Jfrog, Ltd.

Appdome Ltd.

Meir Tsvi

Asaf Karas

Or Peles

Anton Nayshtut

Avner Yehuda

Omer Schory

Daniel Zatuchne

Lior Halfon

A system, a method, and a computer program product for identification of command injection attacks. The system comprises processors, devices connected to a network, a memory, and an execution platform connected to the devices via the network and capable of executing executable products of execution commands provided thereto by the devices. At least one of the processors is configured to analyze execution commands provided to the execution platform to identify input provisioning or execution events, and determine whether they correlate to the suspicious record event, to perform a remedial action prior to attempting to execute them. When determining that the input includes a command separator and an executable product, the processor records a suspicious event. In response to identifying a potential execution event, determine that an execution command configured to be executed thereby correlates to the suspicious event, and flag the execution command as a command injection attack.

Identification of command injection attacks

A method, a computer program product and an apparatus for online detection of command injection attacks in a computerized system. The method comprises determining that an input of a potential input provisioning event received from a network includes a command separator and an executable product and recording a suspicious record event. The method further comprises determining that an execution command configured to be executed a potential execution event correlates to the suspicious record event and in response to said determining flagging the execution command as a command injection attack. The method further comprises performing a remedial action with respect to the flagged command injection attack prior to attempting to execute the execution command.

Online command injection attacks identification

A method, system and product for command injection identification. An input hook function is configured to be executed in response to a potential input provisioning event. The input hook function is configured to perform: analyzing a potential input of the potential input provisioning event to identify whether the potential input comprises a command separator and an executable product; and in response to identifying the command separator and the executable product, recording a suspicious input event indicating the command separator and the executable product. An execution hook function is configured to be executed in response to a potential execution event. The execution hook function is configured to perform: in response to a determination that an execution command of the potential execution event comprises the command separator and the executable product of the suspicious input event, flagging the execution command as a command injection attack.

Command injection identification

A method, system and product for detecting firmware vulnerabilities, including, during a testing phase of a firmware of a device, continuously polling states and activities of the device, wherein said polling is at a testing agent that is functionality separate from the firmware; correlating between at least one event that is associated with the states or the activities of the device and test results of the testing phase; based on said correlating, determining for the firmware one or more normal events and one or more abnormal events; and after the testing phase, providing indications of the one or more normal events and one or more abnormal events from the testing agent to a runtime agent, whereby said providing enables the runtime agent to protect the firmware from vulnerabilities associated with the one or more abnormal events.

Detecting firmware vulnerabilities

It is often desired to add or change the functionality of an existing executable, also known as binary. Simply splicing in new machine code into the binary will not work due to host system-specific and platform-specific limitations. The present invention will enable adding any new code to an existing program while overcoming the aforementioned consistency limitations and maintaining the original functionality.

Method for creating a revised application by adding code functionality to an existing application executable

The huge market of smartphones demands a vast number of applications with varying capabilities. For this, it is desirable that capabilities of two or more pieces of executables will be delivered together. However, several operation systems, such as Apple iOS, do not allow downloading an application with more than one binary executable file. The purpose of this invention is to allow merging of several, two or more, pieces of binary executables, without an access to any of which source code. The merging process will handle the addressing environment required for correct code operation&#x2014;creating a single virtual memory space and adapting the binding addresses, offset addresses and base addresses. This will enable executing all desired functionality from a single piece of a binary executable which can be downloaded as a single application from the app store. Problems of existing mobile OSes for application downloading will be resolved.

Growing community of inventors

Tel Aviv, Israel

Meir Tsvi