Cloud Linux Software Inc.

Igor Seletskiy

Marat Sataiev

Evgenii Vodilov

Serhii Polishchuk

Aleksei Berezhok

Pavel Boldin

Andrey Kucherov

Grigorii Zemskov

Dmitry Turmyshev

Arsenii Pastushenko

Alexey Parfenov

Serhii Brazhnyk

Raushan Myrzashova

Danila Vershinin

Andrei Popov

Evgenii Frolikov

Disclosed herein are systems and methods for automatic detection, fixing, and monitoring of vulnerabilities. In one aspect, an exemplary method comprises receiving as an input an artifact, when the received artifact is vulnerable, building the artifact for a new release, scanning a library containing the new release of the artifact to determine whether the library is safe for publishing, and publishing the library to an accessible artifact depository when the library is safe for publishing. In one aspect, the building of the artifact for the new release includes, scanning a dependency tree, replacing the vulnerable version by a safe version of the artifact when a safe version is available, fixing the vulnerable version of the artifact using known patches when a safe version of the artifact is not available, adding a postfix to a group ID of the artifact for distinguishing the fixed version from prior versions of the artifact.

Systems and methods for automatic detection, fixing, and monitoring vulnerabilities in java libraries

Disclosed herein are systems and method for blocking malicious script execution. In one exemplary aspect, the method includes determining, on a first computing device of a plurality of computing devices, that a first script on the first computing device is malicious. The method includes identifying a plurality of operations in an execution flow of the first script and generating a first hash value of attributes associated with the plurality of operations in the execution flow, wherein the attributes omit a name of the first script and a location of the first script on the first computing device. The method includes generating a first rule that prevents execution of any script whose generated hash value would match the first hash value of the first script and transmitting the first rule to a second computing device that subsequently blocks scripts based on the first rule.

Systems and methods for blocking malicious script execution based on generalized rules

Disclosed herein are systems and method for detecting and resolving account compromise, the method comprising: configuring a web application firewall (WAF) to monitor events in a web application following a successful login into a user account of the web application; collecting, by the WAF, event data of a user session on the web application; determining whether the collected event data comprises malicious activity by comparing the collected event data to historic event data indicative of the malicious activity; in response to determining, by the WAF, that the collected event data corresponds to the historic event data: storing an indication that the user account is compromised in a database; generating an alert indicating that the user account is compromised, wherein the alert comprises a prompt to reset a password of the user account; and blocking, by the WAF, further access to the user account in the user session.

Systems and methods for detecting and resolving user account compromise using a password reset

Disclosed herein are systems and method for deduplicating malware scan attempts. In one exemplary aspect, a method may include: receiving, from a first computing device of a plurality of computing devices in a network, a first hash value of an object and a verdict of a malware scan performed on the object by the first computing device; storing the first hash value and the verdict in a shared verdict database; receiving, from a second computing device in the network, a verdict request including a second hash value; determining that the first hash value and the second hash value match; in response to determining the match, transmitting, to the second computing device, the verdict of the malware scan performed on the object by the first computing device, wherein the second computing device does not perform a redundant malware scan on the object.

Systems and methods for deduplicating malware scan attempts in a network

Disclosed herein are systems and method for automated malicious code replacement. In one exemplary aspect, a method may comprise scanning for malicious content in a file comprising a script written in an interpretable programming language, wherein the malicious content triggers malicious activity on a computing device that stores the file. The method may comprise detecting a malware injection in the file based on the scanning, wherein the malware injection comprises at least one operator that enables the malicious activity. The method may comprise identifying a benign operator that can replace the at least one operator to prevent execution of the malicious activity without causing a syntax error. The method may comprise updating the file by replacing the at least one operator with the benign operator.

Systems and methods for automated malicious code replacement

Disclosed herein are systems and methods for rapid password evaluation. A method may include: configuring a web application firewall (WAF) to monitor login credentials for one or more web applications; intercepting, using the WAF, a password input during a login attempt to a web application by an entity; calculating a hash value of the password input; transmitting the hash value to a dedicated server configured to: determine whether the hash value is in a database of hashes corresponding to weak passwords; and in response to determining that the hash value is in the database of hashes, transmit a message to the WAF indicating that the password input corresponds to a weak password; and generating for display, using the WAF, a web page prompting for a password reset for the web application.

Systems and methods for rapid password compromise evaluation

Disclosed herein are systems and methods for automated conversion and management of web server configuration files using a conversion application. In one aspect, an exemplary method comprises receiving an input configuration file for conversion from an Apache configuration file to an NGINX configuration file, parsing the input configuration file into tokens for processing to construct an Apache configuration tree in memory, building a structured Apache configuration tree from the tokens and storing in memory, traversing the Apache configuration tree examining each element of the Apache configuration tree, and for each Apache directive or block that is encountered during the examination, invoking a directive conversion plugin for handling requirements of the respective Apache directive or block, building an NGINX configuration tree corresponding to the Apache configuration tree, and writing the NGINX configuration depicted in the NGINX configuration tree to an NGINX configuration file.

Systems and methods for automated conversion and management of web server configuration files

Disclosed herein are systems and method for preventing zero-day attacks. A method may include receiving a first report including information about an execution of a first script of an application that modifies a file on a first computing device, and receiving a second report including an indication that the file includes malicious code. In response to determining that an identifier of the file is present in both the first report and the second report, the method may include generating and transmitting, to the first computing device, a first rule that prevents execution of any script that shares at least one operation of the first script. The method may include, in response to determining that a vulnerability detected by the first rule is not present in a vulnerability database, generating an entry in the vulnerability database for the vulnerability as a zero-day vulnerability and transmitting an alert to the application developer.

Systems and methods for preventing zero-day attacks

Disclosed herein are systems and method for detecting malware signatures in databases. In one exemplary aspect, a method may comprise identifying a plurality of entries of the database, wherein each entry represents a record stored on a computing device and selecting at least one suspicious entry in the plurality of entries. The method may comprise retrieving a record associated with the suspicious entry and applying a transformation to original contents of the record. The method may comprise scanning the transformed contents of the record for a malware signature. In response to detecting a portion of the transformed contents that matches the malware signature, the method may comprise executing a remediation action that removes a corresponding portion from the original contents of the record and updating the database by replacing the at least one suspicious entry with an entry of the record on which the remediation action was executed.

Systems and methods for robust malware signature detection in databases

Disclosed herein are systems and method for blocking novel attack vectors. In one aspect, a detected security incident and a consequential event are correlated such that the combination of the security incident and the consequential event are identified as an attack vector. A method may comprise generating and executing a rule that blocks the consequential event in response to detecting the security incident.

Systems and methods for blocking novel attack vectors

Disclosed herein are systems and methods for selective patching processes. In one exemplary aspect, the method includes: identifying, via a user space patching service, a patch that modifies at least one function included in a process, wherein the process is executed on a computing device; generating a list of target pages in virtual memory of the computing device, wherein the list of target pages includes code associated with the at least one function; marking the target pages as non-executable based on file identification; intercepting, using an amended page-fault event handler, an attempt to execute the code associated with the at least one function by the process; and applying the patch to modify the at least one function.

Systems and methods for selective patching based on kernel and user space interaction

Disclosed herein are systems and method for adjusting storage volume size of an application instance. A method may include: identifying a first application instance running on a computing device, wherein the first application instance has an assigned first storage volume on a device storage of the computing device; collecting, over a period of time, usage data of the device storage; determining, based on the collected usage data, whether a usage capacity of the first storage volume of the first application instance is reaching a maximum capacity of the first storage volume; in response to determining that the usage capacity of the first storage volume is reaching the maximum capacity of the first storage volume, adjusting a size of the first storage volume by a first amount to accommodate usage of the first application instance.

Systems and methods for adjusting storage volume size of an application instance

Disclosed herein are systems and method for protecting core files in a content management system (CMS). In one aspect, a method includes detecting execution of a script on a computing device. In response to determining that the script is located in the core folder and is not included in an exclude list that includes paths of scripts and files that are marked as not malicious, the method includes blocking the execution of the script. If the script is not in the core folder, the method includes determining whether the script will upload, to the core folder, a file that is not in the exclude list. In response to determining that the script will upload the file to the core folder, the method includes blocking write functions in the script during the execution.

Systems and methods for protecting core files in a content management systems

Disclosed herein are systems and method for detecting coroutines. A method may include: identifying an application running on a computing device, wherein the application includes a plurality of coroutines; determining an address of a common entry point for coroutines, wherein the common entry point is found in a memory of the application; identifying, using an injected code, at least one stack trace entry for the common entry point; detecting coroutine context data based on the at least one stack trace entry; adding an identifier of a coroutine associated with the coroutine context data to a list of detected coroutines; and storing the list of detected coroutines in target process memory associated with the application.

Systems and methods for detecting coroutines

Disclosed herein are systems and method for blocking malicious script execution. In one exemplary aspect, the method may comprise detecting an execution of a script that creates or modifies a file on a computing device and recording a first report comprising a list of operations involved in the execution of the script, an identifier of the script, and an identifier of the file. The method may comprise determining that the file includes malicious code using a malware scanner and recording a second report comprising an indication that the file includes malicious code and an identifier of the file. In response to determining that identifier of the file is present in both the first report and the second report, the method may comprise generating and storing a first rule that prevents complete execution of any script that shares at least one operation in the list of operations with the script.

Growing community of inventors

Palo Alto, CA, United States of America

Igor Seletskiy