BLADE: an attack-agnostic approach for preventing drive-by malware infections

Web-based surreptitious malware infections (i.e., drive-by downloads) have become the primary method used to deliver malicious software onto computers across the Internet. To address this threat, we present a browserindependent operating system kernel extension designed to eliminate driveby malware installations. The BLADE (Block All Drive-by download Exploits) system asserts that all executable files delivered through browser downloads must result from explicit user consent and transparently redirects every unconsented browser download into a nonexecutable secure zone on disk. BLADE thwarts the ability of browser-based exploits to surreptitiously download and execute malicious content by remapping to the filesystem only those browser downloads to which a programmatically inferred user-consent is correlated, BLADE provides its protection without explicit knowledge of any exploits and is thus resilient against code obfuscation and zero-day threats that directly contribute to the pervas...

• Type: Conference
• Year: 2010
• Where: CCS
• Authors: Long Lu, Vinod Yegneswaran, Phillip A. Porras, Wenke Lee
• Keywords: Browser Downloads, CCS 2010, Download, Drive-by, Security Privacy