Symantec Corporation

Rui Jing

Joseph Chen

Xue Tian

Yuan Liu

Jinghao Li

Rong Zhou

James Hung

The present disclosure relates to systems and methods for blocking an infection vector. In some embodiments, a method may include detecting, at a first device, a synchronization event with a second device, the first device and the second device operating with a proprietary mobile operating system. In some examples, the method may include recognizing, by the first device, that the first device is attempting to send a data package to the second device, and identifying the data package as malware. The method may further include blocking the data package from being received at the second device based at least in part on the identifying.

Proactive protection of mobile operating system malware via blocking of infection vector

A computer-implemented method for detecting malware is described. In some embodiments, the method includes identifying an application identifier of a first application paired with a universal resource locator (URL) scheme, and storing the identified pairing of the application identifier and URL scheme of the first application in a database. In some cases, the database stores URL scheme pairings of a plurality of applications. In some embodiments, the method includes identifying an application identifier of a first application paired with a universal resource locator (URL) scheme, identifying a second application as an unknown application, detecting a request to register a URL scheme pairing of the second application, querying the database based on the request to register the URL scheme pairing of the second application, and determining whether the second application is potential malware based on a result of the querying.

Detecting URL scheme hijacking

A computer-implemented method for detecting display-controlling malware may include (1) identifying a software program that is controlling a display of the computing device, (2) detecting one or more measures taken by the software program to prevent loss of control of the computing device display, (3) performing an analysis of the software program that may include determining, based on the measure taken by the software program to prevent loss of control of the computing device display, that the software program is suspicious and possibly includes display-controlling malware, and (4) performing a security action in response to determining that the software program is suspicious and possibly includes display-controlling malware. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting display-controlling malware

A computer-implemented method for protecting virtual machine program code may include (1) identifying one or more software program functions developed for execution in a virtual machine to be protected against reverse engineering, (2) converting one or more of the software program functions to native code for the computing device, (3) obtaining a memory address of one or more virtual machine functions, (4) generating one or more at least partially random alphanumeric values to identify the memory address of the virtual machine functions, (5) invoking the converted native code using a native code interface for the virtual machine, and (6) invoking one or more of the virtual machine functions from the converted native code using the alphanumeric value. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting virtual machine program code

A computer-implemented method for identifying suspicious text-messaging applications on mobile devices may include (1) identifying at least one outgoing text message on a mobile device, (2) analyzing at least one attribute of the outgoing text message identified on the mobile device, (3) determining that the outgoing text message is illegitimate based at least in part on analyzing the attribute of the outgoing text message, (4) identifying, in response to the determination, a suspicious text-messaging application that created the illegitimate outgoing text message on the mobile device, and then (5) performing, in response to the determination, at least one security action on the suspicious text-messaging application to prevent the suspicious text-messaging application from creating additional illegitimate text messages on the mobile device. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for identifying suspicious text-messaging applications on mobile devices

A computer-implemented method for detecting malicious digitally-signed applications. The method may include 1) identifying an application package file that has been digitally signed, wherein the application package file is used to distribute an application, 2) comparing the application package file to a set of known application package files, 3) determining that the application package file has been repackaged from a known application package file, 4) comparing a public key associated with a digital signature of the application package file to a public key associated with a digital signature of the known application package file, 5) determining that the public key associated with the digital signature of the application package file and the public key associated with the digital signature of the known application package file are different, and 6) performing a security action on the application. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Los Angeles, CA, United States of America

Rui Jing