monkey patch detection

Why It Matters

For developers working on security-sensitive applications, monkey patch detection serves as a crucial early warning system. It helps identify when malicious actors or automated tools attempt to alter the behavior of core JavaScript functions, potentially bypassing security checks or injecting harmful code.

In production environments, this technique is particularly valuable for applications that rely on strict runtime integrity, such as financial software, digital rights management systems, or applications with anti-cheat mechanisms. A successful detection can prevent unauthorized access or data manipulation, making it a key component in defense-in-depth strategies.

How It Works

Monkey patch detection operates by establishing a baseline of known good function implementations and then periodically comparing current implementations against that baseline. This process involves several key components:

• Baseline capture: The system stores original function references before any modifications occur, often during initialization or load time.
• Runtime monitoring: Periodic checks compare current function implementations against the stored baseline to detect discrepancies.
• Change tracking: When a mismatch is detected, the system logs or alerts based on configuration, identifying which functions were modified.
• Anti-tampering logic: Depending on the implementation, detected changes may trigger immediate defensive actions such as disabling features or alerting administrators.
• Performance considerations: Detection mechanisms must balance security with performance to avoid slowing down the application during normal operation.

The technique works by leveraging JavaScript's ability to inspect and compare function objects. Developers typically store references to original functions in a secure scope, then later verify that these functions have not been altered. This approach is especially effective against simple patching attempts where attackers directly replace function implementations.

Quick Reference

Basic Example

This simple example demonstrates how to capture and compare function implementations to detect monkey patches:

const originalToString = Object.prototype.toString;
const originalPush = Array.prototype.push;

function detectMonkeyPatches() {
  if (Object.prototype.toString !== originalToString) {
    console.warn('Object.prototype.toString has been patched');
  }
  if (Array.prototype.push !== originalPush) {
    console.warn('Array.prototype.push has been patched');
  }
}

// Simulate a patch
Array.prototype.push = function() {
  console.log('Patched push called');
  return originalPush.apply(this, arguments);
};

detectMonkeyPatches();

The important lines show how original function references are stored in variables and later compared against the current implementations. When the patch is applied, the comparison fails and logs a warning.

Production Example

This production-ready example shows a more robust implementation that includes monitoring multiple functions, handling edge cases, and providing configurable responses:

class MonkeyPatchDetector {
  constructor() {
    this.baseline = new Map();
    this.initBaseline();
  }

  initBaseline() {
    this.baseline.set('Object.prototype.toString', Object.prototype.toString);
    this.baseline.set('Array.prototype.push', Array.prototype.push);
    this.baseline.set('Function.prototype.call', Function.prototype.call);
    this.baseline.set('Array.prototype.slice', Array.prototype.slice);
    this.baseline.set('Object.keys', Object.keys);
  }

  checkIntegrity() {
    const issues = [];
    for (const [key, originalFn] of this.baseline) {
      const currentFn = eval(key);
      if (currentFn !== originalFn) {
        issues.push(key);
      }
    }
    return issues;
  }

  reportIssues(issues) {
    if (issues.length > 0) {
      console.error('Monkey patch detected in:', issues);
      // In production, this might trigger alerts or disable features
    }
  }
}

const detector = new MonkeyPatchDetector();
const issues = detector.checkIntegrity();
detector.reportIssues(issues);

This version is more suitable for production because it uses a structured approach with baseline storage, handles multiple functions, and provides a clear reporting mechanism. It also includes proper error handling and is configurable for different security requirements.

Common Mistakes

• Storing references in insecure locations: Placing baseline functions in global scopes or easily accessible objects makes them vulnerable to modification before detection runs.
• Overlooking prototype chain modifications: Developers often focus on direct method replacement but miss changes to inherited properties or methods in the prototype chain.
• Ignoring performance impact: Running checks too frequently or using inefficient comparison methods can significantly slow down application performance.
• False positive triggers: Inadequate handling of legitimate runtime changes can cause unnecessary alerts or defensive actions.
• Not accounting for legitimate framework modifications: Some frameworks or libraries intentionally modify core prototypes, leading to false detections if not properly configured.

Security And Production Notes

• Baseline functions should be stored in secure, non-overwritable scopes to prevent modification before detection.
• Regular monitoring should be balanced with performance considerations to avoid impacting application responsiveness.
• Detection mechanisms should distinguish between legitimate framework changes and malicious patches.
• Alerts should include detailed information about which functions were modified and when the change occurred.
• Implementation should be resilient to attacks that attempt to bypass detection by modifying the detection code itself.

Related Concepts

Monkey patch detection is closely related to several other security and development concepts:

Code obfuscation involves transforming code to make it harder to understand or reverse engineer, often including techniques that monkey patch detection aims to counter.

Runtime integrity checking ensures that application behavior remains consistent with expected implementations throughout execution.

Anti-tampering systems protect software from unauthorized modifications, often using similar detection mechanisms.

Debugging and development tools may use similar techniques to monitor function calls and identify unexpected behavior.

Security hardening practices include various methods to prevent unauthorized access or modification of application components.

Further Reading

• MDN Web Docs
• WHATWG HTML Standard