Patent Application
20220253489
The present invention relates generally to the field of computer security. More specifically, the present invention relates to detecting a change to the content of information that is displayed to a user of a website.
Malicious software can wreak havoc on computer and information systems that are unfortunate enough to become the latest malware or pestware victim. As anti-malware software and anti-malware detection techniques become increasingly effective at combating the onslaught of malware or pestware infections, unfortunately, some malware still manages to make its way onto the computers of unsuspecting users. Even worse, as more and more service providers are utilizing the internet and making use of various web architectures to provide or allow access to an expanding profile of services, service providers have no effective techniques to ensure that the services they offer are being accessed and utilized by uninfected computer systems. Moreover, providing services that make use of sensitive information such as online banking information, personal health records, and even social media, can be fraught with danger should the sensitive information fall into the wrong hands. Many users of computer systems willingly provide sensitive information to reputable and frequently accessed service provider's websites without thinking twice, making them prime targets to phishing scams and fraudulent websites.
Phishing tends to be defined as the act of attempting to acquire information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an electronic communication. Common types of phishing include forged or fraudulent websites, deceitful emails, and falsified instant messages. In general, an unsuspecting user is tricked into believing that the communication they are having is with a trusted entity and an entity authorized to collect their sensitive information. Although encryption techniques exist to reduce the likelihood of man-in-the-middle attacks, a solution that protects unsuspecting users from entering information into reputable websites that have been compromised in one way or another has yet to be implemented; that is, there is no solution that exists which ensures that the website a user is visiting is the website the service provider intended them to see.
Accordingly, there exists a need to ensure that a web page a user is viewing is the web page that a service provider intended them to see. It is thus one aspect of the present invention to provide a method that generally comprises detecting a change in content of a web page. This method may further comprise creating a server-side fingerprint based on one or more elements of the web page, injecting executable instructions into the web page such that upon execution at a client device, the executable instructions create a client-side fingerprint of a web page containing the executable instructions based on the one or more elements, receiving the client-side fingerprint, and comparing the client-side fingerprint to the server-side fingerprint.
Since such a solution may be applied to web pages, or web sites, already in place, embodiments of the present invention may provide a method that may protect existing websites; the method generally comprises generating a first fingerprint of a web page, wherein the first fingerprint is based on one or more elements of a first instance of the web page, receiving a second instance of a web page, injecting executable instructions into the received second instance of the web page such that upon execution at a client device, the executable instructions create a second fingerprint of the web page, wherein the second fingerprint is based on the one or more elements of the web page, and comparing the first fingerprint to the second fingerprint.
It is another aspect of the present invention to provide a system for detecting a change in web content, the system comprising a code injection module, a server device including a processor, a communication interface, data storage, and a server application stored on the data storage that is executable by the processor, wherein the server application is operable to create a server-side fingerprint based on one or more elements of a web page and provide the web page, utilizing the communication interface, to a code injection module, wherein the code injection module injects executable instructions into the web page such that upon execution at a client device, the executable instructions create a client-side fingerprint of a web page containing the executable instructions based on the one or more elements, wherein the server application is further operable to receive the client-side fingerprint and compare the client-side fingerprint to the server-side fingerprint.
The phrases “at least one”, “one or more”, and “and/or” are open-ended expressions that are both conjunctive and disjunctive in operation. For example, each of the expressions “at least one of A, B and C”, “at least one of A, B”, or C, “one or more of A, B”, and C, “one or more of A, BC”, or and “A, B, and/or C” means A alone, B alone, C alone, A and B together, A and C together, B and C together, or A, B and C together.
The term “a” or “an” entity refers to one or more of that entity. As such, the terms “a” (or “an”), “one or more” and “at least one” can be used interchangeably herein. It is also to be noted that the terms “comprising”, “including”, and “having” can be used interchangeably.
The term “automatic” and variations thereof, as used herein, refers to any process or operation done without material human input when the process or operation is performed. However, a process or operation can be automatic, even though performance of the process or operation uses material or immaterial human input, if the input is received before performance of the process or operation. Human input is deemed to be material if such input influences how the process or operation will be performed. Human input that consents to the performance of the process or operation is not deemed to be “material”.
The term “computer-readable medium” as used herein refers to any tangible storage that participates in providing instructions to a processor for execution. Such a medium may take many forms, including but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media includes, for example, NVRAM, magnetic or optical disks. Volatile media includes dynamic memory, such as main memory. Common forms of computer-readable media include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, or any other magnetic medium, magneto-optical medium, a CD-ROM, any other optical medium, punch cards, paper tape, any other physical medium with patterns of holes, a RAM, a PROM, and EPROM, a FLASH-EPROM, a solid state medium like a memory card, any other memory chip or cartridge, or any other medium from which a computer can read. When the computer-readable media is configured as a database, it is to be understood that the database may be any type of database, such as relational, hierarchical, object-oriented, and/or the like. Accordingly, the invention is considered to include a tangible storage medium and prior art-recognized equivalents and successor media, in which the software implementations of the present invention are stored.
As will become apparent in view of the following disclosure, the various aspects and embodiments of the invention can be combined.
Referring to
One or more local computer systems 108 may be connected via the communication network 112 to one or more central servers 104 capable of providing or serving content to a computer system 108 over the communication medium 112. For example, all or portions of a particular website, “Website 1”, as illustrated in
As an example of an implementation of computer network 100 in accordance with embodiments of the present disclosure, a client computer system 108 may make a request to view a website, wherein one or more files associated with the website reside on server 104. Server 104 generally responds to the request of the computer system 108 and sends varying content 116 to the computer system 108. The content 116 sent from server 104 to computer system 108 may be referred to as web content; though other forms of content are contemplated. The computer system 108 may interact with the content and may further submit or send additional content, or client information 120, to the server 104. In the context of websites for example, if a user is utilizing computer system 108 to login to a website hosted or located at server 104, the computer system 108 may send or submit a user id associated with the user and a password associated with the user id. In such an instance, the client information 120 comprising the user id and the password may be sent to the server 104, as illustrated generally in
Referring to
The web browser 204 may display one or more web pages 212 to a user. A web page 212 is generally a web document or other resource that is accessible through a web browser and displayed on a monitor or mobile device 108. The web page 212 may be rendered, or displayed, within the borders of the web browser 204, or may be displayed as a separate application or resource. For example, it is not uncommon for a web page to launch a pop-up window that displays additional information, such as audio, video, and/or another web page, in a separate window, tab, or web browser.
The web page 212 may be rendered according to a document object model (DOM) associated with the web page. The DOM may include one or more nodes that correspond to one or more elements appearing in the web page. For example, web page 212, as shown, is generally illustrative of a banking website requiring the submission of sensitive information in order to gain access to services, such as banking services, provided by a banking institution. The example web page 212 may include elements such as, but not limited to one or more logos 216, a banner or banners 220, 224, one or more content areas 228, and one or more login areas 232. The login area 232 generally includes one or more fields or forms 240, 244 and a “submit” and/or “log in” button 248. A login area 232 may include a content area 236; the content area 236 may include instructions that a user is to follow to gain access to services provided by the banking institution. Alternatively, or in addition, content area 236 may include content generally representative of the login area 232. For example, content area 236 may provide an indication to a user that certain locations within content area 236 are locations in which a user id and password are to be entered. For instance, a user would enter a user id in field 240 and a password in field 244. After entering these two items, a user would click on the “log in” button 248 to be logged into the banking website. Once logged in, the user may have access to various services and offerings provided by the banking institution. Each element, as described above, may have one or more DOM nodes associated therewith.
The web page 212 may be created, or coded, using various mark-up and/or programming languages such as, but not limited to HTML, XML, JAVASCRIPT, AJAX, ASP, PHP, Perl, Python, .NET, Java, and jQuery. In general, a web page, such as web page 212, resides on a server 104 capable of serving web content, such as a web content 116. More specifically, a web page 212 may include programming code that causes web content and/or functions to be transferred and displayed to a user at a client or computer system. Upon a user navigating the web browser 204 to a particular web page or resource residing at or on a web server 104 for example, content 116, 228 related to the web page 212 may be transmitted to the web browser 204 for rendering and display in the web page 212. That is, a web page may comprise a document that can incorporate text, graphics, sounds, etc. and is generally a hypertext document, or file, on the World Wide Web, but is not limited to this location. The content of the web page, or file, may therefore include text, graphics, sounds, etc. and also markup symbols or codes inserted in the content, or file, intended for display on a World Wide Web browser page. Additionally, executable instructions, such as scripts, codes, and the like may be utilized within the content to make actions, functions, and or interactions possible.
Various mark-up and programming languages make actions, functions, and/or interactions of the web page possible. For example, some programming languages execute programming code on the web server in which they reside; such programming languages are often referred to as server side coding languages or server side scripting languages. An example of a server side language is PHP. Other programming languages are designed to execute on the client computer system 108, such as within the web browser 204, the client computer system 108, and/or computing device 104; these programming languages are often referred to as client side coding languages or client side scripting. An example of a client side scripting language is JavaScript. Depending on requirements, a web page 212 may be coded in multiple programming languages, such that coded portions of a web page 212 are executed at a web server 104 while other coded portions of a web page are executed on the client computer system 108. As one example, a web page may comprise one or more HTML elements, attributes for the one or more HTML elements, one or more tags, and/or one or more scripts to be executed by the client computer system 108.
As another example, referring to
In some situations, the client computer system 108 may become infected with malware; that is, one or more pieces of malware may have been installed on the client computer system 108 rendering the client computer system 108 compromised. The term “malware” is used herein to refer generally to any executable computer file or, more generally “object”, that is itself or contains malicious code, and thus includes viruses, Trojans, worms, spyware, adware, etc. and the like. Malware is generally designed to wreak havoc on computer systems by disrupting operations, gathering sensitive information, and/or providing access to the compromised computer system. When gathering sensitive information, variants of malware may target a specific set or class of websites known to accept or require various amounts of sensitive data from a user. For example, some variants of malware will alter content, i.e. web content, that is displayed to a user such that the displayed web page phishes for additional sensitive information; that is, the user, believing the website is legitimate, may enter such sensitive information into one or more fields of a website. As an example, web page 212—as a banking website—allows a user to access services from a banking services provider utilizing a client computer system 108. As previously discussed and as illustrated in
As an example,
Table 2 includes example PHP programming code describing a common form object of 232 that has been compromised by one or more pieces of malware. Specifically, the one or malware variants have altered the login content area 232 of
Moreover, the malware variant may have caused additional alterations to the web page 212. For example, web page 304 now includes additional, or altered, content located in content area 312. Content area 312 includes a content area 308 that may display a comforting or reaffirming message to a user; a message such as “For your added security, we now require your Social Security number as part of the login process. We guarantee a safe online experience!” may lead an unsuspecting user to believe that the additional social security information requested by the web page 312 is a legitimate request. Moreover, a content area 336 may state “LOG IN TO YOUR ACCOUNT, WE NOW REQUIRE SS#s”. Again, such an alteration in content may cause an unsuspecting user to believe that the additional social security information requested by the web page 312 is a legitimate request. The user may then enter additional information, such as their social security information, and click submit. A malware variant may then receive this additional information and forward it on to a person having malicious intent.
Once a user has entered this additional information, a malware variant may obtain this entered additional information in a variety of ways. For example, the malware variant may log keystrokes associated with the particular field, take a screenshot of the web page upon the user clicking submit, and/or may cause the information entered into the fields to be “posted”, using post or get methods, to a web page other than the web page defined in the form. For example, the form of Table 1 utilizes the “post” method to send the information entered into the form fields, i.e. userid, password, to the web page “Login.php”. A malware variant may cause the information entered into the form fields, i.e. userid, password, social security number, to be sent to a different web page, such as “MalwareLogin.php”. Additional methods in which the malware variant may cause the information entered into the form fields to be sent to a different web page are contemplated.
Embodiments of the present disclosure utilize digital fingerprints to essentially “lockdown” a web page, such that any change or modification that occurs to a web page between the time a web page is accessed on a server and presented to a user is detected. For example, a digital fingerprint of a web page, or web content that is to be presented to a user, is created at a server controlled by a service provider. This digital fingerprint is then stored at the server for later use. For instance, a service provider, such as a banking institution, may create one or more websites having one or more web pages that have been made accessible to clients or customers. The service provider may choose to create a digital fingerprint of a web page, a website, and/or resources, such as documents, that are made available to users. For example, the service provider may create a digital fingerprint of web pages in which sensitive information is received, such as a login screen webpage. This digital fingerprint is stored as a server-side fingerprint for later retrieval.
Moreover, the service provider may cause a client-side executable code, such as script, to be inserted into the web content and/or web page code, associated with the web page to be fingerprinted. The inserted client-side executable code, once received at a client computer system, creates a client-side fingerprint of the web page rendered and/or presented to a user. The client-side fingerprint is then sent to the server so that the client-side fingerprint and the server-side fingerprint can be compared. If there exist any discrepancies between the client-side fingerprint and the server-side fingerprint, the user and/or the service provider may be alerted and/or notified. Additionally, other protective measures, such as page redirection, may occur if the two fingerprints do not match.
Turning again to
Alternatively, or in addition, the capability to inject or add a client-side script 428 to content 412 may reside within server 104. For example, a code injection module, later shown as 518, may inject or add a client-side script 428, as previously described, to the content 412, such that the server 104 provides the content and the script 416 to the computer system 108 via the communication network 112; in some instances, a code injector 408 external to the server 104 may not be necessary; in other instances, a code injector 408 may be provided in addition to a server 104 utilizing a code injection module 518.
Content and script 416 may then be provided to the computer system 108. As previously discussed, content and script 416 may be a combination of content 412 and at least one client-side script 428 that when executed at a client, creates a digital fingerprint 422 of one or more web pages. Content 412 is generally described as being web content or web page content. Thus, web content contained in content and script 416 may be rendered and/or displayed on computer system 108. Upon rendering and/or displaying the content 412, the script 428 containing executable code may be executed on the computer system 108. Alternatively, or in addition, the executable code 428 may be executed when a user clicks a submit button, such as a “log in” button 248. The executable code 428 then executes, creating a digital fingerprint 422 of the rendered or displayed web page 412 on the computer system 108 and sends the digital fingerprint 422 to server 104, via a communication network 112. Alternatively, or in addition the contents of the client information 423, and or the number of separate values contained in the client information 423, may also be sent to the server 104. The values included in the client information 423 correspond to the data entered and/or residing in fields, such as userid 240, password 244, and/or a malware variant added field, such as socialsecurity#308. The values included in the client information 423 may be sent with the digital fingerprint 422 together as 420 and/or they may be retrieved directly from the form, such as form 232, when the form posts data to the server 104. Alternatively, or in addition, the digital fingerprint 422 and/or the values included in the client information 423 may be encrypted prior to being sent to the server 104.
Once the digital fingerprint 422 is received at the server 104, the server 104 may compare the received digital fingerprint 422 with a fingerprint 424. As previously discussed, the server 104, or a server controlled by a services provider, may create the digital fingerprint 424 based on the web page or web content 412 that is to be presented to, or requested by a user of a computer system 108. The digital fingerprint 424 may then be stored at the server 104 or elsewhere for easy access. Alternatively, or in addition, the digital fingerprint 424 may be encrypted prior to being stored at server 104.
A server 104, or a server controlled by a services provider, may create the digital fingerprint 424 once for each web page that the services provider creates that requires a user to enter sensitive information, such as login information. After the digital finger print 424 has been created, the digital fingerprint 424 may be encrypted and stored. In some embodiments, the same digital fingerprint 424 may be valid or available for a predetermined period of time. For example, the digital fingerprint 424 may last a day, a month, a year, or be static. Alternatively, or in addition, the digital fingerprint 424 may be created specifically for a particular user, location of user—such as per internet protocol address, or may be created on a per session basis. For example, each time a user at computer system 108 established a session with server 104, a new fingerprint 424 may be created. In other embodiments, the creation of the server-side fingerprint 424 may occur randomly.
Turning now to
Processor 504 is provided to execute instructions contained within memory 506 and/or storage 502. As such, the functionality of the server 104 is typically stored in memory 506 and/or storage 502 in the form of instructions and carried out by the processor 504 executing such instructions. Accordingly, the processor 504 may be implemented as any suitable type of microprocessor or similar type of processing chip. One example of the processor 504 may include any general-purpose programmable processor, digital signal processor (DSP) or controller for executing application programming contained within memory 506 and/or storage 502. Alternatively, or in addition, the processor 504, memory 506, and/or storage 502, may be replaced or augmented with an application specific integrated circuit (ASIC), a programmable logic device (PLD), or a field programmable gate array (FPGA).
The memory 506 generally comprises software routines facilitating, in operation, pre-determined functionality of the server 104. The memory 506 may be implemented using various types of electronic memory generally including at least one array of non-volatile memory cells (e.g., Erasable Programmable Read Only Memory (EPROM) cells or FLASH memory cells, etc.). The memory 506 may also include at least one array of dynamic random access memory (DRAM) cells. The content of the DRAM cells may be pre-programmed and write-protected thereafter, whereas other portions of the memory may selectively be modified or erased. The memory 506 may be used for either permanent data storage and/or temporary data storage.
The data storage 502 may generally include storage for programs and data. For example, data storage 502 may provide storage for a finger print creation module 516, a code injection module 518, a fingerprint comparator module 520, and/or the general operating system and other programs and data 522. One or more components of the server 104 may communicate with one another utilizing a bus 514.
Code injector 408 may include a processor 526, memory 528, one or more communication interfaces 530 for communicating with the server 104, the computer system 108, and/or the communication network 112. In general, the code injector generally comprises one or more network appliances capable of inspecting, managing, and modifying network traffic communicating on the communication interface 530.
Processor 526 is the same or similar to processor 504; that is, processor 526 is provided to execute instructions contained within memory 528 and/or storage 524. As such, the functionality of the code injector 408 is typically stored in memory 528 and/or storage 524 in the form of instructions and carried out by the processor 526 executing such instructions. Accordingly, the processor 526 may be implemented as any suitable type of microprocessor or similar type of processing chip. One example of the processor 526 may include any general-purpose programmable processor, digital signal processor (DSP) or controller for executing application programming contained within memory 528 and/or storage 524. Alternatively, or in addition, the processor 526, memory 528, and/or storage 524, may be replaced or augmented with an application specific integrated circuit (ASIC), a programmable logic device (PLD), or a field programmable gate array (FPGA).
The memory 528 is similar or the same as memory 506; that is, memory 528 generally comprises software routines facilitating, in operation, pre-determined functionality of the code injector 408. The memory 528 may be implemented using various types of electronic memory generally including at least one array of non-volatile memory cells (e.g., Erasable Programmable Read Only Memory (EPROM) cells or FLASH memory cells, etc.). The memory 528 may also include at least one array of dynamic random access memory (DRAM) cells. The content of the DRAM cells may be pre-programmed and write-protected thereafter, whereas other portions of the memory may selectively be modified or erased. The memory 528 may be used for either permanent data storage or temporary data storage.
The data storage 524 is the same or similar to data storage 502; that is, data storage 524 may generally include storage for programs and data. For example, data storage 524 may provide storage for a code injection module 534 and the code injector 408 firmware 536. One or more components of the code injector 408 may communicate with one another utilizing a bus 532.
As previously discussed, computer system 108 may each be variously a personal computer 108A, 108C a server of any type, a PDA, mobile device 108B such as a mobile phone, an interactive television, or any other device capable of loading and operating computer objects. Computer system 108 may include one or more processors 540, memory 542, one or more user input devices 544, such as a keyboard and a pointing device, and one or more user output devices 548, such as a display, speaker, and/or printer. Alternatively, or in addition, the user input 544 and the user output 548 may be combined into one device, such as a touch screen display. Computer system 108 may further include a communication interface 546 for communicating with the code injector 408, the server 104, and/or the communication network 112.
Processor 540 is the same or similar to processor 504; that is, processor 540 is provided to execute instructions contained within memory 542 and/or storage 538. As such, the functionality of the computer system 108 is typically stored in memory 542 and/or storage 538 in the form of instructions and carried out by the processor 540 executing such instructions. Accordingly, the processor 540 may be implemented as any suitable type of microprocessor or similar type of processing chip. One example of the processor 540 may include any general-purpose programmable processor, digital signal processor (DSP) or controller for executing application programming contained within memory 542 and/or storage 538. Alternatively, or in addition, the processor 540, memory 542, and/or storage 538, may be replaced or augmented with an application specific integrated circuit (ASIC), a programmable logic device (PLD), or a field programmable gate array (FPGA).
The memory 542 is similar or the same as memory 506; that is, memory 542 generally comprises software routines facilitating, in operation, pre-determined functionality of the computer system 108. The memory 542 may be implemented using various types of electronic memory generally including at least one array of non-volatile memory cells (e.g., Erasable Programmable Read Only Memory (EPROM) cells or FLASH memory cells, etc.). The memory 542 may also include at least one array of dynamic random access memory (DRAM) cells. The content of the DRAM cells may be pre-programmed and write-protected thereafter, whereas other portions of the memory may selectively be modified or erased. The memory 542 may be used for either permanent data storage or temporary data storage.
The data storage 538 is the same or similar to data storage 502; that is, data storage 538 may generally include storage for programs and data. For example, data storage 538 may provide storage for an operating system, programs, and data 552. Storage 528 may also include browser 556. Although depicted separately, the browser 556 may render and cause web code or web content to be displayed to a user view a user output device, such as user output device 548. In general, the script 428 generally executes within browser 556, utilizing storage 538, memory 542, and processor 540. One or more components of the computer system 108 may communicate with one another utilizing a bus 550.
Referring now to
Method 600 is initiated at step 604. Method 600 may continuously flow in a loop, flow according to a timed event, or flow according to a change in an operating or status parameter. Once method 600 has started, the fingerprint creation module 516 receives the web content that is to be protected at step 608. For example, the web content may be a web page comprising various web code, such as HTML, XML, ASP, PHP, JavaScript etc. After receiving the content that is to be protected at step 608, method 600 may pass to step 612, where specific objects identified in the web content are identified for the fingerprint creation process. For example, field 240, field 244, the content within content area 228, and content area 236 may be identified as particular objects or elements that are specifically identified. Thus, if a fingerprint is created utilizing those specific elements, any change to those elements will be reflected as a different fingerprint. Moreover, changes to the web page made between such elements may be reflected as a different fingerprint.
More specifically, the objects may be identified by their corresponding location within a document object model (DOM) tree. For example, the document object model is a platform and language-neutral interface that allows programs and scripts to dynamically access and update the content, structure, and style of a document. For instance, a DOM may consist of one or more nodes; that is, each element (i.e. every HTML element, the content within an HTML element, HTML attributes, and comments) may be considered to be a node. As such, each element is typically ordered in a hierarchical tree structure such that some nodes depend on other nodes. Therefore, if one or more nodes are provided, and a dependency among the one or more nodes exists, any change to one node may be reflected in a fingerprint. As an example, the text “LOG IN TO YOUR ACCOUNT” within content area 236 may be a child node of the content area 232. If a fingerprint is created at step 616, utilizing this node, then any change to the content of this node will be reflected in a changed fingerprint. Moreover, the content of one or more elements may be utilized to create a fingerprint. Accordingly, a fingerprint created utilizing “LOG INTO YOUR ACCOUNT” will be different than a fingerprint created utilizing “LOG INTO YOUR ACCOUNT, WE NOW REQUIRE SS#s”.
As another example, the fingerprint creation process may utilize other objects, elements, and/or content located within a web page, resource, and/or document. For example, such objects may include but are not limited to tags, such as HTML tags, headers, iFrames, content, location of content, location of tags, location of objects, one or more scripts, one or more fields, one or more offsets associated with a particular element and/or object from a particular location of another element and/or object. The fingerprint may be created using one or more well known fingerprint creation techniques such as, but not limited, to hashing, concatenation, encryption, or any other fingerprint creation technique that provides an output representative of an input.
Alternatively, or in addition, the objects, elements, and/or content utilized to create the fingerprint may vary overtime and/or may be random. For example, a first fingerprint may be created using a first combination of objects, elements, and/or content of the web page, while a second finger print may be created using a second combination of objects, elements, and/or content of the web page. The first fingerprint may be created for a first user, session, or time, while the second fingerprint may be created for a second user, session, or time. Accordingly, the objects, elements, and/or content used to create a fingerprint may randomly change and/or be randomly identified. Alternatively, or in addition, one or more key, or important, objects, elements, and/or content may be identified such that the fingerprint may always include such importantly identified elements.
As previously discussed, at step 616, a fingerprint is created utilizing the objects elements, and/or content that have been identified. Additionally, at step 616, a client-side executable code, such as script 428, is created. This client-side executable code, or fingerprint script, is created such that when executed at a computer system, such as computer system 108, a fingerprint is created utilizing those same objects, elements, and or content identified in step 612. For example, if a first fingerprint of a website is created by the finger print creation module 516 using a first combination of objects, elements, and/or content of the web page, a client side executable code, such as script 428, is created such that when executed at a computer system 108, a fingerprint of the website, as rendered and/or displayed by the computer system 108, is created using the same first combination of objects, elements, and/or content. Method 600 then passes to step 620 where the fingerprint and the fingerprint script are stored. In some embodiments, the fingerprint may be encrypted prior to being stored. Method 600 then ends at step 624.
Referring now to
Method 700 is initiated at step 704. Method 700 may continuously flow in a loop, flow according to a timed event, or flow according to a change in an operating or status parameter. Once method 700 has started, the code injection module intercepts web content at step 708. More specifically, the code injection module may intercept a web page destined for a specified computer system 108. At step 712, the code injection module may inject or add the client-side script, such as script 428, to the web content destined for the computer system 108. For example, the code injection module may utilize specific rules, modify internet protocol traffic, and/or add a client-side script into the web content, such that the client-side script is executed at a browser 556 of a computer system 108. Next, the method 700 may pass to step 716, where the web content, including the client-side script, is delivered to the requestor, such as the computer system 108. Next, the method 700 may pass to step 720, where the client-side script is executed at the computer system 108. The execution of the client-side script, then produces a fingerprint of the of the web page or web content as displayed or rendered at the computer system 108, for example in the browser 556. Following the execution of the client-side script, the server 104 may receive the fingerprint at step 724. Next at step 728, the server 104 may retrieve the previously stored server-side fingerprint and compare the server-side fingerprint with the client-side fingerprint to determine if they match, such as at step 732. If the two fingerprints match, then there is a high likelihood that the web page displayed to a user at a computer system 108 is the same web page or web content that was sent from the server 104 to the computer system 108 and that malware has not adapted or modified any content. Accordingly, the method 700 may end at 742.
Alternatively, or in addition, the server 104 may receive the arguments that were submitted in fields, such as fields 240, and 244. The server may then perform a check to ensure that the server 104 received the proper number of values, or arguments at step 744. For example, if the server 104 is expecting to receive two values, such as an userid and a password, as shown in
If, at step 732, the server-side fingerprint, and the client-side fingerprint do not match, then the serve may take action at step 736. Such action may include redirecting a user of a computer system 108 to another website, logging information, such as the internet protocol address, and the values of fields submitted, and/or expressly notifying the user that their computer system 108 may be compromised.
Embodiments of the present invention have been described with particular reference to the examples illustrated. However, it will be appreciated that variations and modifications may be made to the examples described within the scope of the present invention. For example, in the foregoing description, for the purposes of illustration, methods were described in a particular order. It should be appreciated that in alternate embodiments, the methods may be performed in a different order than that described. It should also be appreciated that the methods described above may be performed by hardware components or may be embodied in sequences of machine-executable instructions.
Those of skill in the art would understand that information and signals may be represented using any of a variety of different technologies and techniques. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the above description may be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.
Those of skill would further appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
The various illustrative logical blocks, modules, and circuits described in connection with the embodiments disclosed herein may be implemented or performed with a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.
The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In the alternative, the processor and the storage medium may reside as discrete components in a user terminal.
The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
This application is a continuation of, and claims a benefit of priority under 35 U.S.C. 120 of, U.S. patent application Ser. No. 14/214,935 filed Mar. 15, 2014, entitled “DETECTING A CHANGE TO THE CONTENT OF INFORMATION DISPLAYED TO A USER OF A WEBSITE”, which claims a benefit of priority under 35 U.S.C. 119 to U.S. Provisional Application No. 61/802,348 filed Mar. 15, 2013, entitled “DETECTING A CHANGE TO THE CONTENT OF INFORMATION DISPLAYED TO A USER OF A WEBSITE”, all of which are hereby incorporated herein for all purposes.
| Number | Date | Country | |
|---|---|---|---|
| 61802348 | Mar 2013 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 14214935 | Mar 2014 | US |
| Child | 17729410 | US |
