Methods and systems for preventing security breaches

A non-transitory computer-readable data storage medium storing a computer program executable by a processor to perform a method for improving security of a binary executable file by using a security payload, the method comprising:

• receiving the binary executable file;
• attaching the security payload to the binary executable file by statically embedding the binary executable file in a reversible manner prior to execution of the binary executable file at and distribution of the binary executable file to a target computing system, the security payload adapted to intercept application programming interface (API) calls to system resources from the binary executable file via export address redirection back to the security payload;
• and
• distributing the binary executable file within which the security payload has been embedded to the target computing system over a network, such that upon execution of the binary executable file at the target computing system,
• the security payload replacing system library export addresses within a process address space for the binary executable computer file with security monitoring stub addresses to the security payload, the API calls associated with the system library export addresses within the process address space,
• wherein the security payload replacing the system library export addresses within the process address space for the binary executable file with the security monitoring stub addresses to the security payload comprises locating a base address to a system library within the process address space for the binary executable file, the system library encompassing the system resources.

A system comprising:

• hardware comprising at least one or more of processors, memory, and storage devices;
• an application running on the hardware and adapted to receive a binary executable file;
• a plug-in for the application, the plug-in running on the hardware and adapted to attach security payload to the binary executable computer file in a reversible manner, the security payload adapted to intercept application programming interface (API) calls to system resources from the binary executable file via export address redirection back to the security payload,
• such that upon execution of the binary executable file by the hardware of the system,
• the security payload replaces system library export addresses within a process address space for the binary executable file with security monitoring stub addresses to the security payload, the API calls associated with the system library export addresses within the process address space.