Automated hardening of web page content

Patent metadata

Field	Value
Publication number	US-9800602-B2
Application number	US-201414502893-A
Country	US
Kind code	B2
Filing date	Sep 30, 2014
Priority date	Sep 30, 2014
Publication date	Oct 24, 2017
Grant date	Oct 24, 2017

Abstract

Methods and apparatus are described for automatically modifying web page source code to address a variety of security vulnerabilities such as, for example, vulnerabilities that are exploited by mixed content attacks.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving source code and one or more headers corresponding to a web page requested by a client device;
using one or more physical processors, rendering the source code to generate rendered code;
using one or more of the physical processors, processing the rendered code to identify one or more security vulnerabilities including identification of an unsecure channel corresponding to a resource identified by the source code;
wherein processing the rendered code includes identifying a first reference in the source code to the resource to retrieve the resource via the unsecure channel;
using one or more of the physical processors, automatically modifying, responsive to processing the rendered code, one or both of the source code and the one or more headers thereby generating modified code, including inserting first code in the source code, the first code being configured to access the resource or content associated with the resource via a secure channel;
wherein modifying the source code includes removing the first reference to the resource, adding a second reference to the resource specifying a security directive requiring use of the secure channel by a browser on the client device, and causing the resource to be hosted on a secure server or domain; and
transmitting the modified code to the client device.

2. The method of claim 1 , further comprising determining that the resource does not support secure communication.

3. The method of claim 1 , further comprising determining that the resource supports communication via the secure channel.

4. The method of claim 2 , further comprising causing, responsive to determining that the resource does not support secure communication, the content associated with the resource to be stored at a secure location, the secure location being accessible via the secure channel.

5. The method of claim 1 , further comprising causing the resource or the content associated with the resource to be hosted in a secure server or domain, and wherein the first code is configured to access the resource or the content associated with the resource at the secure server or domain.

6. The method of claim 1 , wherein the resource is an executable script.

7. The method of claim 1 , wherein modifying one or both of the source code and the one or more headers includes specifying an X-Frame options header, or inserting frame-breaking code in the source code.

8. The method of claim 1 , further comprising determining whether one or more modifications to the source code would result in the web page being undeliverable to the client device.

9. The method of claim 1 , further comprising:
generating a report specifying the one or more security vulnerabilities;
transmitting the report to a representative of a web site operator from which the web page originated; and
receiving authorization from the representative of the web site operator to proceed with modification of one or both of the source code and the one or more headers.

10. The method of claim 1 , wherein modifying one or both of the source code and the one or more headers includes specifying one or more security directives for use by a browser on the client device.

11. The method of claim 1 , further comprising intercepting a request for the web page from the client device.

12. A system, comprising:
memory; and
one or more physical processors configured to:
receive source code and one or more headers corresponding to a web page requested by a client device;
render the source code to generate rendered code;
process the rendered code to identify one or more security vulnerabilities by identifying an unsecure channel corresponding to a resource identified by the source code;
wherein processing the rendered code includes identifying a first reference in the source code to the resource to retrieve the resource via the unsecure channel;
automatically modify, responsive to processing the rendered code, one or both of the source code and the one or more headers thereby generating modified code, including inserting first code in the source code, the first code being configured to access the resource or content associated with the resource via a secure channel;
wherein modifying the source code includes removing the first reference to the resource, adding a second reference to the resource specifying a security directive requiring use of the secure channel by a browser on the client device, and causing the resource to be hosted on a secure server or domain; and
transmit the modified code to the client device.

13. The system of claim 12 , wherein the one or more processors are further configured to determine that the resource does not support secure communication.

14. The system of claim 12 , wherein the one or more processors are further configured to determine that the resource supports communication via the secure channel.

15. The system of claim 13 , wherein the one or more processors are further configured to cause, responsive to determining that the resource does not support secure communication, the content associated with the resource to be stored at a secure location, the secure location being accessible via the secure channel.

16. The system of claim 12 , wherein the the resource is an executable script.

17. The system of claim 12 , wherein the one or more processors are configured to modify one or both of the source code and the one or more headers by specifying an X-Frame options header, or inserting frame-breaking code in the source code.

18. The system of claim 12 , wherein the one or more processors are further configured to determine whether one or more modifications to the source code would result in the web page being undeliverable to the client device.

19. The system of claim 12 , wherein the one or more processors are further configured to:
generate a report specifying the one or more security vulnerabilities;
transmit the report to a representative of a web site operator from which the web page originated; and
receive authorization from the representative of the web site operator to proceed with modification of one or both of the source code and the one or more headers.

20. The system of claim 12 , wherein the one or more processors are configured to modify one or both of the source code and the one or more headers by specifying one or more security directives for use by a browser on the client device.

21. The system of claim 12 , wherein the one or more processors are further configured to intercept a request for the web page from the client device.

22. A computer program product, comprising one or more non-transitory computer-readable media having computer program instructions stored therein, the computer program instructions being configured such that, when executed by one or more computing devices, the computer program instructions cause the one or more computing devices to:
receive source code and one or more headers corresponding to a web page requested by a client device;
render the source code to generate rendered code;
process the rendered code to identify one or more security vulnerabilities by identifying an unsecure channel corresponding to a resource identified by the source code;
wherein processing the rendered code includes identifying a first reference in the source code to the resource to retrieve the resource via the unsecure channel;
automatically modify, responsive to processing the rendered co

Assignees

• Shape Security Inc

Inventors

• Shekyan Sergey
• Coates Michael
• Hales Wesley
• Peacock Tim
• Call Justin

Classifications

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/568

  eliminating virus, restoring damaged files · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F16/958

  Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking · CPC title