Mitigation of cyber attacks by pointer obfuscation

摘要

A method for protecting a computer includes identifying a first pointer in a data structure used by a computer program indicating a first memory address to be accessed, using the pointer, in order to invoke a functionality of the computer. The identified first pointer is replaced with a second pointer indicating a second memory address, different from the first memory address. A security program module traps attempts to access the second memory address during execution of the computer program so as to foil unauthorized access to the functionality of the computer.

主权项

1. A method for protecting a computer when loading a computer program into a memory for execution by the computer and creating a data structure for the computer program, comprising:
executing a pointer handling module which when loading a computer program into a memory for execution by the computer, and before execution of the computer program, performs:
identifying a first pointer in the data structure created for the computer program, the first pointer indicating a first memory address which can be used to access operating system functions and accordingly is considered to be vulnerable;replacing the identified first pointer in the created data structure for the loaded computer program with a second pointer selected to initiate an exception when accessed; configuring the computer such that when the second pointer is accessed, control is transferred to a security program module in two steps, a first step in which the computer attempts to access a memory location indicated by the second pointer, causing an exception, and a second step in which an exception handling function transfers control to the security program module; initiating execution of the computer program after replacing the first pointer; and determining, by the security program module when invoked, whether an access to the second pointer which invoked the security program module is a possible unauthorized access to the functionality of the computer.