Systems and methods for causing nonpredictable environment states for exploit prevention and malicious code neutralization for JavaScript-enabled applications

1. A cyber security system comprising:

at least one processor configured to:

receive, by an application capable of JavaScript execution, code for execution;

execute, before execution of the received code, an intercepting code, wherein the intercepting code is configured to intercept at least one application programming interface (API) invocation by the received code;

intercept, by the intercepting code, an API invocation by the received code;

determine that the intercepted API invocation results in a manipulation of a backing store object; and

modify an execution of the intercepted API invocation, wherein the modified execution results in a nonpredictable environment state and modifying the execution of the intercepted API invocation includes at least one of:

padding input data associated with the API invocation;

encoding input data associated with the API invocation;

manipulating input data associated with the API invocation;

splitting, into multiple execution contexts, input data associated with the API invocation;

manipulating an object shape associated with the API invocation; or

manipulating an object structure associated with the API invocation.

2. The cyber security system of claim 1 , wherein the nonpredictable environment state includes at least one of a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

3. The cyber security system of claim 1 , wherein the intercepting code is configured to patch an exposed native API of a current execution context and intercept an API invocation of the patched native API.

4. The cyber security system of claim 1 , wherein native API functionality of at least one patched API is maintained within the nonpredictable environment state.

5. The cyber security system of claim 1 , wherein modifying the execution of the intercepted API invocation is performed in response to the determination that the intercepted API invocation results in a manipulation of a backing store object.

6. The cyber security system of claim 1 , wherein the application capable of JavaScript execution is a browser.

7. The cyber security system of claim 6 , wherein the intercepting code is executed by a JavaScript engine associated with the browser.

8. A computer-implemented method for cyber security, the method comprising:

receiving, by an application capable of JavaScript execution, code for execution;

executing, before execution of the received code, an intercepting code, wherein the intercepting code is configured to intercept at least one application programming interface (API) invocation by the received code;

intercepting, by the intercepting code, an API invocation by the received code;

determining that the intercepted API invocation results in a manipulation of a backing store object; and

modifying an execution of the intercepted API invocation, wherein the modified execution results in a nonpredictable environment state and modifying the execution of the intercepted API invocation includes at least one of:

padding input data associated with the API invocation;

encoding input data associated with the API invocation;

manipulating input data associated with the API invocation;

splitting, into multiple execution contexts, input data associated with the API invocation;

manipulating an object shape associated with the API invocation; or

manipulating an object structure associated with the API invocation.

9. The computer-implemented method of claim 8 , wherein the nonpredictable environment state includes at least one of a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

10. The computer-implemented method of claim 8 , wherein the intercepting code is configured to patch an exposed native API of a current execution context and intercept an API invocation of the patched native API.

11. The computer-implemented method of claim 8 , wherein native API functionality of at least one patched API is maintained within the nonpredictable environment state.

12. The computer-implemented method of claim 8 , wherein the API invocation is intercepted from at least one available execution context associated with the execution of the received code.

13. The computer-implemented method of claim 8 , wherein modifying the execution of the intercepted API invocation is performed in response to the determination that the intercepted API invocation results in a manipulation of a backing store object.

14. The computer-implemented method of claim 8 , wherein the application capable of JavaScript execution is a browser.

15. The computer-implemented method of claim 14 , wherein the intercepting code is executed by a JavaScript engine associated with the browser.

16. A non-transitory computer-readable medium storing program instructions executable by at least one processor to:

receive, by an application capable of JavaScript execution, code for execution;

execute, before execution of the received code, an intercepting code, wherein the intercepting code is configured to intercept at least one application programming interface (API) invocation by the received code;

intercept, by the intercepting code, an API invocation by the received code;

determine that the intercepted API invocation results in a manipulation of a backing store object; and

modify an execution of the intercepted API invocation, wherein the modified execution results in a nonpredictable environment state and modifying the execution of the intercepted API invocation includes at least one of:

padding input data associated with the API invocation;

encoding input data associated with the API invocation;

manipulating input data associated with the API invocation;

splitting, into multiple execution contexts, input data associated with the API invocation;

manipulating an object shape associated with the API invocation; or

manipulating an object structure associated with the API invocation.

17. The non-transitory computer-readable medium of claim 16 , wherein the nonpredictable environment state includes at least one of a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

18. The non-transitory computer-readable medium of claim 16 , wherein the intercepting code is configured to patch an exposed native API of a current execution context and intercept an API invocation of the patched native API.

19. The non-transitory computer-readable medium of claim 16 , wherein native API functionality of at least one patched API is maintained within the nonpredictable environment state.

20. The non-transitory computer-readable medium of claim 16 , wherein the API invocation is intercepted from at least one available execution context associated with the execution of the received code.

21. The non-transitory computer-readable medium of claim 16 , wherein modifying the execution of the intercepted API invocation is performed in response to the determination that the intercepted API invocation results in a manipulation of a backing store object.

22. The non-transitory computer-readable medium of claim 16 , wherein the application capable of JavaScript execution is a browser.

23. The non-transitory computer-readable medium of claim 22 , wherein the intercepting code is executed by a JavaScript engine associated with the browser.

24. A cyber security system comprising:

at least one processor configured to:

receive, by an application capable of JavaScript execution, code for execution;

execute, before execution of the received code, an intercepting code, wherein the intercepting code is configured to intercept at least one application programming interface (API) invocation by the received code;

intercept, by the intercepting code, an API invocation by the received code;

determine that the intercepted API invocation results in a manipulation of a backing store object; and

modify an execution of the intercepted API invocation, wherein the modified execution results in a nonpredictable environment state and modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

dividing into a random number of execution contexts, input data associated with the API invocation;

splitting into a random number of subsets, input data associated with the API invocation;

padding with random data of a same type as an argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

holding at least one object reference in memory in a manner preventing collection by a garbage collector, and releasing the at least one held object reference for garbage collection upon an occurrence of a specified condition.

25. A computer-implemented method for cyber security, the method comprising:

receiving, by an application capable of JavaScript execution, code for execution;

executing, before execution of the received code, an intercepting code, wherein the intercepting code is configured to intercept at least one application programming interface (API) invocation by the received code;

intercepting, by the intercepting code, an API invocation by the received code;

determining that the intercepted API invocation results in a manipulation of a backing store object; and

modifying an execution of the intercepted API invocation, wherein the modified execution results in a nonpredictable environment state and modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

dividing into a random number of execution contexts, input data associated with the API invocation;

splitting into a random number of subsets, input data associated with the API invocation;

padding with random data of a same type as an argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

holding at least one object reference in memory in a manner preventing collection by a garbage collector, and releasing the at least one held object reference for garbage collection upon an occurrence of a specified condition.

26. A non-transitory computer-readable medium storing program instructions executable by at least one processor to:

receive, by an application capable of JavaScript execution, code for execution;

execute, before execution of the received code, an intercepting code, wherein the intercepting code is configured to intercept at least one application programming interface (API) invocation by the received code;

intercept, by the intercepting code, an API invocation by the received code;

determine that the intercepted API invocation results in a manipulation of a backing store object; and

modify an execution of the intercepted API invocation, wherein the modified execution results in a nonpredictable environment state and modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

dividing into a random number of execution contexts, input data associated with the API invocation;

splitting into a random number of subsets, input data associated with the API invocation;

padding with random data of a same type as an argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

holding at least one object reference in memory in a manner preventing collection by a garbage collector, and releasing the at least one held object reference for garbage collection upon an occurrence of a specified condition.