Kernel Level Anti-Spyware Using Device Stack Lock Strategy

This paper is devoted to design and implement an Anti spyware software package. The targeted type is the kernel level spyware which is the most dangerous threat due to the capabilities granted to the spyware code injected in this level. Kernel level is the most trusted level and the code executed at this level will have accessibility to all system resources. This paper will introduce a methodology to lock device stack for any attaching of malicious filter driver, spyware is using filter driver as the main weapon to intercept data exchanged by system devices (physical, logical or virtual) and the I/O manager. The paper interduces also, a locking methodology for the device stack is presented and all kernel level APIs are explained. The ‘keyboard’ is the target stack to be locked against famous attack of keyboard logger

A generic anti-spyware solution by access control list at kernel level

Spyware refers to programs that steal the user information stored in the user's computer and transmit this information via the Internet to a designated home server without the user being aware of this transmission. Existing anti-spyware solutions are not generic and flexible. These solutions either check for the existence of known spyware or try to block the transmission of the private information at the packet level. In this paper, we propose a more generic and flexible anti-spyware solution by utilizing an access control list in kernel mode of the operating system. The major difference between our approach and the existing approaches is that instead of asking a guard to look for the theft (spyware) or control the exit of the computer (and hence giving the spyware enough time to hide the information to be transmitted), we put a guard besides the treasure (the private information) and carefully control the access to it in the kernel mode. We also show the details of an implementation that realizes our proposed solution. © 2004 Elsevier Inc. All rights reserved.link_to_subscribed_fulltex