Patent Grant
11947666
The invention relates to the field of cyber defense, and more specifically to browser and other JavaScript enabled applications exploit prevention and malicious code neutralization
Typically, cyber-attackers employ unknown advanced malware and zero-day vulnerabilities exploits. Most existing cyber defense technologies rely heavily on signature-based detection for known threats, or signatureless technologies, such as static Indicators of Compromise (IOCs) tactics or dynamic approaches such as machine learning-enabled behavioral and anomaly analytics, sandboxing, and deception. Even more advanced solutions are enabled by different Moving Target Defense (MTD) tactics.
However, most current cyber defense techniques practically fail to prevent, protect or even detect and remediate most of the advanced threats, as malicious players employ state-of-the-art evasive techniques, and keep a step ahead in this cat and mouse game.
Furthermore, in the last few years, browsers, JavaScript engines, and other applications using JavaScript (e.g., Facebook, WhatsApp, etc.) have become much more sophisticated, and this segment is expected to grow even further, as web applications become more and more common. Increasing levels of sophistication of applications require additional code to implement each new feature, which in turn increases the number of potential vulnerabilities and risk of malicious attacks.
Of the common JavaScript applications, web browsers are the most common attack targets. Known solutions for browser exploits exist at the operating system (OS) level, and thus must monitor browser processes from the OS level in order to detect malicious behavior. This approach has a significant flaw, as the ability to monitor and understand the high-level JavaScript logic of the browser, from a lower level, is limited. In addition, restricted devices, such as smart TVs, smartphones, and the like, cannot run those OS-level solutions, which further increases the prevalence of the browser as an attack vector. Accordingly, implementation of a cyber-defense solution at the JavaScript application level is of significant value.
The foregoing examples of the related art and limitations related therewith are intended to be illustrative and not exclusive. Other limitations of the related art will become apparent to those of skill in the art upon a reading of the specification and a study of the figures.
The following embodiments and aspects thereof are described and illustrated in conjunction with systems, tools and methods which are meant to be exemplary and illustrative, not limiting in scope.
There is provided, in an embodiment, a system comprising at least one hardware processor; and a non-transitory computer-readable storage medium having stored thereon program instructions, the program instructions executable by the at least one hardware processor to: receive, by an application capable of JavaScript execution, a code for execution, inject, before the execution, an intercepting code into the received code, wherein the intercepting code is configured to intercept all application programming interface (API) invocations by the received code, intercept, by the intercepting code, an API invocation by the received code, determine that the intercepted API invocation, and results in a manipulation of a backing store object, and modify an execution of the intercepted API invocation, wherein the modified execution results in a non-predictable memory layout.
There is also provided, in an embodiment, a computer-implemented method comprising: receiving, by an application capable of JavaScript execution, a code for execution; injecting, before the execution, an intercepting code into the received code, wherein the intercepting code is configured to intercept all application programming interface (API) invocations by the received code; intercepting, by the intercepting code, an API invocation by the received code; determining that the intercepted API invocation, and results in a manipulation of a backing store object; and modifying an execution of the intercepted API invocation, wherein the modified execution results in a non-predictable memory layout.
There is further provided, in an embodiment, a computer program product comprising a non-transitory computer-readable storage medium having program instructions embodied therewith, the program instructions executable by at least one hardware processor to: receive, by an application capable of JavaScript execution, a code for execution, inject, before the execution, an intercepting code into the received code, wherein the intercepting code is configured to intercept all application programming interface (API) invocations by the received code, intercept, by the intercepting code, an API invocation by the received code, determine that the intercepted API invocation, and results in a manipulation of a backing store object, and modify an execution of the intercepted API invocation, wherein the modified execution results in a non-predictable memory layout.
In some embodiments, the program instructions are further executable to store a mapping of the modified execution, and use the mapping to respond to read or write operations by the intercepted API. In some embodiments, the method further comprises storing a mapping of the modified execution, and using the mapping to respond to read or write operations by the intercepted API
In some embodiments, the injecting is performed by at least one of: a proxy server, a browser extension, and a privileged operating system agent.
In some embodiments, the application is a web browser, and the received code is a webpage.
In some embodiments, the modifying comprises at least one of: (i) encoding at least some randomly selected arguments in input data associated with the API invocation; (ii) dividing the input data into a random number of execution contexts; (iii) splitting the input data into a random number of subsets of the input data; (iv) padding at least some randomly selected arguments in the input data with random data of the same type; (v) adding a random number of inline properties to the input data, wherein the properties are as non-enumerable with a Symbol as the property key: (vi) allocating a random number of additional backing store objects.
In some embodiments, the at least some of the execution contexts are inline frames.
In some embodiments, the intercepted API invocation comprises creating a new JavaScript object, and wherein the dividing comprises: (i) splitting the input data into a random number of subsets of the input data; and (ii) creating, for each of the subsets, a separate the object within one of the different execution contexts.
In some embodiments, the intercepted API invocation comprises creating a new array object, wherein the input data comprises arguments associated with the array object, and wherein the dividing comprises: (i) splitting the input data into a random number of subsets of the input data; and (ii) creating, for each of the subsets, a separate array object within one of the different execution context.
In some embodiments, the mapping includes a location of each of the arguments within the different execution contexts.
In some embodiments, the intercepting comprises intercepting API invocations from all available execution contexts associated with the execution.
In some embodiments, the mapping comprises a reference to a location of each of the objects, and wherein the reference is freed upon the occurrence of a specified condition.
In some embodiments, the responding is performed by a proxy object.
In addition to the exemplary aspects and embodiments described above, further aspects and embodiments will become apparent by reference to the figures and by study of the following detailed description.
Exemplary embodiments are illustrated in referenced figures. Dimensions of components and features shown in the figures are generally chosen for convenience and clarity of presentation and are not necessarily shown to scale. The figures are listed below.
Disclosed herein is a technique, embodied in a system, method, and computer program product, for automated neutralizing of malicious code in a computer system. In some embodiments, the present disclosure provides for various approaches for exploit prevention and malicious code neutralization.
Typically, a malicious code, trying to exploit some sort of vulnerability in the browser, first needs to trigger the vulnerability, and then construct the necessary artifacts for successful exploitation, which in most cases is reflected in achieving code execution.
Typically, browser vulnerability exploitations—and especially those attempting to circumvent exploit mitigation techniques, such as address space layout randomization (ASLR) and/or data execution prevention (DEP)—require carefully constructed payloads, both for vulnerability triggering and for further exploitation. The most common artifact employed by browser exploits is the use of JavaScript (JS) typed array objects. The exploitation process thus depends heavily on the predictable behavior of application programming interfaces (APIs). For example, a given exploit may create an array to hold its shellcode payload pending execution. Under normal conditions, the array creation process results in predictable behavior, which means that the created array will hold its corresponding backstage JsArray object with a predictable offset between its nodes, or with predictable properties such as array length and/or type.
Accordingly, in some embodiments, the present disclosure provides for manipulating API invocations of the JavaScript engine, in JavaScript enabled applications, so that the effect of the original API calls on the underlying memory layout will be unpredictable. As an exemplary result, the present technique will cause an object created by malicious code to reside in unpredictable memory locations, within multiple execution contexts; have varying random properties, such as length and/or random node ordering, and/or other inline properties, such as random strings, random interrupts, INT3 instructions, and the like. In some embodiments, the present technique may provide for additional manipulations of the code, e.g., padding and/or encoding of the payload.
It is noted that the manipulated, or “chaotic” execution approach of the present disclosure applies to all executable code, legitimate and malicious alike. However, the chaotic execution prevents any malicious code that relies on the predictable behavior of API invocations from fulfilling its malicious intent. At the same time, because the present disclosure generates and stores a mapping between the original and manipulated, “chaotic,” execution parameters, to enable the present technique to return the intended values of all read operations of the input code. Thus, the present disclosure enables legitimate code to execute as intended.
In some embodiments, in order for API invocations to be manipulated, all native APIs are patched to enable their interception. Manipulation is preferably performed only on invocations that are used to create and/or manipulate back store objects. Manipulation is preferably performed in a randomized “chaotic” manner, and a mapping is generated and stored between the original and manipulated object. This way, valid code may refer to the mapping to get the intended values for all read/write operations, while malicious code that cannot rely, due to the manipulation, on a predictable memory layout/stored payload data, is neutralized as almost any vulnerability will not be triggered and any malicious payload will not execute.
In particular, a method in computing device is described herein. The method includes injecting Java Script agent (JSA) to a code, prior to, or upon, its receipt by an application capable of JavaScript execution; patching of all exposed native APIs on the application; intercepting all native API calls invoked by any JavaScript code in the current execution context; manipulating those of the intercepted API calls that are used for back store allocation and/or manipulation of user-controlled input, in a chaotic randomized manner, so that the effect of the original API call on the underlying memory layout/stored data will be unpredictable; generating and storing a mapping between the original and manipulated parameters; and using the generated mapping to respond and return the intended values to read/write operations by the intercepted API calls, so that complete functionality for the high-level code is maintained, while any code that relies on a predictable behavior of the process memory layout fails to fulfill any malicious intent. In some embodiments, the present disclosure may further create a proxy object that is returned to the original invocation and use the mapping to respond and return the intended value to read operations by the intercepted API calls so that complete functionality for the high-level code is maintained.
In one embodiment of the present method, the injection of the JSA may be performed by any means, for example, using:
In one embodiment of the present disclosure, the application is a web browser and at least some of the received code is a web page. In one embodiment of the present disclosure, the manipulation of input data may include different methods, including any combination of one or more of the following actions:
In one embodiment, at least some of the execution contexts are inline frames. In one embodiment of the present disclosure, intercepting API calls includes creating a new JavaScript object, and the manipulation comprises:
In one embodiment of the present disclosure, intercepting an API call includes generating a new array object, wherein the input data includes arguments associated with the array object, and wherein the manipulation includes:
In one embodiment of the present disclosure, the mapping includes a location of each of the arguments within the different execution contexts. In one embodiment of the present disclosure, intercepting API calls includes intercepting API invocations from all available execution contexts associated with the execution. In one embodiment of the present disclosure, the mapping includes a reference to a location of each of the objects, wherein the reference is freed in a completely random manner based our a unique seed upon the occurrence of a specified condition.
As indicated above, JavaScript exploits follow certain common patterns. The exploit writer typically attempts to build abstract primitives which grant freedom in corrupting memory, e.g., by gaining out-of-bounds (OOB) memory access and/or allowing to read or write data at the process memory address space. However, by creating a chaotic execution environment, the present method thwarts this ability, and the intended purpose of the malicious code cannot be effected. Specifically, because most if not all of these exploits rely on generating objects (e.g., arrays), storing raw byte code in memory, and/or freeing objects under specific conditions, by executing the API invocations in a chaotic and unpredictable manner, an attacker cannot rely on the results of the generated objects, and thus cannot carry out the attack as intended.
For example, in the case of a JavaScript typed array allocation using a relevant JavaScript API (an action that almost all browser exploits use when exploiting memory corruption), an attacker may rely on the layout of the allocated object for successful exploitation. Thus, in order to create a chaotic execution environment using the browser API, embodiments of the present disclosure provide for creating multiple execution contexts (e.g., via multiple inline frame objects), in a way that causes the browser to allocate multiple memory sections for the multiple contexts. Thus, when the executed code invokes the relevant JavaScript API (e.g., an array constructor) to allocate a new array, the present software agent (JSA) intercepts the invocation, and splits all of the original invocation arguments randomly into multiple arrays corresponding to the multiple execution contexts. In some embodiments, each argument may also be processed by, e.g., data padding, encoding, and/or otherwise. In one embodiment of the present disclosure, in the case of a malicious exploit code trying to allocate an array to hold its shellcode for further exploitation, the shellcode ends up residing in memory scattered across multiple different execution contexts while also being encoded with a random key, and thus prevented from executing its intended.
In another embodiment of the present disclosure, the method may prevent malicious code attempts to perform a buffer-overflow attack. Buffer overflow attacks occur when an attacker provides malformed input to a program that causes it to write the input incorrectly, to areas outside the allotted memory location. Direct overflow attacks try to overwrite the return pointer on the stack, and indirect attacks try to overwrite a function pointer on the heap that is later dereferenced. In this regard, JavaScript has a built-in “garbage collector” which controls all memory management. Thus, many browser vulnerabilities involve garbage collector memory management (e.g., use-after-free exploits). For example, a malicious code may try to exploit a use-after-free vulnerability in an Orinoco garbage collector for Chrome, by creating a special object that will be freed under special conditions by the garbage collector, and later accessed by the malicious code to trigger the vulnerability. Using the present method, this scenario will be impossible to execute, because each API trying to create any object is intercepted and executed in a chaotic manner, with the reference held by the present software agent mapping function. Thus, the malicious code would not be able to trigger the vulnerability, because the reference to that object will still be held rather than freed, and the garbage collector will not collect it.
In some embodiment of the present disclosure, it is performed in real time with no disruption or impact on performance and with no or minimal latency in the execution of the code and/or any program executing on the computer system, and in a way that cannot be discovered by the attacker.
In some embodiments of the present disclosure, it does not require malicious code detection in order to operate, and is performed without regard to whether the content received may be suspicious or not, and without the need for applying malware detection algorithms.
In one embodiment of the present disclosure, it is useful for restricted devices, due to the fact that it operates on the application level without the need to gain access to the OS.
Malicious code or malicious content, as these terms are used throughout this disclosure, refers to any content, code, or computer program instructions intended for a malicious purpose, such as exploit code. Malicious code may be configured to perform any surreptitious or malicious task, in a way unwanted and unknown to a user, including, for example, taking control of a computer, obtaining data from a computer, and the like.
In some embodiments, the disclosed methods may be implemented with respect to any content included in a file or any other received content, without regard to whether the content itself is deemed suspicious in advance of the present method being performed.
In some embodiments, however, one or more malware detection techniques may be implemented together with the exemplary embodiments in association with receiving received content and generating modified received content, but knowledge or awareness of suspected malicious or suspicious content is not required to disarm any malicious content that may be included in the received content.
Received content according to the disclosed embodiments may include any form of electronic content, including any file or other objects that may be downloaded, run, processed, opened, or executed by an application or operating system of the victim computer or computing device. Malicious content may be embedded among seemingly legitimate content. A file according to the disclosed embodiments may include any file or file-like content, such as an embedded object or script, that is processed, run, opened or executed by an application of a computing system. In some embodiments, the present disclosure provides a chaotic execution environment generating engine configured to run within a Java Script environment.
A system is also described herein, configured to employ the method described herein. The system includes one or more processing units and a memory coupled with one or more processing units. The memory stores program code for execution by one or more processing units. The program code includes a JavaScript agent, including several modules: a patcher configured to patch all exposed native APIs of current execution context, and a controller configured to intercept all API invocation of the wrapped APIs, and to further identify API invocations that are used for backing store allocation and/or manipulations of user-controlled input, and further refer these API invocation to a chaotic engine configured to manipulate the altering invocations—splitting and rearranging in few subsets, encoding, identifying the type of arguments, padding and diverting the manipulated invocation to multiple different contexts.
The controller is further configured to store a mapping between the original and manipulated object and to generate values to be returned to the original invocation, using the mapping, so that complete functionality for the high-level code is maintained; while any code that relies on a predictable behavior of the process memory layout, fails to fulfill any malicious intent. A computer program product including a non-transitory computer-readable storage medium having program code embodied therewith, the program code executable by at least one hardware processor to perform the method described herein. Example Systems and Methods for exploit prevention and neutralizing malicious code
Computer system 100 includes at least one hardware processor 102, at least one secondary storage device 104, network hardware 106, main memory 110, and communication infrastructure 108 interconnecting all the above.
System 100 may store in a non-volatile memory thereof, such as main memory 110 or another storage device, program instructions or components configured to operate hardware processor 102. In some embodiments, the software components may include an operating system, including various software components and/or drivers for controlling and managing general system tasks (e.g., memory management, storage device control, power management, etc.) and facilitating communication between various hardware and software components. The program instructions may include one or more software modules, such as JavaScript Agent (JSA) 146 and/or initializer 150.
Main memory 110 may be segmented into user space 112 and kernel space 114. Kernel space 114 may be reserved for storing and running operating system 116, and user space 112 may store and run application processes, such as browser process 120.
When a request is made by a browser for a web page, the request is transferred from the browser to the network stack 140, to network hardware driver 118, to network hardware 106, and the transferred to world-wide web 144, reaching target web server 142. The web page, including an external executable JavaScript code (input code), is received by the browser through network stack 140 and a browser process 120 initiated by the browser.
JavaScript engine 130 may then initiate an execution context 132. The web page is rendered 122, by different elements of the browser engine (e.g., HTML parser 126. CSS parser 128), and the JavaScript code is referred for execution by the JavaScript engine 130 (for example, V8 in chrome). The JavaScript Engine native APIs 134 may be invoked by a given input code with arguments for generation of a new Array. A native array constructor may be invoked, and creates a new array and fills it with the provided arguments in a predictable manner.
JavaScript engine 130 then generates the corresponding backing store array object (jsArray) 138 within process memory 136, and initializes it with the supplied arguments. As illustrated in
The API invocation returns the newly-generated array object with the initialized arguments. This predictable behavior, which means that this array holds its corresponding backing store jsArray object 138, with a predictable offset between its nodes and/or predictable properties such as length and/or type, may enable a given exploit process to generate an array to hold its shellcode payload before execution, and thus carry out its malicious intent without any hindering.
To prevent such exploit process from executing as intended, embodiments described herein manipulate certain aspects of JavaScript engine 130 during run time.
For example, a received web page may be first encountered by initializer 150. Initializes 150, which may be configured to perform one of more of the following tasks:
In some embodiments, the received code is then injected, upon or prior to its receipt by the browser, with a JavaScript Agent (JS) 146. Such interception and injection may be carried out by a proxy 148, connected to network 106. JSA 146 is injected at the top of the page received code, so that it is executed first by the Java Script engine. JSA 146 may be configured to identify and patch all native APIs exposed by the current execution environment, before any code is actually executed. Following the patching, JSA 146 may also be configured to intercept all API invocations and identify all API invocations associated with input data that may result in manipulation of a backing store object. JSA 146 may also be configured to further modify the altered APIs in a chaotic manner, so that the effect of API invocation on the memory layout will be unpredictable.
At the same time, JSA 146 may be configured to save the new arrangements to a mapping, and use the mapping to retrieve the original values. Thus, legitimate JavaScript code will work as intended, while any malicious code that relies on predictable behavior of process memory layout, fails to fulfil its malicious intent.
System 100 as described herein is only an exemplary embodiment of the present invention, and in practice may be implemented in hardware only, software only, or a combination of both hardware and software. System 100 may have more or fewer components and modules than shown, may combine two or more of the components, or may have a different configuration or arrangement of the components. System 100 may include any additional component enabling it to function as an operable computer system, such as a motherboard, data busses, power supply, a network interface card, etc. (not shown). Moreover, components of system 100 may be co-located or distributed, or the system may be configured to run as one or more cloud computing “instances,” “containers,” “virtual machines,” or other types of encapsulated software applications, as known in the art.
Such interception and injection may be carried out by a proxy 148, connected to network 106. Shown in
In some embodiments, JSA 146 may be configured to identify and patch all native APIs exposed by the current execution environment, before any code is actually executed. Thus, in some embodiments, a patcher 146a, which is a module of JSA 146, identifies and patches all exposed native APIs 220 in the current execution context, before any other code. Thus, from this point onward, all interactions between the received code and the native APIs are mediated by JSA 146, and any API invocation sees only the wrapped APIs 222. Thus, all API calls invoked by code 202 are intercepted by wrapped API 222 and referred to a controller 146b. In some embodiments, controller 146b will be invoked on each invocation of a native API, so as to replace it with the present wrapped API. Based on the invocation type, controller 146b may perform at least two of the following actions:
In some embodiments, patcher 146a may be invoked for every execution context (e.g., iFrame) within the execution environment. Thus, for example, at first patcher 146a will be invoked within the “top” context, as well as within any other nested execution context.
In some embodiments, patcher 146a may be applied within the two following two main categories:
In some embodiments, patcher 146a is configured to be invoked for every execution context, including any “top” context as well as any other nested executing context therein. In some embodiments, when the “top” and any nested execution context are of the same source, patcher 146a patching module will patch the nested execution context window objects within the same JSA execution context, i.e., without the need for re-executing the JSA in the nested execution context. However, in cases where the nested execution context is from a different source, e.g., “cross origin,” initializer 150 will re-inject the JSA in the nested execution context.
In some embodiments, patcher 146a will iterate on the vast majority of the native exposed APIs, and will replace the original native APIs with the present wrapped APIs, Wherein the wrapped APIs will invoke controller 146b on each invocation.
In some embodiments, patcher 146a may operate within two main categories:
In some embodiments, the present disclosure provides for further manipulations to ensure that the present wrapped APIs may not be detected, while maintaining full functionality. Thus, for example, the present disclosure may provide for storing, with respect to each wrapped API, in a special key-value mapping 146d, the wrapped API as the key and the original native API as the value. This may facilitate the locating of the native API based on the wrapped API, and allow the present disclosure to return the expected values for operations on the wrapped API, as shall further be explained below. For example:
All of these should return the expected value for each wrapped API, such that with respect to each invocation, the original native API may be retrieved via the mapping 146d and return the corresponding value for the native API, to be returned as the expected value. Thus, functionality transparency may be maintained for each of the wrapped APIs.
In some embodiments, following the patching, JSA 146 may also be configured to intercept all API invocations and identify all API invocations associated with input data that may result in manipulation of a backing store object. Thus, in some embodiments, controller 146b, which a module of JSA 146, diverts all API calls associated with input data that may result in manipulation of a backing store object, to a chaotic engine 146e, which manipulates the input data, and splits it into different contexts as it builds the backing store objects. This results in an unpredictable memory layout 226.
A mapping 146d of the manipulations applied to the API calls is generated and stored at controller 146b, which maps between the original and manipulated execution parameters. In some embodiments, a proxy object 146c is then created, which may be returned to the original code invocation, wherein the code sees the proxy-object as an array. All calls to indexes of this proxy object reach controller 146b, which returns the expected values to such read operations, by using mapping 146d. All attempts to add more nodes to the array again result in referring the call to the chaotic engine for manipulation.
Thus, complete functionality for the high-level code is maintained, as the proxy object returns the expected values for all read operations, while any code that relies on the predictable behavior of the underlying memory will fail due to the manipulations used by the process of generating the backing store objects.
Non-altering API invocations, e.g., API calls that are not used for back storing allocation and/or manipulation of user-controlled input, are documented and transferred by the controller 146b to the native API. In some embodiments, the controller 146b may be configured to block such API calls, based, e.g., on enterprise policy, and the like.
The program instructions of JSA 146, shown in
For illustrative purposes, the flowchart in
JavaScript Agent (JSA) 146, of
In some embodiments, in step 302, a received code may be executed by application 201, e.g., a received webpage may be rendered in a browser.
In some embodiments, exposed native APIs in the current execution context are identified and patched. For example, with reference to
In some embodiments, in step 304, the program instruction of system 100 may cause controller 146b, a module of JSA 146, to intercept all API invocations, which are now patched to wrapped APIs 222.
In some embodiments, controller 146b may be configured to intercept each invocation of a native API, and to replace is with wrapped APIs 222.
For example, in
In some embodiments, in step 306, those of the intercepted API invocations that are associated with input data that may result in manipulation of a backing store object, are identified and referred for manipulation. For example, with reference to
In some embodiments, in step 308, the program instruction of system 100 may cause chaotic engine 146e, a module of JSA 146, to perform chaotic manipulation of a referred API invocation. In some embodiments, such manipulation comprises any combination of one or more of the following:
For example, with reference to
In some embodiments, all the above-mentioned manipulation methods may be performed in a random manner. For example, splitting arguments into subsets may be done randomly, whereas the number of subsets and their lengths selected by JSA 146, e.g., by chaotic engine 146e, at random. In another example, the above steps of splitting to argument subsets, padding, and diverting into different execution contexts may be performed by chaotic engine 146e.
This disclosure will discuss extensively the example of a chaotic execution of JavaScript array objects creation and their execution in a chaotic environment of the present disclosure. However, array objects are only one example of objects which may be created and/or utilized by API invocations and may result is backing store allocation. Other, additional, and/or similar JavaScript objects and their associated API invocation and/or other service calls may be similarly executed within a chaotic execution environment, and thus result in unpredictable and/or unknowable layout of the process memory.
In some embodiments, the input argument may be divided or split into a plurality of splits or subsets. In some embodiments, the number of splits may be randomly selected by JSA 146, e.g., by chaotic engine 146e. In some embodiments, the split in performed in a random and arbitrary manner, wherein the number of subsets and their length in selected by JSA 146 e.g., by chaotic engine 146e, at random.
As can be seen in
In some embodiments, JSA 146, e.g., chaotic engine 146e, may further perform one or more of the following with respect to one or more for the splits:
In some embodiments, in the case of a web browser, JSA 146, e.g., chaotic engine 146e, may generate different inline frames (IFrames) for different contexts. An execution context may be understood as a wrapper object, which holds key details for processing a given method, such as variable object, window object, event queue, scope chain, etc. Forcing a web browser to create new iframes generates a new execution context for each split subset 402a-402c.
With reference back to
For example, with reference to
In some embodiments, mapping 146d is configured to maintain functionality of the execution environment, in view of the various chaotic manipulation applied to the executed code. For example, for each patched function, mapping 146d may store in a key-value map the patched function as the key, and the original native as the value. Thus, mapping 146d can enable to efficiently locate the native implementation based on the patching, and return the expected values for operations on the patched function. For example:
With reference back to
In some embodiments, a proxy object may be generated and returned to the invocation, so that a simple array variable holds this array, and all read operations are intercepted by the proxy object, which uses the mapping to retrieve the proper value, decode it, and return to the original invocation. The proxy object described here is an example of proxy object 146c in
The program instructions of JSA 146, shown in
In some embodiments, in step 702, when an API invocation for simpleArray creation is intercepted, such interception may be performed by wrapped API 222 in
In step 704, the invocation is identified as altering, i.e., results in backing store allocation, such identification may be performed by controller module 146b of
In step 706, the arguments of the invocations are encoded.
In step 708, the arguments are split and rearranged into a few groups, such split may be performed by chaotic engine 146e in
In step 710, arguments type is checked, and random padding of the same type is inserted between each argument, such padding may be performed by chaotic engine 146e of
In step 712, object references may be stored by JSA 146, such that the reference to that object will not be freed and the garbage collector will not collect it. In some embodiments, JSA 146 may also add inline properties to the created object, for example, by adding a random number of properties containing primitive values, and setting them as non-enumerable with a Symbol as the property key.
In step 714, each argument group may be diverted into different array objects generated in different contexts. Such diversion to different contexts may be performed by chaotic engine 146e of
In step 716, the new argument location (index and array object) may be stored in a mapping 146d, such mapping may be performed by chaotic engine 146e in
Finally, in step 718, the expected values with respect to read/write operations are returned to the original invocation, using the mapping. Thus, legitimate code is executed as intended, while any code that relies on the predictable behavior of the underlying memory fails to fulfill its malicious intent.
In some embodiments, a proxy object may be generated and returned to the invocation, so that a simple array variable holds this array, and all read operations are intercepted by the proxy object, which uses the mapping to retrieve the proper value, decode it, and return to the original invocation. The proxy object described here is an example of proxy object 146c in
The present invention may be a computer system, a computer-implemented method, and or a computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a hardware processor to carry out aspects of the present invention.
The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a Static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire. Rather, the computer readable storage medium is a non-transient (i.e., not-volatile) medium.
Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. A network adapter card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device.
Computer readable program instructions for carrying out operations of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, a field-programmable gate array (FPGA), or a programmable logic array (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present invention. In some embodiments, electronic circuitry including, for example, an application-specific integrated circuit (ASIC), may be incorporate the computer readable program instructions already at time of fabrication, such that the ASIC is configured to execute these instructions without programming.
Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and or block diagrams, can be implemented by computer readable program instructions.
These computer readable program instructions may be provided to a hardware processor of a general-purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart and/or block diagram block or blocks.
The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions/acts specified in the flowchart and/or block diagram block or blocks.
The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions.
In the description and claims, each of the terms “substantially,” “essentially,” and forms thereof, when describing a numerical value, means up to a 20% deviation (namely, ±20%) from that value. Similarly, when such a term describes a numerical range, it means up to a 20% broader range—10% over that explicit range and 10% below it).
In the description, any given numerical range should be considered to have specifically disclosed all the possible subranges as well as individual numerical values within that range, such that each such subrange and individual numerical value constitutes an embodiment of the invention. This applies regardless of the breadth of the range. For example, description of a range of integers from 1 to 6 should be considered to have specifically disclosed subranges such as from 1 to 3, from 1 to 4, from 1 to 5, from 2 to 4, from 2 to 6, from 3 to 6, etc., as well as individual numbers within that range, for example, 1, 4, and 6. Similarly, description of a range of fractions, for example from 0.6 to 1.1, should be considered to have specifically disclosed subranges such as from 0.6 to 0.9, from 0.7 to 1.1, from 0.9 to 1, from 0.8 to 0.9, from 0.6 to 1.1, from 1 to 1.1 etc., as well as individual numbers within that range, for example 0.7, 1, and 1.1.
The descriptions of the various embodiments of the present invention have been presented for purposes of illustration, but are not intended to be exhaustive or limited to the explicit descriptions. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.
In the description and claims of the application, each of the words “comprise,” “include,” and “have,” as well as forms thereof, are not necessarily limited to members in a list with which the words may be associated.
Where there are inconsistencies between the description and any document incorporated by reference or otherwise relied upon, it is intended that the present description controls.
This application is a continuation of U.S. application Ser. No. 17/575,139, filed on Jan. 13, 2022, which issued as U.S. Pat. No. 11,507,658 on Nov. 22, 2022, which is a continuation of International Application No. PCT/IL2021/051062, filed on Aug. 31, 2021, which claims priority to U.S. Provisional Patent Application No. 63/072,581, filed on Aug. 31, 2020. The disclosures of the above-referenced applications are expressly incorporated herein by reference in their entireties.
| Number | Name | Date | Kind |
|---|---|---|---|
| 5974549 | Golan | Oct 1999 | A |
| 8353767 | Borst et al. | Jan 2013 | B1 |
| 9253013 | Kolam et al. | Feb 2016 | B1 |
| 9582666 | Overson et al. | Feb 2017 | B1 |
| 9798524 | Colton | Oct 2017 | B1 |
| 9898537 | Leclerc | Feb 2018 | B2 |
| 20020062346 | Chen | May 2002 | A1 |
| 20040098715 | Aghera | May 2004 | A1 |
| 20040143564 | Gross | Jul 2004 | A1 |
| 20060248310 | Kavalam | Nov 2006 | A1 |
| 20080016339 | Shukla | Jan 2008 | A1 |
| 20100262487 | Edwards | Oct 2010 | A1 |
| 20120167121 | Reierson | Jun 2012 | A1 |
| 20130055266 | Gittelman | Feb 2013 | A1 |
| 20130212603 | Cooke et al. | Aug 2013 | A1 |
| 20140245196 | Zheng et al. | Aug 2014 | A1 |
| 20140282464 | El-Gillani | Sep 2014 | A1 |
| 20140283067 | Call | Sep 2014 | A1 |
| 20150106426 | Antipa | Apr 2015 | A1 |
| 20150304337 | Nguyen-Tuong | Oct 2015 | A1 |
| 20150319252 | Momchilov | Nov 2015 | A1 |
| 20160241560 | Reshadi | Aug 2016 | A1 |
| 20160359901 | Yang | Dec 2016 | A1 |
| 20170091428 | Johnson et al. | Mar 2017 | A1 |
| 20170169100 | Reshadi | Jun 2017 | A1 |
| 20170257385 | Overson et al. | Sep 2017 | A1 |
| 20180157827 | Kang et al. | Jun 2018 | A1 |
| 20180198807 | Johns | Jul 2018 | A1 |
| 20190342365 | Vysotsky | Nov 2019 | A1 |
| 20200409780 | Balasubramanian | Dec 2020 | A1 |
| 20210097174 | Mandal | Apr 2021 | A1 |
| 20210374241 | Parikh et al. | Dec 2021 | A1 |
| Entry |
|---|
| Nonfinal Office Action dated Apr. 6, 2022 for U.S. Appl. No. 17/575,286. |
| PCT International Search Report in counterpart Application No. PCT/IL2021/051062 dated Nov. 8, 2021 (3 pages). |
| PCT International Written Opinion in counterpart Application No. PCT/IL2021/051062 dated Nov. 8, 2021 (4 pages). |
| Extended Search Report for European Application No. 21860763.8 dated Feb. 2, 2024 (9 pages). |
| Marta Tasic, “Detecting Attacks using Program Alternatives, ”Jan. 6, 2015 (61 pages). |
| Number | Date | Country | |
|---|---|---|---|
| 20230083463 A1 | Mar 2023 | US |
| Number | Date | Country | |
|---|---|---|---|
| 63072581 | Aug 2020 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 17575139 | Jan 2022 | US |
| Child | 18053038 | US | |
| Parent | PCT/IL2021/051062 | Aug 2021 | US |
| Child | 17575139 | US |
