Stopping automated attacks with shapeshifting websites
How we can defend against automated attacks? Tom Brewster takes a look...
A moving target is always harder to hit than a stationary one. IT security types have exploited this fact for years, but never before has a service come along that shifts around the high-level of a website's code to thwart attacks.
Shuman Ghosemajumder, vice president of strategy at Shape, explains how this actually helps: "What this means is that it now becomes difficult or even impossible to be able to script an attack against the application because it is no longer reliably static. [An attacker] won't know how to get their code to interact with the web application's code anymore."
Automated vulnerability scanners will have no hope against these shapeshifting sites and application layer distributed denial of service attacks should be limited by the technology too. But where I see this technology being really valuable is in the banking sector.
Prevalent financial man-in-the-browser malware like Zeus has long caused issues for banks, costing the millions upon millions of pounds over recent years. Such malware contain scripts that automatically out commands on bank websites as the customer visits them, initiating transactions silently. "What we do is prevent the Trojan from successfully being able to send commands to the banks website anymore," Ghosemajumder notes.
HTML web injects, where the malware replaces pieces of the bank's website, such as the login form, would be impossible too. Any attempt to inject code in this way would corrupt the page "pretty horrendously," Ghosemajumder adds.
This is big. If the major banks apply this kind of technology, it will significantly weaken the majority of banking malware out there. It's no surprise the company's first customers are in the financial industry.
In This Article
Four strategies for building a hybrid workplace that works
All indications are that the future of work is hybrid, if it's not here alreadyFree webinar
The digital marketer’s guide to contextual insights and trends
How to use contextual intelligence to uncover new insights and inform strategiesFree Download
Ransomware and Microsoft 365 for business
What you need to know about reducing ransomware riskFree Download
Building a modern strategy for analytics and machine learning success
Turning into business valueFree Download