Technology

Hardware visibility. Software agility.

Unprecedented Zero-day, N-day and everyday threat prevention.

For advanced threats, unique technology scans incoming code before it can be masked, to see what leading solutions miss. On top, we’ve built-in multiple layers against everyday threats like phishing, commodity malware, and spam, for a complete holistic solution.

Holistic protection against every threat level.

Cybersecurity is complex, but your security stack doesn’t need to be. We’ve combined multiple layers into one platform to provide comprehensive protection against malicious files and URLs, across channels.

ADVANCED THREAT (APT) PREVENTION

We see the unknown attacks that leading solutions miss.

First ever hardware-assisted platform (HAP™) combines hardware visibility with software agility to deliver unprecedented prevention of Zero-day and N-day threats.

TARGETING THE REAL ENEMY

Exploits.

In advanced attacks, the source of malware are exploits. While there are as many as 72M new malware variants/month, there are currently only ~10 exploit techniques in use*. We target these exploit techniques to deliver an earlier, far more reliable verdict and prevent APT attacks pre-malware release.

*ISTR, Vol. 23 (March 2018)

The Cyber Kill Chain.

Scroll to see how early we act upon any sign of intrusion

The Cyber Kill Chain

stage 1

Recon.

Hackers identify the best attack vector, gaining information on potentially vulnerable applications. The exploration process includes research on both known and unknown vulnerabilities.

stage 2

Weaponise.

Creates file embedded with malicious code to leverage those vulnerabilities

stage 3

Content Delivery.

Sends content containing the attachment to spacific individuals or company-wide.

pre-stage 4

Perception Point.

Deterministic

Detecting the exploit technique, before the user clicks on the URL or the file. Takes the user out of the equation. Utilizing deterministic methods to accurately identify malicious intent with full visibility. 15-30 sec scans. Unlimited scale.

New exploit techniques are developed in academia, and introduced every few years. See Threat Coverage section for more informatuoon on specific techniques.

stage 4

Exploitation.

User clicks on the URL or opens the file attachment. Malicious code is triggered, exploiting vulnerabilities in the targeted application.

New exploit techniques are developed in academia, and introduced every few years. See Threat Coverage section for more informatuoon on specific techniques.

stage 5

Malware Delivery.

Malicious code is installed onto the system, allowing persistent access.

stage 6

Command & Control.

Hacker is able to access the malware remotely, gaining inside access to the target’s system and wider network

pre-stage 7

Existing Solutions.

SANDBOX / BEHAVIORAL / STATISTICAL

Detect malware only after it has entered the system – subject to user’s security awareness. Utilizing statistical or behavior-based analysis to make a hypothesis – easily evaded by sophisticated techniques. 7 – 20 minutes scans. Limited scale.

stage 8

Action on Objective.

Hacker fulfills objective – possibly stealing data, shutting down networks, or infiltrating connected targets.

RECORDING THE FULL EXECUTION FLOW

Hardware Visibility.

Any APT attack always starts at the CPU level, so access to this data is critical. How to achieve this in a SaaS solution? We leverage Intel PT (Processor Trace) to record the full execution flow using software. Custom built hypervisor bridges between the CPU and virtual machines to capture the cleanest data possible, enabling the detection of highly-evasive attacks that sandbox and other solutions cannot see.

PATENT-PENDING DETECTION ALGORITHMS

Software agility.

Cutting-edge detection algorithms (scanners) analyze each recording to detect malicious intent. Advanced scanners include:

1

CFG.

Detects memory corruption exploits

2

FFG.

Detects advanced exploitation techniques

3

Dropper.

Detects logical bugs

We are continuously researching the latest exploitation techniques, while they are still in academia, to ensure our detection capabilities are updated to stay ahead of the latest attack campaigns.

everyday threat technology

MULTI-LAYERED APPROACH

Holistic protection against all attacks.

Multi-layered platform provides unified detection of advanced and everyday threats in one simple solution. Scroll down to see how content (files & URLs) is scanned by each layer.

1 email only

Amazon SES.

SES receives the email and applies reputation and anti-spam filters to quickly flag an email as malicious.

2 all threats

Recursive Unpacker.

Unpacks the email into smaller units (files and URLs) to identify hidden malicious attacks. Further extracts embedded URLs and files (recursively) by unpacking files and following URLs. All of the extracted components go separately through the next layers.

3 everyday threats

Threat Intelligence.

Combines 6 different threat intelligence sources with our internally devloped engine that scans URLs and files in the wild to warn about potential or current attacks.

4 everyday threats

Phishing Engines.

Combines 4 top URL reputation engines and an in-house image analysis engine to identify impersonation techniques and phishing attacks.

5 everyday threats

Static Signatures.

Combines 4 top signature based anti-virus engines to identify malicious attacks. In addition, we've developed a tool that acts to identify highly complicated signatures.

6 n-day & Zero-day threats

HAP™ Dropper.

Employs advanced heuristics-based engine for detecting logical bugs and handling macros and scripts.

7 n-day & Zero-day threats

HAP™ CFG.

Records the CPU while it processes the input (files and URLs) and identifies exploits by examining the entire execution flow - detecting any deviation from the normal flow of a program in order to deterministically identify malicious activity.

8 n-day & Zero-day threats

HAP™ FFG.

Detects advanced techniques such as exploits that are written to bypass common CFI algorithms. Proprietary semantic aware control flow graphs developed for each application identify deviations of the execution flow during runtime.

1 email only

Spam
Filter.

Receives the email and applies reputation and anti-spam filters to quickly flag an email as malicious.

2 email only

Recursive
Unpacker.

3 email only

Threat
Intelligence.

Combines 6 different threat intelligence sources with our internally devloped engine that scans URLs and files in the wild to warn about potential or current attacks.

4 email only

Phishing
Engines.

Combines 4 top URL reputation engines and an in-house image analysis engine to identify impersonation techniques and phishing attacks.

5 email only

Static
Signatures.

Combines 4 top signature based anti-virus engines to identify malicious attacks. In addition, we've developed a tool that acts to identify highly complicated signatures.

6 email only

HAP
Dropper.

Employs advanced heuristics-based engine for detecting logical bugs and handling macros and scripts.

7 email only

HAP
CFG.

8 email only

HAP
FFG.

how long does it take?

An average of 3 seconds.

We run all layers simultaneously, resulting in close to zero delay for the user, with an average delivery time of under 3 seconds.

See Complete Architecture

Learn more about how you can leverage this approach
to secure your enterprise communication and
collaboration channels.

Our Product

Complete threat coverage.

Cutting-edge protection against advanced threats. Enhanced protection against every threats.

Everyday Threats.

Low risk - Low exposure

Low risk
Low exposure

Spam, phishing, commodity malware

Requires minimal hacking skills

Moderately effective

Partly covered by AVs & Sandbox

N-day Threats.

medium risk - high exposure

medium risk
high exposure

Obfuscated exploits leveraging known vulnerabilities in Office, Adobe, browsers, and more

Requires advanced hacking skills

Highly effective against unpatched software

Easily evade AVs & Sandbox

Zero-day Threats.

high risk - high exposure

high risk
high exposure

Exploits leveraging new/unknown vulnerabilities in Office, Adobe, browsers, and more

Requires very advanced hacking skills

Highly effective even against well-secured organizations

A complete blindspot to AVs & Sandbox

Layered technology

THE SOURCE OF MALWARE

Advanced threat coverage.

Researched and developed in universities, there are currently only ~10 known exploit techniques utilized today.

Exploit Technique	Description	Year published
Stack Overwrite Return Address	Attacker overwrites the return address in the stack frame of a function and diverts execution to a location of his choice.	1996
Stack Overwrite variables	Attacker overwrites variables in the stack frame of a function in order to affect the flow of the program and divert execution to a location of his choice.	N/A
Stack SEH Overwrite	Upon overflowing a stack buffer which overwrites the SEH handler, execution is diverted to a gadget (pop; pop; ret) which executes shellcode or ROP.	2003
Heap Spray	Creates a continuous allocation in memory to which an attacker can reliably divert the execution to.	2004
Stack Pivot	Attacker changes the stack pointer to memory under his control, usually in order to initaite a ROP/COP/JOP sequence.	N/A
Return Oriented Programming (ROP)	Bypasses NX-bit and chains together “gadgets” by sequencing return addresses on the stack.	2007
Jump Oriented Programming (JOP)	Bypasses NX-bit and chains together “gadgets” by sequencing JMP commands that use stack arguments.	2010
Call Oriented Programming (COP))	Bypasses NX-bit and chains together “gadgets” by sequencing call instructions.	2014
Counterfeit Object-Oriented Programming (COOP)	Induces malicious program behavior by only invoking chains of existing C++ virtual functions in a program through corresponding existing call sites.	2015
Data Oriented Programming (DOP)	Manipulates data instead of control flow objects in order to gain code execution.	2016

1

Stack Overwrite Return Address

Attacker overwrites the return address in the stack frame of a function and diverts execution to a location of his choice.

Year published: 1996

2

Stack Overwrite variables

Attacker overwrites variables in the stack frame of a function in order to affect the flow of the program and divert execution to a location of his choice.

Year published: N/A

3

Stack SEH Overwrite

Upon overflowing a stack buffer which overwrites the SEH handler, execution is diverted to a gadget (pop; pop; ret) which executes shellcode or ROP.

Year published: 2003

4

Heap Spray

Creates a continuous allocation in memory to which an attacker can reliably divert the execution to.

Year published: 2004

5

Stack Pivot

Attacker changes the stack pointer to memory under his control, usually in order to initaite a ROP/COP/JOP sequence.

Year published: N/A

6

Return Oriented Programming (ROP)

Bypasses NX-bit and chains together “gadgets” by sequencing return addresses on the stack.

Year published: 2007

7

Jump Oriented Programming (JOP)

Bypasses NX-bit and chains together “gadgets” by sequencing JMP commands that use stack arguments.

Year published: 2010

8

Call Oriented Programming (COP))

Bypasses NX-bit and chains together “gadgets” by sequencing call instructions.

Year published: 2014

9

Counterfeit Object-Oriented Programming (COOP)

Induces malicious program behavior by only invoking chains of existing C++ virtual functions in a program through corresponding existing call sites.

Year published: 2015

10

Data Oriented Programming (DOP)

Manipulates data instead of control flow objects in order to gain code execution.

Year published: 2016

APT technology

Want to know more?

Contact Us.

Stay a step ahead

Research & News.

CVE-2019-0539 Exploitation

Achieving full R\W primitive with CVE-2019-0539

Rom Cyncynatus and Shlomi Levin

March 5, 2019

Incident Report: Composite Moniker

We’ve spotted CVE-2017-8570, a.k.a the “Composite Moniker” in the wild alive and kicking.

Perception Point Incident Response Team

February 28, 2019

Incident Report: CV or Cyber Vector

Resume files can be dangerous, especially when they are encrypted word documents.

Perception Point Incident Response Team

February 21, 2019

68 Articles

Technology

Hardware visibility. Software agility.

Holistic protection against every threat level.

ADVANCED THREAT (APT) PREVENTION

We see the unknown attacks that leading solutions miss.

TARGETING THE REAL ENEMY

Exploits.

The Cyber Kill Chain.

stage 1

Recon.

stage 2

Weaponise.

stage 3

Content Delivery.

pre-stage 4

Perception Point.

stage 4

Exploitation.

stage 5

Malware Delivery.

stage 6

Command & Control.

pre-stage 7

Existing Solutions.

stage 8

Action on Objective.

RECORDING THE FULL EXECUTION FLOW

Hardware Visibility.

PATENT-PENDING DETECTION ALGORITHMS

Software agility.

1

CFG.

2

FFG.

3

Dropper.

MULTI-LAYERED APPROACH

Holistic protection against all attacks.

1

email only

Amazon SES.

2

all threats

Recursive Unpacker.

3

everyday threats

Threat Intelligence.

4

everyday threats

Phishing Engines.

5

everyday threats

Static Signatures.

6

n-day & Zero-day threats

HAP™ Dropper.

7

n-day & Zero-day threats

HAP™ CFG.

8

n-day & Zero-day threats

HAP™ FFG.

1

email only

Spam Filter.

2

email only

Recursive Unpacker.

3

email only

Threat Intelligence.

4

email only

Phishing Engines.

5

email only

Static Signatures.

6

email only

HAP Dropper.

Spam
Filter.

Recursive
Unpacker.

Threat
Intelligence.

Phishing
Engines.

Static
Signatures.

HAP
Dropper.

HAP
CFG.

HAP
FFG.

Learn more about how you can leverage this approach
to secure your enterprise communication and
collaboration channels.

Low risk
Low exposure

medium risk
high exposure

high risk
high exposure