Most malicious web-based activity involves malicious javascript. Detecting and blocking malicious javascript is essential for preventing web-based compromises. Most malicious javascript is obfuscated, which renders static analysis, such as signature matching, approaches ineffective.
Legitimate javascript is also obfuscated so simply identifying obfuscation is insufficient. Too many false negative false positive fails. What is needed is a system to detect and prevent browser based malicious javascript contents.
A system that can detect and prevent browser based malicious javascript contents. MJD (Malicious Javascript Detection) is a pluggable module that achieves this by emulating html response in sandboxed browser environment that traces sensitive data access and dangerous function usage. MJD concentrates on detecting malicious javascript embedded in html response itself. The method comprises emulating html response in sandboxed browser environment that traces sensitive data access and dangerous function usage by detecting malicious javascript embedded in html response itself. The process includes
A method provides Dynamic Analysis comprising
tracing frequently used javascript feature used to either inject malicious javascript in html response or redirecting user to the website that is serving malicious contents.
The method of Dynamic Analysis further comprises the steps emulating the response received for client request in a sandboxed environment where use of sensitive javascript functions is traced and argument to those function are analyzed for malicious contents. Tracing is achieved by hooking and changing the implementation of those functions.
Dynamic Analysis: Dynamically trace frequently used javascript feature used to either inject malicious javascript in html response or redirecting user to the website that is serving malicious contents. Advantage of this approach is relatively shorter period of prototyping and reasonable performance.
Dynamic Analysis: Dynamic analysis is done by emulating the response received for client request in a sandboxed environment where use of sensitive javascript functions is traced and argument to those function are analyzed for malicious contents. Tracing is achieved by hooking and changing the implementation of those functions.
Sandboxed environment: This is a browser emulation environment created using Rhino and HtmlUnit.
The overall conceptual design for the system is shown in
1. A User Http request is received at a service
2. MN) examines and forwards the request to website
3. Receiving a Response from a website
3a. Embedded javascript if any transferred to Virtual Browser Environment
3b. Embedded javascript response traced by hooks on javascript actions
4. Analyzing response for malicious/suspicious behaviors
5. Enabling or blocking message to User from PWSS depending on result in (4)
Input expected: Html Response body.
Output intended: Categorization vulnerabilities found in response if any to at least one of the following categories:
There are two modules:
In an embodiment the response module receives a user request from a Purewire Service (pwss). Response module makes a request to the cloud and emulates the response if it is html. Response module only requests the embedding javascripts from the html page. Any other request such as for images or iframed src request are not requested because they may not contribute to the javascript execution of the page and performance impact on the response time could be significant. Also all these contents would need to be cached to keep system from any state related issues.
Patterns caught by response module:
In an embodiment, creating a browser emulation environment comprising Rhino and HtmlUnit, known in the art.
The steps include
receiving a user http request,
examining and forwarding the request to cloud,
receiving an embedded javascript response from the cloud
receiving an embedded javascript request if any from the cloud
forwarding the analyzed response if no malicious javascript
and blocking message to the user if malicious javascript found.
The method categorizes vulnerabilities into at least one of the following
The method further comprising operating a response module passing user request to the response module requesting to the cloud and emulates the response if it is html requesting the embedding javascripts from the html page no requests for images or iframed src request.
Methods include catching patterns by
The method further comprises tracing the cookie value manipulation and store modified cookie in the cookiejar as well to identify the cookie theft in event.
The method further comprises, in a request module,
A method embodiment for dynamically tracing frequently used javascript features to detect a uniform resource identifier provisioning a malicious javascript content in response to http requests comprises:
receiving a read request to a uniform resource locator (URL);
initializing a browser;
reading the requested URL;
loading a page comprising html and embedded javascript;
executing the javascript;
tracing execution of at least one frequently used javascript feature used to either redirect users to a website serving malicious contents or used to inject malicious javascript in html response, and
categorizing vulnerabilities and storing the URL when malicious contents are found.
In an embodiment, the frequently used javascript feature comprises one or more of fromCharCode( ) and unescape( ) whereby contents are decoded.
In an embodiment, the frequently used javascript feature comprises eval and its string argument comprises malicious keywords.
In an embodiment, the frequently used javascript feature comprises eval and its string argument comprises large unicode strings.
In an embodiment, the string argument of javascript feature eval is the decoded content and the method further comprises storing a vulnerability category 5.
In an embodiment, the frequently used javascript feature comprises CreateElement and the method further comprises counting the number of CreateElement instances in the javascript and comparing the number with a threshold, the method further comprises storing a vulnerability category 1.
In an embodiment, the frequently used javascript feature is document.write.
In an embodiment, the method further comprises finding a <script> tag and further comprises storing a vulnerability category 8.
In an embodiment, the method further comprises finding an <image> tag and further comprises storing a vulnerability category 8.
In an embodiment, the method further comprises finding an iframe ‘src“.
In an embodiment the method further comprises finding fromCharcode( ) and unescape( ) whereby the iframe contents have been decoded before document.write and the method further comprises storing a vulnerability category 3.
In an embodiment, the frequently used javascript feature comprises large memory write with unicode characters and the method further comprises storing a vulnerability category 1.
An other method embodiment comprises
In an embodiment the method further comprises tracing the cookie value manipulation and storing the modified cookie into the cookie jar to identify the cookie theft event.
The invention can be easily distinguished from conventional methods and systems by an apparatus embodiment which operates in the cloud in the middle where it identifies javascript in the response traffic and then requests the other corresponding javascript and can make a determination before delivering the original content to the user.
A related application is provisional application 61/273334 filed Aug. 3, 2009 Web Security Systems and Methods which is incorporated in its entirety by reference.
Number | Date | Country | |
---|---|---|---|
61273334 | Aug 2009 | US |