Dynamic method invocation for zero-day exploits
In some embodiments, techniques for dynamic method invocation for zero-day exploits may include locating, by a security agent, an entry point to a method of an online application; injecting, by the security agent, instrumentation code into the entry point of the method; receiving, at the security agent, a security policy regarding the method that dynamically sets a parameter of the instrumentation code; and executing, by the security agent and based on the parameter of the instrumentation code, wrapper code for the method that performs a mitigation action with respect to the method.
1 . A method, comprising:
locating, by a security agent, an entry point to an application method of an online application;
injecting, by the security agent, instrumentation code into the entry point of the application method;
receiving, at the security agent, a security policy regarding the application method, the security policy including code that the security agent converts at runtime into executable instructions, the executable instructions being incorporated into the instrumentation code and, when executed, dynamically setting a runtime parameter of the instrumentation code; and
executing, by the security agent and based on the runtime parameter of the instrumentation code, wrapper code for the application method that performs a mitigation action with respect to the application method.
2 . The method of claim 1 , wherein the security agent receives the security policy from a security server.
3 . The method of claim 2 , wherein the security agent receives updates to the security policy from the security server.
4 . The method of claim 1 , wherein the mitigation action comprises blocking all lookup calls for the application method.
5 . The method of claim 1 , wherein the wrapper code performs a conditional check on an argument associated with the application method.
6 . The method of claim 5 , wherein the security agent performs the mitigation action when the argument matches a particular call indicated by the conditional check.
7 . The method of claim 1 , wherein the security agent injects the instrumentation code based on the security policy.
8 . The method of claim 1 , wherein the security policy is associated with a newly discovered exploit.
9 . The method of claim 1 , wherein the mitigation action is performed without requiring a restart of the online application.
10 . The method of claim 1 , wherein the mitigation action comprises making a call to an application programming interface (API).
11 . An apparatus, comprising:
one or more network interfaces;
a processor coupled to the one or more network interfaces and configured to execute one or more processes; and
a memory configured to store a process that is executable by the processor, the process when executed configured to:
locate an entry point to a method of an online application;
inject instrumentation code into the entry point of the method;
receive a security policy regarding the application method, the security policy including code that a security agent converts at runtime into executable instructions, the executable instructions being incorporated into the instrumentation code and, when executed, dynamically setting a runtime parameter of the instrumentation code; and
execute, based on the parameter of the instrumentation code, wrapper code for the method that performs a mitigation action with respect to the method.
12 . The apparatus of claim 11 , wherein the security policy is received by a security agent from a security server.
13 . The apparatus of claim 12 , wherein the security agent receives updates to the security policy from the security server.
14 . The apparatus of claim 11 , wherein the mitigation action comprises blocking all lookup calls for the method.
15 . The apparatus of claim 11 , wherein the wrapper code performs a conditional check on an argument associated with the method.
16 . The apparatus of claim 15 , wherein the mitigation action is performed by a security agent when the argument matches a particular call indicated by the conditional check.
17 . The apparatus of claim 11 , wherein the instrumentation code is injected by a security agent based on the security policy.
18 . The apparatus of claim 11 , wherein the security policy is associated with a newly discovered exploit.
19 . The apparatus of claim 11 , wherein the mitigation action is performed without requiring a restart of the online application.
20 . A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:
locating, by a security agent, an entry point to a method of an online application;
injecting, by the security agent, instrumentation code into the entry point of the method;
receiving, at the security agent, a security policy regarding the method, the security policy including code that a security agent converts at runtime into executable instructions, the executable instructions being incorporated into the instrumentation code and, when executed, dynamically setting a runtime parameter of the instrumentation code; and
executing, by the security agent and based on the parameter of the instrumentation code, wrapper code for the method that performs a mitigation action with respect to the method.