component in the downloaded file with at least instructions to launch the copy of the executable component from the protected repository.
A system, comprising:
- a processor;
- and
- a memory comprising instructions which, when executed by the processor, perform an operation for managing shared libraries loaded into the memory when launching executable programs downloaded to an insecure location on the system, the operation comprising:
- detecting that a downloaded file has been written to the insecure location on the system;
- determining that the downloaded file includes an executable component;
- generating a copy of the executable component in a protected repository on the system;
- and
- overwriting contents of the executable component in the downloaded file with at least instructions to launch the copy of the executable component from the protected repository.
A non-transitory computer-readable medium comprising instructions which, when executed by one or more processors, perform an operation for managing shared libraries loaded into memory when launching executable programs downloaded to an insecure location on a computing device, the operation comprising:
- detecting that a downloaded file has been written to the insecure location on the computing device;
- determining that the downloaded file includes an executable component;
- generating a copy of the executable component in a protected repository on the computing device;
- and
- overwriting contents of the executable component in the insecure location with at least instructions to launch the copy of the executable component from the protected repository.
Dependencies are inferred from the claim text.