Identifying exploitation of vulnerabilities using error report

A system for collecting and managing error report data that determines when an attempted exploit has taken place on one or more networked computers, the system comprising:

• a network connection for receiving error report data from a plurality of networked computers, the error report data being related to occurrence of one or more errors within one or more of the plurality of networked computers;
• a data store for collecting the error report data from the plurality of networked computers;
• a notification module responsive to an identification of a successful exploit and to an identification of an unsuccessful exploit in a service of one of the plurality of networked computers that sends a notice to each of the plurality of computers to collect and forward maximal error data associated with the service;
• a data collection module that obtains state data regarding a configuration of the one of the plurality of computers;
• and
• an analysis module that analyzes the error report data in the data store and state data to produce the identification of the successful exploit, if the exploit is successful, and the unsuccessful exploit, if the exploit is unsuccessful, in the service.

A computer-implemented method of performing computer forensics to determine whether an error report contains evidence of an exploit, the method comprising:

• receiving an error report file including error data related to one or more errors within a computing system;
• performing exploit analysis on the error report, even though the exploit was unsuccessful and even when the error report reflects a known-benign error condition, the exploit analysis comprising:
• scanning, with a computer processor, the error report for a known exploit at an executable memory location;
• scanning, with the processor, the error report for a memory pattern indicative of NOPSleds;
• scanning, with the processor, the error report for a memory pattern indicative of a decoder loop;
• scanning, with the processor, the error report for a memory pattern indicative of each of a malicious text, a malicious string, and a malicious binary sequence;
• scanning, with the processor, the error report for evidence of a disabled defense program;
• scanning, with the processor, the error report for a memory pattern indicative of a hijacked control structure;
• examining, with the processor, exception information for a location of a vulnerability that indicates a point of attack;
• and
• reporting one of the error report file and the result of the exploit analysis to a system monitor via a network connection.