System and method for protecting against point of sale malware using memory scraping

A method for preventing malicious memory scraping, the method comprising the steps of:

• providing a predetermined software processes at a zero-ring level using physical RAM that can be opened as a section named “\\Device\\PhysicalMemory” with NtOpenSection( );
• mapping with NtMapViewOfSection( ) native API functions which include Kernel highest level drivers, intermediate drivers and low level drivers in the NT Kernel and which communicate with Ring 3 (user land) applications to establish a 0 ring hook;
• mapping a targeted physical address with NtMapViewOfSection( ) pointer;
• providing write access to “\\Device\\PhysicalMemory” using NtOpenSection call to WRITE_DAC and READ_CONTROL;
• and
• restoring the memory table.

A method for preventing memory scraping continuously scanning and removing PROCESS_VM_Read flags in system memory from a defined set of vulnerable processes while calling the VirtualQueryEx and OPENPROCESS functions for a defined point of sale application process, the method comprising the steps of:

• determining a 0 ring hook or local level hook;
• map targeted physical address with NtMapViewOfSection( ) or PROCESS_QUERY_INFORMATION or VirtualQueryEx pointer;
• grant write access to “\\Device\\PhysicalMemory” using NtOpenSection identify PROCESS_VM_Read flags;
• monitoring for PROCESS_VM_Read system calls;
• when a PROCESS_VM_Read flag change call is made by wininet call is detected, unhooking the call and restoring the flag to null;
• and
• restoring system hooks.