Intel Corporation

Mcafee, Inc.

University of Massachusetts

Xiaoning Li

Ravi L Sahita

Lixin Lu

Vedvyas Shanbhogue

Jason W Brandt

Mingwei Zhang

Mingqiu Sun

Lu Deng

Manohar Ruben Castelino

Yuriy Bulygin

Chunhui Zhang

David M Durham

Sanjeev N Trika

Karanvir S Grewal

Geoffrey Cooper

Abhay Kanhere

John Richard Guzik

Yi Gai

Chih-Yuan Yang

Alexander Shepsen

Aravind Subramanian

Benjamin Boyer

Xiang Xu

Liangjun Huang

Hua Liu

Kai Huang

William Wager

Nathan Bixler

Gilbert A Neiger

Siddhartha Chhabra

Uday R Savagaonkar

Prashant Dewan

Barry E Huntley

Baiju V Patel

Michael Lemay

H Peter Anvin

James B Crossland

David A Koufaty

Michael A Goldsmith

Jason Martin

Asit K Mallick

Ofer Levy

Ido Ouziel

Adrian R Pearson

Faraz A Siddiqi

James S Coke

Toby Opferman

Xiaozhu Kang

Vincent Martin Rotello

Atul A Khare

Bing Sun

Bradley P Duncan

Paul S Schmitz

John M Esper

Haifei Li

Brian L Vajda

Rodrigo Rubira Branco

John R Guzik

Geoffrey H Cooper

Technologies for untrusted code execution include a computing device having a processor with sandbox support. The computing device executes code included in a native domain in a non-privileged, native processor mode. The computing device may invoke a sandbox jump processor instruction during execution of the code in the native domain to enter a sandbox domain. The computing device executes code in the sandbox domain in a non-privileged, sandbox processor mode in response to invoking the sandbox jump instruction. While executing in the sandbox processor mode, the processor denies access to memory outside of the sandbox domain and may deny execution of one or more prohibited instructions. From the sandbox domain, the computing device may execute a sandbox exit instruction to exit the sandbox domain and resume execution in the native domain. The computing device may execute processor instructions to configure the sandbox domain. Other embodiments are described and claimed.

Technologies for untrusted code execution with processor sandbox support

A processor includes an execution unit and a processing logic operatively coupled to the execution unit, the processing logic to: enter a first execution state and transition to a second execution state responsive to executing a control transfer instruction. Responsive to executing a target instruction of the control transfer instruction, the processing logic further transitions to the first execution state responsive to the target instruction being a control transfer termination instruction of a mode identical to a mode of the processing logic following the execution of the control transfer instruction; and raises an execution exception responsive to the target instruction being a control transfer termination instruction of a mode different than the mode of the processing logic following the execution of the control transfer instruction.

Mode-specific endbranch for control flow termination

A malicious object detection system for use in managed runtime environments includes a check circuit to receive call information generated by an application, such as an Android application. A machine learning circuit coupled to the check circuit applies a machine learning model to assess the information and/or data included in the call and detect the presence of a malicious object, such as malware or a virus, in the application generating the call. The machine learning model may include a global machine learning model distributed across a number of devices, a local machine learning model based on use patterns of a particular device, or combinations thereof. A graphical user interface management circuit halts execution of applications containing malicious objects and generates a user perceptible output.

Malicious object detection in a runtime environment

Embodiments of this disclosure are directed to an execution profiling handler configured for intercepting an invocation of memory allocation library and observing memory allocation for an executable application process. The observed memory allocation can be used to update memory allocation meta-data for tracking purposes. The execution profiling handler can also intercept indirect branch calls to prevent heap allocation from converting to execution and intercept exploitation of heap memory to block execution.

Detecting data corruption by control flow interceptions

Particular embodiments described herein provide for an electronic device that can be configured to receive data related to execution of a sandboxed process, determine if a high privileged process was created by the sandboxed process, and block the sandboxed process from executing if the high privileged process was created by the sandboxed process and the data indicates the sandboxed process is attempting a sandbox bypass attack. In an example, the high privileged process was created by the sandboxed process if a resource folder is associated with a sandbox folder. In another example, the high privileged process was created by the sandboxed process if a resource folder was created by a broker process in response to a request by the sandboxed process.

System and method to detect bypass of a sandbox application

Technologies for hardware assisted native malware detection include a computing device. The computing device includes one or more processors with hook logic to monitor for execution of branch instructions of an application, compare the monitored branch instructions to filter criteria, and determine whether a monitored branch instruction satisfies the filter criteria. Additionally, the computing device includes a malware detector to provide the filter criteria to the hook logic, provide an address of a callback function to the hook logic to be executed in response to a determination that a monitored branch instruction satisfies the filter criteria, and analyze, in response to execution of the callback function, the monitored branch instruction to determine whether the monitored branch instruction is indicative of malware. Other embodiments are also described and claimed.

Technologies for hardware assisted native malware detection

In one embodiment, a processor comprises: a first register to store a first bound value for a stack to be stored in a memory; a second register to store a second bound value for the stack; a checker logic to determine, prior to an exit point at a conclusion of a function to be executed on the processor, whether a value of a stack pointer is within a range between the first bound value and the second bound value; and a logic to prevent a return to a caller of the function if the stack pointer value is not within the range. Other embodiments are described and claimed.

Attack protection for valid gadget control transfers

In one embodiment, a system comprises a processor to, in response to a determination that a write command is suspect, identify a logical address associated with the write command; and send a checkpoint command identifying the logical address to a storage device to preserve data stored in the storage device at a physical address associated with the logical address.

Method and apparatus for range based checkpoints in a storage device

Technologies for managed code execution include a computing device having a processor with protection key support. The computing device sets a protection key register of the processor with permissions to disallow data access to any protection domain of the computing device and then executes a domain switch routine to switch to a managed applet. The managed applet is included in an applet protection domain, the domain switch routine is included in a switch protection domain, and a managed runtime environment is included in a normal protection domain. The domain switch routine sets the protection key register with permissions to disallow access to any protection domain other than the applet protection domain and then executes the managed applet. Other managed applets may be each be included in separate applet domains. Each managed applet may be a thread executed within a common process address space. Other embodiments are described and claimed.

Technologies for protecting dynamically generated managed code with protection domains

A stabilized microcapsule includes a liquid hydrophobic core including an essential oil and an aromatic monoaldehyde, and a shell encapsulating the core, the shell including a plurality of amino-functionalized inorganic nanoparticles. Also disclosed is a dispersion including a plurality of the stabilized microcapsules. The microcapsules and dispersions can be particularly useful for treating a bacterial biofilm.

Nanoparticle-stabilized microcapsules, dispersions comprising nanoparticle-stabilized microcapsules, and method for the treatment of bacterial biofilms

Growing community of inventors

Hillsboro, OR, United States of America

Xiaoning Li