In-depth

Stopping automated attacks with shapeshifting websites

How we can defend against automated attacks? Tom Brewster takes a look...

A moving target is always harder to hit than a stationary one. IT security types have exploited this fact for years, but never before has a service come along that shifts around the high-level of a website's code to thwart attacks.

But that's what the geniuses at Shape Security, who have histories at Google and the US Department of Defense, have done. After two years of development, they've found a way to alter HTML, CSS and JavaScript code without altering the user experience. The algorithms figure out fresh ways to do that with every webpage visit. The ultimate idea of this polymorphism is to stop automated tools probing for predictable weaknesses, as they won't be able to detect them if the structure of the site is scrambled on each request.

This is big. If the major banks apply this kind of technology, it will significantly weaken the majority of banking malware out there. It's no surprise the company's first customers are in the financial industry.

Shuman Ghosemajumder, vice president of strategy at Shape, explains how this actually helps: "What this means is that it now becomes difficult or even impossible to be able to script an attack against the application because it is no longer reliably static. [An attacker] won't know how to get their code to interact with the web application's code anymore."

Automated vulnerability scanners will have no hope against these shapeshifting sites and application layer distributed denial of service attacks should be limited by the technology too. But where I see this technology being really valuable is in the banking sector.

Advertisement
Advertisement - Article continues below

Prevalent financial man-in-the-browser malware like Zeus has long caused issues for banks, costing the millions upon millions of pounds over recent years. Such malware contain scripts that automatically out commands on bank websites as the customer visits them, initiating transactions silently. "What we do is prevent the Trojan from successfully being able to send commands to the banks website anymore," Ghosemajumder notes.

HTML web injects, where the malware replaces pieces of the bank's website, such as the login form, would be impossible too. Any attempt to inject code in this way would corrupt the page "pretty horrendously," Ghosemajumder adds.

This is big. If the major banks apply this kind of technology, it will significantly weaken the majority of banking malware out there. It's no surprise the company's first customers are in the financial industry.

Featured Resources

The essential guide to cloud-based backup and disaster recovery

Support business continuity by building a holistic emergency plan

Download now

Trends in modern data protection

A comprehensive view of the data protection landscape

Download now

How do vulnerabilities get into software?

90% of security incidents result from exploits against defects in software

Download now

Delivering the future of work - now

The CIO’s guide to building the unified digital workspace for today’s hybrid and multi-cloud strategies.

Download now
Advertisement

Most Popular

Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/hardware/354232/raspberry-pi-4-owners-complain-of-broken-wi-fi-when-using-hdmi
Hardware

Raspberry Pi 4 owners complain of broken Wi-Fi when using HDMI

29 Nov 2019
Visit/mobile/mobile-phones/354222/samsung-sails-past-apples-market-share-despite-smartphone-market-slump
Mobile Phones

Samsung sails past Apple's market share despite smartphone market slump

28 Nov 2019
Visit/mobile/google-android/354189/samsung-galaxy-a90-5g-review-simply-the-best-value-5g-phone
Google Android

Samsung Galaxy A90 5G review: Simply the best value 5G phone

22 Nov 2019