KR101563657B1 - Method for sending data escape windows practical sandboxing - Google Patents

Abstract

The present invention relates to a method for transmitting data to the outside of a sandboxed window application program which enables a sub party module injected into an operating process in a sandbox to transmit data to the outside of the sandbox. The method for transmitting data to the outside of a sandboxed window application program according to the present invention comprises the following steps of: searching a state in an operating module injected into a target process in target process context; attempting to transmit data through a loopback socket opened to the outside; setting a location of data in a memory area sharable with a kernel; ending control if a process is generated and bringing the location of the data to a memory shared in the kernel if a target process ends; converting context from the target process context to system process context; and transmitting data to the outside of the sandboxed window application program in the converted system process context.

Description

{Method for sending data escape windows practical sandboxing}

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to data transmission outside a Windows application program, and more particularly to a method of data transmission outside a sandboxed window application.

In general, security programs perform a desired operation by injecting a protection module into a monitoring target process (injecting a desired dll into a specific process in an external process) in order to monitor or block the behavior of a specific process on the Windows OS. Although the kernel can monitor and block the behavior of a specific process, it can only do a large part of file-system-related, network-related, registry-related, etc. operations. Injection is generally performed to perform the operation.

In this case, if the protection module is injected into the target process and is in operation, it is definitely necessary to leave related information on the disk as a file during monitoring, or to transmit information to a service process being executed simultaneously. At this point, the protection module will create a file on disk using a file creation function such as fopen or CreateFile to leave information on the disk.

You can use pipes, sockets, messages, shared memory, etc. to transfer information directly to other processes.

Since there is no restriction on the authority problem in the case of the general process, there is no difficulty in leaving the information using the above methods by the injection of the protection module which is injected into the process.

However, not all processes operate with normal permissions. In particular, processes that are the subject of exploitation attacks, such as Internet Explorer, Chrome, and Adobe Reader, are trapped in a so-called Sandbox technology.

For example, when a vulnerability attack occurs, the attack usually downloads malicious code from the external server to perform a malicious action.

However, processes inside the sandbox may be denied by the sandbox, such as writing files to the disk, accessing other processes, and so on. In other words, even if the vulnerability allows the hacker to execute the desired code in the process, the malicious code will not be able to perform the desired operation, which will eventually cause the hacker's attack to fail.

This sandbox technology is designed to prevent vulnerability attacks, but for security program developers, it becomes a serious hurdle when these sandboxes transfer data from the protection module to the outside world.

For example, suppose a protection module is being injected to monitor the behavior of Internet Explorer and block malicious activity. At this time, Internet Explorer performs a specific action, and the protection module catches this action and attempts to transmit related information to the service process. However, since Internet Explorer is a process that is trapped by a sandbox and the protection module is also injected into Internet Explorer, our protection module also sends related information out of the sandbox The act of failure is to fail.

If the protection module can not retrieve the desired contents in the target process and can not extract the information outside the target process, there is a problem that the product can only be seen as a serious functional error.

Korean Patent Publication No. 10-2013-0132859- "Security Sandbox"

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems of the conventional art, and it is an object of the present invention to provide a sandboxed window in which a third party module injected into a process in the sandbox can transfer data to the outside of the sandbox And to provide a method of transmitting data to the outside of an application program.

According to another aspect of the present invention, there is provided a method of transferring data to a sandboxed window application program, the method comprising the steps of: detecting a status of a target process in a target process; Attempting to transmit data through an externally open loopback socket to transmit status related information of the module to the outside; Setting a location of data in a memory area that can be shared with the kernel if data transmission through the loopback socket fails; If the malicious action is detected, the process is terminated and the process callback routine checks whether the callback routine is called or terminated. If the process is generated, If the target process is terminated, fetching a data location from a memory shared by the kernel to start an operation for transferring data to the kernel in the kernel; Generating a system thread to execute code responsible for a data transferring part and calling a context from the target process context to a system process context; And transmitting data to the outside of the sandboxed window application program in the switched system process context.

In this case, when the connection to the loopback socket is successful, the method further includes transmitting data to the loopback socket to complete data transmission to the outside of the target process and terminating the process.

The step of obtaining the process environment block (PEB) address of the target process is characterized in that the process fails to escape using the loopback socket or the data transfer to the outside of the target process fails (False).

On the other hand, when the process termination is started, control is passed to the process callback routine registered in advance in the kernel. The callback routine can be registered by the developer directly. This is a callback function to be called each time a new process is executed or terminated in the window environment .

Also, if address information having data to be transferred to the outside is fetched from the PEB structure, and address information having data to be transferred is fetched from the PEB structure before the process termination is started, In a region of the substrate.

Here, the step of generating a system thread to execute a code that carries a data transferring part is for executing a data transfer code, which is trapped in a sandbox and deviates from the context of a target process in operation, And to execute the code by creating a system thread to switch the context in order to be outside the box.

And transferring data to the outside of the sandboxed window application in the switched system process context comprises at least one of a loopback socket, a file creation, a pipe connection, and a message delivery.

The present invention has the following effects.

First, in the sandboxed process, we set up address information that contains data to be sent out to member variables that are not used in the PEB structure, and create a process to capture when the process is created in the process callback routine in the kernel, If the system thread is created by executing the code to transfer data to the outside, the injected third party module can transfer the data to the outside of the sandbox to the process running in the sandbox.

Second, data can be transferred to the outside at the end of the process or in the middle of the process operation.

Third, it can provide a user-friendly process by leaving a product log or notifying the user.

FIG. 1 is a flowchart illustrating a method of transmitting data out of a sandboxed window application program according to the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

In addition, although the term used in the present invention is selected as a general term that is widely used at present, there are some terms selected arbitrarily by the applicant in a specific case. In this case, since the meaning is described in detail in the description of the relevant invention, It is to be understood that the present invention should be grasped as a meaning of a term that is not a name of the present invention. Further, in describing the embodiments, descriptions of technical contents which are well known in the technical field to which the present invention belongs and which are not directly related to the present invention will be omitted. This is for the sake of clarity of the present invention without omitting the unnecessary explanation.

First, there are two major considerations in the invention.

First, the implementation is done using only the official method provided by Windows environment. Usually, people who bug hunts to escape from the sandbox find themselves vulnerable to the sandbox and escape. However, this is not an officially provided function in Windows, but it is an attack using a vulnerability, so Windows will prevent the vulnerability from being able to escape the sandbox. Therefore, it is generally implemented using only the functions provided by Windows so that developers can use them when developing products.

Second, it is assumed that no data can be transmitted to the outside in the sandbox. Currently, some special functions provided by Windows can be used to transfer data to outside the sandbox, and in some cases, transmission is possible due to a data transfer function that is not thought of by Windows. For example, in the sandbox function in Windows 7, data can be transferred outside the sandbox using a loopback socket, but in the sandbox function provided in Windows 8, data transfer to the outside is not possible even with a loopback socket. If you are using this non-persistent way to send data out of the sandbox, you might be in serious trouble to change the product design itself if you block that feature in the next version of Windows. Therefore, in the first place, it is assumed that no data can be transmitted outside in the sandbox.

Now, a method for transferring data out of a sandboxed window application will be described with reference to FIG.

The method of transmitting data to the outside of the sandboxed window application program according to the present invention is as shown in FIG. 1. In FIG. 1, a green square represents a target process context and a system process context ). In this case, orange is the code executed in the user area and blue is the code executed in the kernel area.

First, in the target process context, Detect Status (S100) is a state in which a certain state is detected in an active module due to injection into a target process.

And the Connect loopback socket (S110) tries to connect to an open loopback socket to send the related information to the outside. That is, the first attempt is made to transmit data using a loopback socket. Until Windows 7, it was possible to escape the sandbox this way.

If the connection to the external loopback socket is successful, the send data to loopback socket (S120) completes the data transmission to the outside of the target process by sending the relevant data to the loopback socket, (Terminate Process) (S130).

If either the loopback socket or the data transfer to the target process fails (False), ie if either the "connect loopback socket" or the "send data to loopback socket" fails, the PEB block address (Get PEB (S140)).

The set data pointer to unused member within PEB (S150) is a process for setting address information including data to be transmitted to an unused member variable of the obtained PEB structure. The reason for putting the address information including the data to be transferred to the external member variable in the PEB is that the structure information sharing the address information between the user and the kernel is the PEB. At this time, the location of the data is set in a memory area that can be shared with the kernel.

Start Terminate Process (S160) starts the process termination because it is no longer necessary to execute the target process when a malicious action is detected.

The call CreateProcessNotify Routine (S170) is controlled by the process callback routine registered in advance in the kernel when the process termination is started. The callback routine can be registered directly by the developer, which is a callback function that is called each time a new process is executed or terminated in a Windows environment.

Check CreateProcess Status (S180) checks whether the current callback routine is called when the process is created or terminated. If the process is created, you can finish the process without any processing. On the other hand, if the process is terminated, you need to start working on the outside to transfer data to the kernel.

The PEB (S190) sets the address information having the data to be transmitted to the external member in the PEB internal member variable before starting the process termination in the user area. This part sets the address information to the PEB structure member Variables, that is, parts of the kernel that take data locations from a shareable memory. This behavior is possible because the PEB structure address information has the same address between the user and the kernel.

If the set data pointer to kernel global area (S200) is fetched from the PEB structure with address information having data to be transmitted to the outside, the address is stored in the global variable area so that the address can be accessed globally in the kernel.

The Create system thread (S210) now creates a system thread to execute the code responsible for the data transferring part in order to transfer (escape) the data to the outside. At this time, the program is terminated in the target process context (S220). The reason for creating a system thread to transfer data to the outside is to execute the data transfer code out of the context of the target process that is trapped in the sandbox and is in operation. Considering the second of the two above considerations, we assume that no data can be transferred out of the sandbox, so the code that transfers data to the outside must never be executed inside the sandbox, To send code out of the sandbox itself, we create a system thread to switch the context and execute the code.

Connect loopback socket (S230) is a system process context that is currently out of the sandbox, so if you try to connect to a loopback socket it will not fail and connect properly. This approach is a second attempt using a loopback socket, which allows data transfer to the outside of sandboxed Windows applications up to Windows 10 when using this approach. On the other hand, there is no need to transfer data using only sockets, since not only the loopback socket connection but also the data transfer operations that were not performed in the sandbox such as file creation, pipe connection, message transfer, will be.

The send data to loopback socket (S240) transmits the data to be sent out to the socket when the loopback socket is successfully connected.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it should be understood that various changes and modifications will be apparent to those skilled in the art. Obviously, the invention is not limited to the embodiments described above. Accordingly, the scope of protection of the present invention should be construed according to the following claims, and all technical ideas which fall within the scope of equivalence by alteration, substitution, substitution, Range. In addition, it should be clarified that some configurations of the drawings are intended to explain the configuration more clearly and are provided in an exaggerated or reduced size than the actual configuration.

Claims (7)

Detecting a state in a module that is in operation and subject to a target process injection in a target process context;
Attempting to transmit data through an externally open loopback socket to transmit status related information of the module to the outside;
Setting a location of data in a memory area that can be shared with the kernel if data transmission through the loopback socket fails;
If a malicious action is detected, the process is started by terminating the target process and checking whether the process callback routine is called when the process callback routine is called or when the process callback routine is terminated. If the target process is terminated, fetching a data location from a memory shared by the kernel to start a task for data transfer to the outside in the kernel;
Generating a system thread to execute code that is responsible for the data transferring part, and converting the context from the target process context to the system process context; And
And transferring data to the outside of the sandboxed window application program in the switched system process context. The method according to claim 1,
If the connection with the loopback socket is successful, sending the related data to the loopback socket to complete data transmission to the outside of the target process and terminating the process. A method of transferring data out of a Windows application. The method according to claim 1,
Wherein the step of obtaining the PEB (Process Environment Block) address of the target process is a failure of escape using a loopback socket or a failure of data transmission to the outside of the target process (False) / RTI > The method according to claim 1,
When the process is terminated, control is transferred to a process callback routine registered in advance in the kernel. The process callback routine can be directly registered by the developer. In this case, when a new process is executed or terminated in a window environment, Wherein the method comprises the steps of: The method of claim 3,
If address information having data to be transmitted to the outside is fetched from the PEB address, address information having data to be transmitted to the outside is fetched before starting the process termination. If the address information is fetched from the PEB address, Said method comprising the steps of: storing said data in a region of said window; The method according to claim 1,
Wherein the step of generating a system thread to execute a code for carrying out the data transferring step comprises:
It is intended to run the data transfer code out of the context of the target process, which is trapped in the sandbox, to execute the code by creating a system thread to switch the context outside of the sandbox itself, A method of transmitting data out of a sandboxed window application program. The method according to claim 1,
Wherein transferring data to the outside of the sandboxed window application in the switched system process context comprises:
A loopback socket, a file creation, a pipe connection, and a message delivery. ≪ Desc / Clms Page number 13 >

Images