System and method for detecting and preventing extraction of plaintext passwords using memory attacks
AssigneeSaudi Arabian Oil Company
InventorUrfan Ahmed
Life of this patent
Estimating the term…
Abstract
A system and methodology for preventing extraction of an authentication credential from a memory in a computer. The system and methodology include identifying a memory area used by a native process, monitoring the memory area for any access of the memory area by a process, detecting when data is being read from the memory area, detecting an amount of data being read from the memory area, comparing the amount of data being read from the memory area to a data amount threshold value, and blocking access to the memory area or terminating said process when the amount of data being read from the memory area reaches or exceeds the data amount threshold. The native process can include a Windows® operating system lsass.exe process.
Claims19
A computer-implemented method for preventing extraction of an authentication credential from a memory in a computer, the method comprising:
- identifying a memory area used by a native process;
- monitoring the memory area for any access of the memory area by a process;
- detecting when data is being read from the memory area;
- detecting an amount of data being read from the memory area;
- comparing the amount of data being read from the memory area to a data amount threshold value;
- blocking access to the memory area or terminating said process when the amount of data being read from the memory area reaches or exceeds the data amount threshold,
- wherein the native process includes a Windows® operating system lsass.exe process;
- checking if the computer-implemented method is in a learning mode or a protect mode,
- wherein the protect mode switches to the learning mode after one of the following:
- computer resource updates, patches, or installation of new computer resources;
- and,
- in the event that the computer-implemented method is in the learning mode, allowing data in an access repository to be updated.
A system for preventing extraction of an authentication credential from a memory in a computer, the system comprising:
- a non-transitory computer readable storage medium containing a process monitor having a learning mode and a protect mode arranged to
- identify a memory area used by a native process,
- monitor the memory area for any access by a process,
- detect when data is being read from the memory area, and
- detect an amount of data being read from the memory area;
- an attack detector arranged to
- compare the amount of data being read from the memory area to a data amount threshold value, and
- detect a cyberattack event when the amount of data being read from the memory area reaches or exceeds the data amount threshold;
- a remediation unit arranged to block access to the memory area or terminate said process based on the cyberattack event,
- wherein the native process includes a Windows® operating system lsass.exe process;
- wherein the protect mode switches to the learning mode after one of the following:
- computer resource updates, patches, or installation of new computer resources;
- and,
- wherein data in an application repository is allowed to be updated in the event that the process monitor is in the learning mode.
A non-transitory computer readable storage medium containing credential extraction prevention program instructions for preventing extraction of an authentication credential from a memory in a computer, the program instructions, when executed by a processor, causing the processor to perform an operation comprising:
- identifying a memory area used by a native process;
- monitoring the memory area for any access of the memory area by a process;
- detecting when data is being read from the memory area;
- detecting an amount of data being read from the memory area;
- comparing the amount of data being read from the memory area to a data amount threshold value;
- blocking access to the memory area or terminating said process when the amount of data being read from the memory area reaches or exceeds the data amount threshold,
- wherein the native process includes a Windows® operating system lsass.exe process;
- checking if the operation is in a learning mode or a protect mode,
- wherein the protect mode switches to the learning mode after one of the following:
- computer resource updates, patches, or installation of new computer resources;
- and,
- in the event that the operation is in the learning mode, allowing data in an access repository to be updated.
Dependencies are inferred from the claim text.