Method and system for injecting javascript into a web page

Patent metadata

Field	Value
Publication number	US-10728274-B2
Application number	US-201615272452-A
Country	US
Kind code	B2
Filing date	Sep 22, 2016
Priority date	Sep 22, 2016
Publication date	Jul 28, 2020
Grant date	Jul 28, 2020

Abstract

Computerized methods and systems inspect data packets received from a web server for the presence of a value from a list of prohibited values. If a prohibited value is absent, a gateway injects at least one JavaScript code segment for execution by a web browser. The at least one JavaScript code segment includes a plurality of JavaScript functions which include at least one security analysis JavaScript function and a plurality of modified JavaScript functions. Each of the modified JavaScript functions is created from a respective native JavaScript function to include at least one code segment that when executed inspects for at least one of: a dynamic modification of at least one JavaScript function from a prohibited list of JavaScript functions, a dynamic creation of at least one JavaScript function from the prohibited list of JavaScript functions, or a dynamic reference to a value from the list of prohibited values.

First claim

What is claimed is:

1. A method for injecting JavaScript, comprising:
inspecting at least one packet, received from a web server, for the presence of at least one value from a list of prohibited values, wherein the at least one value from the list of prohibited values is indicative of a malicious attempt to modify at least one prohibited native JavaScript function that is built into the JavaScript programming language; and
should the at least one value be absent from the at least one packet, responding to the inspecting by injecting at least one JavaScript code segment for execution by a web browser, the at least one JavaScript code segment including a plurality of JavaScript functions, the plurality of JavaScript functions including at least one security analysis JavaScript function that sends inspection vectors when executed and a plurality of modified JavaScript functions, each of the modified JavaScript functions created from a respective native JavaScript function to include at least one code segment that when executed inspects for: a dynamic modification of at least one JavaScript function from a prohibited list of JavaScript functions, a dynamic creation of at least one JavaScript function from the prohibited list of JavaScript functions, and a dynamic reference to at least one value from the list of prohibited values.

2. The method of claim 1 , further comprising: executing at least one of the injected modified JavaScript functions based on identification of at least one event.

3. The method of claim 2 , further comprising: responding to the inspection as a result of the executing by taking at least one protective action.

4. The method of claim 2 , further comprising:
responding to the inspection as a result of the executing by not executing the respective native JavaScript function.

5. The method of claim 2 , wherein the at least one event includes at least one of a predetermined time interval or a trigger caused by the execution of code received from the web server.

6. The method of claim 1 , wherein the at least one security analysis JavaScript function includes at least one code segment which identifies malicious content in an HTML page, a JavaScript file, or a JavaScript code segment.

7. The method of claim 1 , wherein the executing is performed by a web browser is installed on an endpoint.

8. The method of claim 1 , wherein the inspecting of the at least one packet and the injecting are performed by a gateway that couples the web server to a web browser, the web server providing content of a web page to the web browser.

9. The method of claim 1 , further comprising:
should the at least one value be present in the at least one packet, responding to the inspecting by performing at least one of discarding the at least one packet, or terminating a connection with the web server.

10. The method of claim 1 , wherein the list of prohibited values is a predefined list, the predefined list including every tag, variable, function, method and object associated with the at least one security analysis JavaScript function.

11. The method of claim 1 , wherein at least one of the respective native JavaScript functions is selected from a group consisting of: eval( ), string( ), parseInt( ), remove( ), getElementById( ), getEelementsByClassName( ), and write( ).

12. The method of claim 1 , wherein the list of prohibited values includes at least one of a namespace, a tag, a variable, a function, a method or an object associated with at least one JavaScript function selected from the group consisting of: the modified JavaScript functions, or the native JavaScript functions from which the modified JavaScript functions are created.

13. The method of claim 1 , wherein the at least one packet forms at least part of an HTML page, a JavaScript file, or a JavaScript code segment.

14. The method of claim 13 , wherein the injecting includes:
locating the JavaScript code segment in the HTML page, the JavaScript file, or the JavaScript code segment, such that the modified JavaScript functions are the first code segments executed in the HTML page or JavaScript file, and such that the security analysis JavaScript function is the last or first code segment executed in the HTML page, the JavaScript file, or the JavaScript code segment.

15. The method of claim 1 , wherein the list of prohibited values includes the prohibited list of JavaScript functions.

16. A computer system for injecting JavaScript, comprising:
a gateway coupling a web server to a web browser, the gateway comprising:
a storage medium for storing computer components; and
a computerized processor for executing the computer components comprising:
a computer module configured for:
inspecting at least one packet, received from the web server, for the presence of at least one value from a list of prohibited values, wherein the at least one value from the list of prohibited values is indicative of a malicious attempt to modify at least one prohibited native JavaScript function that is built into the JavaScript programming language; and
should the at least one value be absent from the at least one packet, responding to the inspecting by injecting at least one JavaScript code segment for execution by a web browser, the at least one JavaScript code segment including a plurality of JavaScript functions, the plurality of JavaScript functions including at least one security analysis JavaScript function that sends inspection vectors when executed and a plurality of modified JavaScript functions, each of the modified JavaScript functions created from a respective native JavaScript function to include at least one code segment that when executed inspects for: a dynamic modification of a JavaScript function from a prohibited list of JavaScript functions, a dynamic creation of a JavaScript function from the prohibited list of JavaScript functions, and a dynamic reference to at least one value from the list of prohibited values.

17. The computer system of claim 16 , wherein the list of prohibited values includes at least one of a namespace, a tag, a variable, a function, a method or an object associated with at least one JavaScript function selected from the group consisting of: the modified JavaScript functions, or the native JavaScript functions from which the modified JavaScript functions were created.

18. The computer system of claim 16 , further comprising: an endpoint coupled to the gateway, the endpoint having a web browser installed thereon, the web browser configured to execute code in the at least one packet associated with an HTML page, a JavaScript file, or a JavaScript code segment received from the web server via the gateway.

19. The computer system of claim 18 , wherein the computer module is further configured for providing the at least one injected JavaScript code segment to the web browser, and wherein the web browser is further configured to execute at least one of the modified JavaScript functions.

20. The computer system of claim 18 , wherein the web browser is further configured to execute the at least one security JavaScript function based on at least one of a predetermined time interval or a trigger caused by the execution of code received from the web server.

21. The computer system of claim 16 , wherein should the at least one value be present in the at least one packet the computer module is further configured to respond to the inspecting by discarding the packet or terminating a connection with the web server.

22. The

Assignees

• Checkpoint Software Tech Ltd
• Check Point Software Tech Ltd

Inventors

• Uriel Ilan
• Mor Aviad

Classifications

• H04L63/168 Primary

  above the transport layer · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title