(51) Int Cl.: H04L 12/58 ( ) G06F 21/00 ( ) G06Q 10/00 ( )

Transcription

1 (19) (12) EUROPEAN PATENT SPECIFICATION (11) EP B1 (4) Date of publication and mention of the grant of the patent: Bulletin 2008/49 (1) Int Cl.: H04L 12/8 ( ) G06F 21/00 ( ) G06Q /00 ( ) (21) Application number: (22) Date of filing: (4) Method and device for preventing malicious computer code from propagating Verfahren und Vorrichtung zur Verhinderung der Ausbreitung von böswilligen Programmkode Procédé et dispositif pour empêcher la propagation du logiciel malveillant (84) Designated Contracting States: DE FR GB (30) Priority: US P US 268 (43) Date of publication of application: Bulletin 2004/0 (73) Proprietor: SYMANTEC CORPORATION Cupertino, CA 9014 (US) (74) Representative: Beresford, Keith Denis Lewis et al BERESFORD & Co. 16 High Holborn London WC1V 6BX (GB) (6) References cited: EP-A WO-A-01/91403 WO-A-02/0072 WO-A-97/39399 DE-A GB-A US-A (72) Inventor: Szor, Peter Northridge, CA (US) EP B1 Note: Within nine months of the publication of the mention of the grant of the European patent in the European Patent Bulletin, any person may give notice to the European Patent Office of opposition to that patent, in accordance with the Implementing Regulations. Notice of opposition shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention). Printed by Jouve, 7001 PARIS (FR)

2 1 EP B1 2 Description [0001] This invention pertains to the field of preventing malicious attacks to computers, and, in particular, preventing propagation of malicious computer code. [0002] As used herein, "malicious computer code" is any code that enters a computer without an authorized user s knowledge and/or without an authorized user s consent. Malicious computer code that propagates from one computer to another over a network, e.g., via , is often referred to as a "worm". Most worms that spread from one computer to another are spread via over the Internet. The most common way to send over the Internet is using the SMTP (Simple Mail Transfer Protocol). SMTP is part of TCP/IP (Transfer Control Protocol/ Internet Protocol). SMTP was originally designed to send only that that consists solely of text and that is encoded using the ASCII character set, which is limited. It soon became apparent that computer users wished to send other than straight ASCII characters as , and so encoding schemes such as UUencode and MIME were developed. These encoding schemes are capable of encoding any type of file, including a binary graphics file, into ASCII so that it can be sent as an attachment. [0003] Figure 1 illustrates a common system by which a client computer 1 can send to a recipient computer over an open network 4 such as the Internet. In Figure 1, it is assumed that there are a plurality N of client computers 1 located within an enterprise 3. Enterprise 3 may be a company, a university, a government agency, etc. Computers 1 are coupled to each other and to an e- mail server computer 2 over a Local Area Network (LAN) 6. server 2 collects and formats s sent from computers 1 and sends them to the designated recipients using the SMTP protocol. It is assumed that there are a plurality J of recipient computers. [0004] Figure 2 illustrates a similar network in which client computers 1 are not associated with the same enterprise 3, but rather may be more geographically dispersed and are subscribers to an Internet Service Provider (ISP). In this cause, computers 1 communicate with the ISP s server 2 via the Public Switched Telephone Network (PSTN) 6. In other respects, the functioning of the networks illustrated in Figures 1 and 2 are the same. [000] WO02/0072 describes a system for processing s which monitors traffic patterns to identify patterns characteristic of a virus outbreak. s are assessed using criteria which may include assessing whether s contain the same or similar body texts or contain the same attachment. [0006] WO97/39399 describes sending via a proxy server which scans the message body for code likely to contain viruses. [0007] GB-A describes an service for sending warning messages to subscribers when the presence of a virus in their system is detected [0008] WO-01/91403 describes a secure mail server which provides a digital signature to verified messages. [0009] Aspects of the present invention are set out in the appended independent claims. [00] Computer-implemented methods, systems, and computer-readable media are disclosed for detecting the presence of a malicious computer code in an e- mail sent from a client computer (1) to an server (2). An embodiment of the inventive method comprises the steps of: allowing (42) a proxy server (31) residing within a client computer to intercept s sent from the client computer (1) to the server (2) ; enabling (43) the proxy server (31) to determine when a file (30) is attempting to send itself (30) as part of an ; and declaring (44) a suspicion of malicious computer code when the proxy server (31) determines that a file (30) is attempting to send itself (30) as part of an . Brief Description of the Drawings [0011] These and other more detailed and specific objects and features of the present invention are more fully disclosed in the following specification, reference being had to the accompanying drawings, in which: Figure 1 is a system level diagram of a conventional network for sending from within an enterprise 3. Figure 2 is a system level diagram of a conventional network for sending via an Internet Service Provider (ISP) computer 2. Figure 3 is a block diagram illustrating an embodiment of the present invention. Figure 4 is a flow diagram illustrating an embodiment of the present invention. Detailed Description of the Preferred Embodiments [0012] Nefarious persons sending malicious computer code via s have resorted to many tricks to spread their malicious messages. A typical may look something like this: IP x.y.z.1:2 (SMTP) HELLO someone RCPT to: edgxyz.com FROM: XYZGx17as.com SUBJECT: HELLO DATA MIME-encoded attachments [0013] One of the tricks employed by authors of mali- 2

3 3 EP B cious code is to falsify the "FROM" field so that the recipient of the will be lulled into thinking that the e- mail was sent from a known, reputable source. [0014] Sometimes the malicious code will be encrypted, making it difficult for a conventional anti-virus scanner to analyze it. [001] Modern worms such as Klez self-activate simply by the user clicking open the message itself : the user doesn t even have to click on the attachment containing the worm. Klez has operated through the popular software known as Microsoft outlook. Klez contains its own SMTP client embedded in the worm; it does not reply on Outlook. [0016] The embodiment thwarts the propagation of malicious computer code being sent in an s from a client computer 1 to an server 2, by means of interposing (step 41 of Fig. 4) an proxy server 31 (hereinafter referred to as "proxy") between the client computer 1 and the server 2. The client computer 1 thinks that the proxy 31 is the real server 2. The proxy 31 may be associated with the client computer 1, e.g., it may reside within computer 1. [0017] Figure 3 illustrates the basic architecture of proxy 31. Redirector 36 intercepts messages, and tricks client file 30 into thinking that redirector 36 is server 2. Scan manager 32 is coupled to re-director 36, and contains intelligence for examining the contents of s. Decomposer 33 is coupled to scan manager 32; and unpacks (e.g., unzips) objects and sends the decomposed objects back to scan manager 32 one by one. Decomposer 33 is invoked when the being analyzed by scan manager 32 contains many objects, e.g., an e- mail body and several attachments that are zipped or otherwise combined. In that case, decomposer 33 unzips the objects and presents them to scan manager 32 one by one for further analysis. API 34 such as Norton Antivirus Application Programming Interface (NAVAPI) 34 is coupled to scan manager 32, and presents scan manager 32 with ready access to conventional antivirus software. Extensions 3 such as Norton Antivirus Extensions (NAVEX) 3 are coupled to NAVAPI 34 and contain all of the scanning engines, virus signatures, and virus names used in conventional antivirus scanning. Modules may be implemented in hardware, software, and/or firmware, or any combination thereof. [0018] In the embodiment where server 2 adheres to the SMTP protocol, proxy 31 adheres to the SMTP protocol as well.-generally speaking, proxy 31 adheres to the same protocol adhered to by server 2. [0019] At step 42 of Fig. 4, proxy 31 is enabled to intercept sent from the client computer 1 to the e- mail server 2. The enabling may be accomplished by the user of computer 1 clicking on a " scanning" feature on antivirus software (such as Norton Antivirus manufactured by Symantec Corporation of Cupertino, California) that has been installed on the user s computer 1. Such an enabling may, for example, serve to activate proxy 31 every time a client file 30 within client computer 1 attempts to access the computer s port 2, which is the conventional port used in personal computers for sending over the Internet. [0020] At step 43, scan manager 32 determines whether file 30 is attempting to send itself, either as part of the body or as an attachment. The determination that is made in step 43 can vary based upon the type of file 30. The name of the file 30 is ascertained by redirector 36 and given to scan manager 32. In the WIN32 API of Microsoft Corporation, scan manager 32 determines whether file 30 is a file in the PE (portable executable) format. The PE header identifies file 30 as a PE file. Section headers determine the type of the section, e.g., code sections, data sections, resource sections, etc. For a PE file in the WIN 32 API, scan manager 32 examines the entire code section or code sections. Scan manager 32 performs a compare between two versions of file 30: the version that has been intercepted and that now resides within proxy 31 versus the version that resides in client computer 1. In one embodiment, scan manager 32 declares a suspicion of malicious code in step 44 when the two versions are nearly identical. If the two versions are not nearly identical, scan manager 32 declares in step 4 that no malicious code is present in file 30. "Nearly identical" is defined throughout this patent application to mean that no more than one byte out of a preselected threshold number of bytes varies between the two versions. In one embodiment, the preselected threshold number of bytes is 12. Other preselected threshold numbers can be selected based on the application. The reason for not insisting upon perfect matching between the two versions of the file is that the malicious code occasionally modifies a byte of the file. [0021] Once a suspicion of malicious code is declared in step 44, one or more optional steps 46, 47, and 48 can be invoked. Steps 46 and 48 serve to reduce the number of unwanted false positives (declaring a file 30 to be contaminated when it isn t). [0022] In optional step 46, the user of computer 1 is given a set of choices when a suspicion of malicious code has been declared in step 44. These choices may be presented to the user via a dialog box which pops up on the user s monitor. Such a dialog box may look like the following: Malicious Worm Alert Filename: readme.exe [0023] Norton AntiVirus has detected a malicious worm on your computer that is trying to itself to other computers. If. this Malicious Worm Alert appeared when you were not sending an message, the worm is trying to spread itself by , and you should select the "Quarantine this worm (Recommended)" option from the following drop down list. You can get more information about the worm from the Symantec Security Response virus encyclopedia. 3

4 EP B1 6 [0024] Select one of the following actions: Stop this worm from ing itself. This stops the worm from ing itself at this time, but does not quarantine the worm. This action leaves the worm on your computer, where it can possibly be activated again. Select this option only if you are sure you want to leave the worm on your computer. Quarantine this worm (Recommended). This permanently stops the worm by putting it in the Norton AntiVirus Quarantine. While in Quarantine, the worm will not be able to spread itself. This is the safest action. Allow this application to send attachments. This sends the containing a potential worm. Such a worm could infect the recipient s computer. Select this option only if you are sure the is not infected with a worm. Always allow this application to send attachments. In the future, Norton AntiVirus will not check this file for worms. This is the riskiest action, because such a worm could itself from your computer without your knowledge. [002] Note that the file name of the suspicious file 30 is given to the user, along with four choices. If the second choice is selected (quarantining the worm), file 30 is encrypted and sent to the headquarters of the antivirus company (in this case, Symantec) for analysis. [0026] It is expected that the user would rarely select choices three or four (allowing the application to send e- mail attachments). Such a choice might be selected when the user is attempting to the entire software program to a recipient.. [0027] In optional step 47, an alert is sent to every client computer 1 associated with the enterprise 3. The alert serves to warn other users of possible problems. [0028] In optional step 48, scan manager 32 checks to see whether a digital signature has been affixed to file 30, and, if so, verifies the digital signature with a trusted source in a conventional manner. If the digital signature is present and is verified by the trusted third party, scan manager 32 then rescinds the declaration of suspected malicious code found in step 44, and deems the file 30 to be clean after all. [0029] The above description is included to illustrate the operation of the preferred embodiments and is not meant to limit the scope of the invention. The scope of the invention is to be limited only by the following claims. From the above discussion, many variations will be apparent to one skilled in the art that would yet be encompassed by the scope of the present invention. [0030] The present invention can be implemented by a computer program operating on a proxy computer. An aspect of the present invention thus provides a storage medium storing processor implementable instructions for controlling a processor to carry out the method as hereinabove described [0031] Further, the computer program can be obtained in electronic form for example by downloading the code over a network such as the internet. Thus in accordance with another aspect of the present invention there is provided an electrical signal carrying processor implementable instructions for controlling a processor to carry out the method as hereinbefore described. Claims 1. A method of operating an proxy (31) residing within a client computer for detecting the presence of malicious computer code in an generated by the client computer (1) for sending to the server, said method comprising the steps of: operating the proxy to intercept (42) s generated by the client computer for sending to the server; characterised by; the proxy determining (43) when a file (30) is attempting to send itself as part of an ; and the proxy declaring (44) a suspicion of malicious code when the proxy determines that the file is attempting to send itself as part of an The method of claim 1 wherein the server and the proxy adhere to the SMTP protocol. 3. The method of claim 1 further comprising, in response to the declaring step, the step of sending (46) a message to a user of the client computer. 4. The method of claim 3 wherein the message gives the user a plurality of choices, comprising at least one choice from the following group of choices: preventing the file from ing itself; quarantining the file; allowing the file to send attachments; and always allowing the file to send attachments.. The method of claim 4 further comprising, when the user chooses to quarantine the file, the step of encrypting the file and sending the file to an antivirus software company. 6. The method of claim 1 further comprising, in response to the declaring step, the step of transmitting an alert to each computer in an enterprise associated with the client computer. 7. The method of claim 1 further comprising, in response to the declaring step, the step of rescinding the declaration of suspicion when the file contains a digital signature and the digital signature is verified. 4

5 7 EP B The method of claim 1 wherein the determining step comprises the substeps of: decomposing the into constituent parts; and determining that the file is attempting to send itself when a replica of the file is detected in one of the constituent parts. processor perform the method of any one of claims 1 to An electrical signal carrying processor implementable instructions for controlling a processor when executed to carry out all of the steps of a method of any one of claims 1 to The method of claims 1 wherein the determining step comprises the proxy comparing a version of the file from the client computer with a version of the file from within the proxy.. The method of claim 9 wherein a suspicion that malicious code is present in the file is declared when the two versions vary by no more than one byte out of a preselected threshold number of bytes. 11. The method of claim wherein the preselcted threshold number is The method of claim 1 wherein the file is attempting to send itself as part of an body. 13. The method of claim 1 wherein the file is attempting to send itself as part of an attachment. 14. Apparatus (31) for detecting the presence of malicious computer code in an sent from a client computer (1) to an server (2), said apparatus comprising: Patentansprüche 1. Verfahren zum Betrieb eines -Proxys (31), der innerhalb eines Client-Computers eingerichtet ist, um das Vorhandensein bösartigen Computercodes in einer vom Client-Computer (1) zum Senden an einen -Server erzeugten zu erkennen, mit folgenden Schritten: Betreiben des -Proxys zum Abfangen (42) von s, die vom Client-Computer zum Senden an den -Server erzeugt werden, dadurch gekennzeichnet, dass der -Proxy bestimmt (43), wenn eine Datei (30) versucht, sich selbst als Teil einer zu versenden, und der -Proxy einen Verdacht auf bösartigen Code bekannt gibt (44), wenn er bestimmt, dass die Datei versucht, sich selbst als Teil einer E- Mail zu versenden. 2. Verfahren nach Anspruch 1, wobei sich der - Server und der Proxy an das SMTP-Protokoll halten. a proxy residing within the client computer, said proxy comprising: a redirector module (36) adapted to intercept s sent from the client computer to the server; and characterised by, coupled to the redirector module, a scan manager module (32) adapted to determine when a file (30) within the client computer is attempting to send itself as part of an The apparatus of claim 14 further comprising, coupled to the scan manager module, a decomposer module (33) adapted to: decompose into constituent parts; and determine that the file is attempting to send itself as part of an when a second file varying from the first file by no more than one byte out of a preselected number of bytes is detected in one of the constituent parts. 16. A computer-readable medium containing computer program instructions, which when executed by a Verfahren nach Anspruch 1 mit einem Schritt zum Senden (46) einer Nachricht an einen Benutzer des Client-Computers in Reaktion auf den Bekanntgabeschritt. 4. Verfahren nach Anspruch 3, wobei die Nachricht dem Benutzer mehrere Auswahlmöglichkeiten gibt, die zumindest eine der folgenden Auswahlmöglichkeiten enthalten: Verhindern, dass die Datei sich selbst als verschickt, unter Quarantäne setzen der Datei, Erlauben, dass die Datei -Anhänge versendet, und stets Erlauben, dass die Datei -Anhänge versendet.. Verfahren nach Anspruch 4 mit einem Schritt zum Verschlüsseln der Datei und zum Senden der Datei an ein Anti-virus-Softwareunternehmen, wenn der Benutzer das unter Quarantäne setzen der Datei auswählt. 6. Verfahren nach Anspruch 1 mit einem Schritt zum

6 9 EP B1 Senden einer Warnung an jeden Computer in einem dem Client-Computer zugehörigen Unternehmen in Reaktion auf den Bekanntgabeschritt. 7. Verfahren nach Anspruch 1 mit einem Schritt zum Widerrufen der Bekanntgabe des Verdachts, wenn die Datei eine digitale Signatur enthält, die verifiziert ist. 8. Verfahren nach Anspruch 1, wobei der Bestimmungsschritt folgende Unterschritte aufweist: Zerlegen der in Bestandteile, und Bestimmen, dass die Datei versucht, sich selbst zu versenden, wenn in den Bestandteilen eine Kopie der Datei erkannt wird. 9. Verfahren nach Anspruch 1, wobei der Bestimmungsschritt beinhaltet, dass der Proxy eine Version der Datei vom Client-Computer mit einer Version der Datei von innerhalb des Proxys miteinander vergleicht.. Verfahren nach Anspruch 9, wobei ein Verdacht auf das Vorhandensein bösartigen Codes in der Datei bekanntgegeben wird, wenn sich die beiden Versionen um nicht mehr als ein Byte aus einer vorgewählten Schwellenanzahl an Bytes unterscheiden. 11. Verfahren nach Anspruch, wobei die vorgewählte Schwellenanzahl 12 ist. 12. Verfahren nach Anspruch 1, wobei die Datei versucht, sich selbst als Teil eines -Körpers zu versenden. 13. Verfahren nach Anspruch 1, wobei die Datei versucht, sich selbst als Teil eines -Anhangs zu versenden. 14. Vorrichtung (31) zum Erkennen des Vorhandenseins bösartigen Computercodes in einer von einem Client-Computer (1) an einen -Server (2) gesandten , aufweisend: einen im Client-Computer eingerichteten Proxy, der Folgendes aufweist: ein Redirektor-Modul (36) zum Abfangen von vom Client-Computer an den - Server gesandten s, gekennzeichnet durch ein mit dem Redirektor-Modul gekoppeltes Abtastmanagermodul (32), um zu bestimmen, wenn eine Datei (30) innerhalb des Client-Computers versucht, sich selbst als Teil einer zu versenden Vorrichtung nach Anspruch 14 mit einem mit dem Abtastmanagermodul gekoppelten Zerlegermodul (33) zum Zerlegen einer in Bestandteile und Bestimmen, dass die Datei versucht, sich selbst als Teil einer zu versenden, wenn in einem der Bestandteile eine zweite Datei erkannt wird, die sich von der ersten durch nicht mehr als ein Byte aus einer vorgewählten Anzahl an Bytes unterscheidet. 16. Computerlesbares Medium mit Computerprogrammanweisungen, die bei Ausführung durch einen Prozessor ein Verfahren nach einem der Ansprüche 1 bis 13 ausführen. 17. Elektrisches Signal, das Prozessor-implementierbare Anweisungen zum Steuern eines Prozessors trägt, um bei Ausführung alle Schritte eines Verfahrens nach einem der Ansprüche 1 bis 13 durchzuführen. Revendications 1. Procédé de mise en oeuvre d un serveur mandataire de courrier électronique (31) résidant dans un ordinateur client pour détecter la présence d un code informatique malveillant dans un courrier électronique généré par l ordinateur client (1) pour envoi au serveur de courrier électronique, ledit procédé comprenant l étape consistant à : mettre en oeuvre le serveur mandataire de courrier électronique pour intercepter (42) les courriers électroniques générés par l ordinateur client pour envoi au serveur de courrier électronique ; caractérisé en ce que : le serveur mandataire de courrier électronique détermine (43) si un fichier (30) tente de s envoyer lui-même en tant que partie d un courrier électronique ; et le serveur mandataire de courrier électronique déclare (44) avoir une suspicion de code malveillant lorsque le serveur mandataire détermine que le fichier tente de s envoyer lui-même en tant que partie d un courrier électronique. 2. Procédé selon la revendication 1, dans lequel le serveur de courrier électronique et le serveur mandataire adhèrent au protocole SMTP. 3. Procédé selon la revendication 1, comprenant en outre, en réponse à l étape de déclaration, l étape d envoi (46) d un message à un utilisateur de l ordinateur client. 6

7 11 EP B Procédé selon la revendication 3, dans lequel le message donne à l utilisateur une pluralité de choix, comprenant au moins un choix dans le groupe de choix suivants : empêcher le fichier de s envoyer lui-même par courrier électronique ; mettre le fichier en quarantaine ; permettre au fichier d envoyer des fichiers joints de courrier électronique ; et toujours permettre au fichier d envoyer des fichiers joints de courrier électronique.. Procédé selon la revendication 4, comprenant en outre, lorsque l utilisateur choisit de mettre le fichier en quarantaine, l étape de chiffrement du fichier et d envoi du fichier à une société de logiciel antivirus. 6. Procédé selon la revendication 1, comprenant en outre, en réponse à l étape de déclaration, l étape de transmission d une alarme à chaque ordinateur dans une entreprise associée à l ordinateur client. 7. Procédé selon la revendication 1, comprenant en outre, en réponse à l étape de déclaration, l étape de révocation de la déclaration de suspicion lorsque le fichier contient une signature numérique et que la signature numérique est vérifiée. 8. Procédé selon la revendication 1, dans lequel l étape de détermination comprend les étapes secondaires consistant à : décomposer le courrier électronique en parties constitutives ; et déterminer que le fichier tente de s envoyer luimême lorsqu une réplique du fichier est détectée dans l une des parties constitutives Procédé selon la revendication 1, dans lequel le fichier tente de s envoyer lui-même en tant que partie d un fichier joint de courrier électronique. 14. Dispositif (31) pour détecter la présence d un code informatique malveillant dans un courrier électronique envoyé par un ordinateur client (1) à un serveur de courrier électronique (2), ledit dispositif comprenant : un serveur mandataire résidant dans l ordinateur client, ledit serveur mandataire comprenant : un module de redirection (36) adapté pour intercepter des courriers électroniques envoyés de l ordinateur client au serveur de courrier électronique ; et caractérisé par, un module de gestionnaire de balayage (32) couplé au module de redirection, adapté pour déterminer si un fichier (30) dans l ordinateur client tente de s envoyer lui-même en tant que partie d un courrier électronique. 1. Dispositif selon la revendication 14, comprenant en outre, couplé au module de gestionnaire de balayage, un module de décomposition (33) adapté pour : décomposer un courrier électronique en parties constitutives ; et déterminer que le fichier tente de s envoyer luimême en tant que partie d un courrier électronique lorsqu un deuxième fichier qui ne varie pas du premier fichier de plus d un octet par rapport à un nombre d octets de seuil présélectionné est détecté dans l une des parties constitutives. 9. Procédé selon la revendication 1, dans lequel l étape de détermination comprend la comparaison, par le serveur mandataire, d une version du fichier provenant de l ordinateur client avec une version du fichier provenant du serveur mandataire.. Procédé selon la revendication 9, dans lequel une suspicion qu un code malveillant est présent dans le fichier est déclarée lorsque les deux versions ne varient pas de plus d un octet par rapport à un nombre d octets de seuil présélectionné Support pouvant être lu par un ordinateur contenant des instructions de programme informatique, qui, lorsqu elles sont exécutées par un processeur, effectuent le procédé selon l une quelconque des revendications 1 à Signal électrique transportant des instructions pouvant être mises en oeuvre par un processeur pour commander un processeur lorsqu elles sont exécutées pour effectuer toutes les étapes d un procédé selon l une quelconque des revendications 1 à Procédé selon la revendication, dans lequel le nombre de seuil présélectionné est Procédé selon la revendication 1, dans lequel le fichier tente de s envoyer lui-même en tant que partie d un corps de courrier électronique. 7

8 EP B1 8

9 EP B1 9

10 EP B1

11 EP B1 11

12 EP B1 REFERENCES CITED IN THE DESCRIPTION This list of references cited by the applicant is for the reader s convenience only. It does not form part of the European patent document. Even though great care has been taken in compiling the references, errors or omissions cannot be excluded and the EPO disclaims all liability in this regard. Patent documents cited in the description WO A [000] WO A [0006] GB A [0007] WO A [0008] 12