On-demand injection of software booby traps in live processes
This disclosure provides for rapid deployments of application-level deceptions (i.e., booby traps) to implant cyber deceptions into running legacy applications both on production and decoy systems, with no downtime and minimal performance overhead compared with the original application. An application-level booby trap is a piece of code injected into an application, and which provides an active defense or deception in response to an attack. A booby trap does not influence program execution under normal operation, and preferably elicits a response that can be defined by a security analyst. In operation, a booby trap is compiled into a bitcode using a patch synthesis process, and it is then injected into a running application, where it is compiled further into machine code, and linked directly with the existing application constructs. The original function also is modified with a function trampoline, and subsequent calls to the original function are then directed to the new function. As easily as a deception (provided by the booby trap) can be deployed, it can be removed easily, thereby leaving no trace in the application.
1. A method for cyber security, comprising:
on-demand, injecting a deception patch into a memory space of a production application that is running, the production application having an execution flow;
in-memory compiling the deception patch into native code on a separate execution thread inside the production application;
in the separate execution thread, setting a booby trap as a replacement function for an original function in the production application, the replacement function performing one or more tasks of the original function and including at least one deception; and
responsive to detecting an attack on the production application by an action that trips the booby trap, initiating a defined response.
2. The method as described in claim 1 wherein the defined response is one of: a passive response, and an active response.
3. The method as described in claim 2 wherein the passive response is one of: terminating a connection, collecting an attack payload, and issuing a notification.
4. The method as described in claim 2 wherein the active response is one of: transparently moving a current execution thread into a decoy sandbox for further execution and analysis, providing disinformation, and activating rule to block the attack.
5. The method as described in claim 1 further including removing the replacement function while the production application is running.
6. The method as described in claim 1 wherein the deception patch is synthesized in an off-line process by:
receiving patch source code, and a symbol table associated with the production application;
compiling the patch source code into bitcode suitable for just-in-time in-memory interpretation;
extracting a symbols map from the symbol table; and
packing into a shared object the bitcode, the symbols map and a hooking agent, the shared object being the deception patch.
7. The method as described in claim 6 wherein compiling the deception patch further includes compiling the bitcode, and linking against global symbols of the production application using the symbol map.
8. An apparatus for cyber security, comprising:
a processor;
computer memory holding computer program instructions executed by the processor, the computer program instructions operative to:
on-demand, inject a deception patch into a memory space of a production application that is running, the production application having an execution flow;
in-memory compile the deception patch into native code on a separate execution thread inside the production application;
in the separate execution thread, set a booby trap as a replacement function for an original function in the production application, the replacement function configured to perform one or more tasks of the original function and including at least one deception; and
responsive to detecting an attack on the production application by an action that trips the booby trap, initiate a defined response.
9. The apparatus as described in claim 8 wherein the defined response is one of: a passive response, and an active response.
10. The apparatus as described in claim 9 wherein the passive response is one of: terminating a connection, collecting an attack payload, and issuing a notification.
11. The apparatus as described in claim 9 wherein the active response is one of: transparently moving a current execution thread into a decoy sandbox for further execution and analysis, providing disinformation, and activating rule to block the attack.
12. The apparatus as described in claim 8 wherein the computer program instructions are further operative to remove the replacement function while the production application is running.
13. The apparatus as described in claim 8 wherein the deception patch is synthesized in an off-line process, the off-line process including computer program instructions operative to:
receive patch source code, and a symbol table associated with the production application;
compile the patch source code into bitcode suitable for just-in-time in-memory interpretation;
extract a symbols map from the symbol table; and
pack into a shared object the bitcode, the symbols map and a hooking agent, the shared object being the deception patch.
14. The apparatus as described in claim 13 wherein the computer program instructions operative to compile the deception patch are operative to compile the bitcode, and to link against global symbols of the production application using the symbol map.
15. A computer program product in a non-transitory computer readable medium, the computer program product holding computer program instructions executed by a host machine for cyber security, the computer program instructions comprising program code operative to:
on-demand, inject a deception patch into a memory space of a production application that is running, the production application having an execution flow;
in-memory compile the deception patch into native code on a separate execution thread inside the production application;
in the separate execution thread, set a booby trap as a replacement function for an original function in the production application, the replacement function configured to perform one or more tasks of the original function and including at least one deception; and
responsive to detecting an attack on the production application by an action that trips the booby trap, initiate a defined response.
16. The computer program product as described in claim 15 wherein the defined response is one of: a passive response, and an active response.
17. The computer program product as described in claim 16 wherein the passive response is one of: terminating a connection, collecting an attack payload, and issuing a notification.
18. The computer program product as described in claim 16 wherein the active response is one of: transparently moving a current execution thread into a decoy sandbox for further execution and analysis, providing disinformation, and activating rule to block the attack.
19. The computer program product as described in claim 15 wherein the computer program instructions are further operative to remove the replacement function while the production application is running.
20. The computer program product as described in claim 15 wherein the deception patch is synthesized in an off-line process, the off-line process including computer program instructions operative to:
receive patch source code, and a symbol table associated with the production application;
compile the patch source code into bitcode suitable for just-in-time in-memory interpretation;
extract a symbols map from the symbol table; and
pack into a shared object the bitcode, the symbols map and a hooking agent, the shared object being the deception patch.
21. The computer program product as described in claim 20 wherein the computer program instructions operative to compile the deception patch are operative to compile the bitcode, and to link against global symbols of the production application using the symbol map.
22. A method for cyber security, comprising:
just-in-time deploying into a running target application a software patch having associated therewith at least one application-level deception, wherein deploying the software patch instantiates in a separate execution thread a replacement function configured to perform one or more tasks of the running target application, the replacement function further including a task to check for a given condition associated with the at least one application-level deception;
responsive to detection of the given condition, initiating a defined response; and
selectively removing the software patch from the running target application.