Feeds

Ex-Google, Mozilla bods to outwit EVIL BOTS with 'polymorphic' defence

ShapeShifter will see off automated attacks on websites

Choosing a cloud hosting partner with confidence

Startup Shape Security is re-appropriating a favourite tactic of malware writers in developing a technology to protect websites against automated hacking attacks.

Trojan authors commonly obfuscate their code to frustrate reverse engineers at security firms. The former staffers from Google, VMWare and Mozilla (among others) have created a network security appliance which takes a similar approach (dubbed real-time polymorphism) towards defending websites against breaches - by hobbling the capability of malware, bots, and other scripted attacks to interact with web applications.

Polymorphic code was originally used by malicious software to rewrite its own code every time a new machine was infected. Shape has invented patent-pending technology that is able to implement "real-time polymorphism" - or dynamically changing code - on any website. By doing this, it removes the static elements which botnets and malware depend on for their attacks.

How it works

When a ShapeShifter appliance protects a website, instead of encountering an application with fixed elements that are trivial to program an attack against, cybercriminals now face the difficult task of getting their malware to interact with a web app that is a moving target, constantly rewriting itself. This is done while keeping all of the user interaction functionality intact for legitimate users. And it works better than earlier approaches such as IP reputation or throttling, the pitch goes.

Shape Security said its technology is able to defend against common hacking attacks such as SQL injection attacks as well as attempts by hackers to brute force logins to websites and application layer DDoS attacks.

The technology, in development over the past two years, also defends against so-called man-in-the-browser attacks, which are commonly used in combination with Trojans on a victim's PC to defeat the additional layer of protection offered by two-factor authentication technology.

Shuman Ghosemajumder, Shape Security VP of strategy, told El Reg that its technology relies on deflecting automated attacks rather than detection. Detection of attacks based on signatures or heuristics, is an approach taken by established technologies such as Web Application Firewalls. Ghosemajumder explained how ShapeShifter is designed to screw up automated attack code without messing things up for regular users.

"ShapeShifter institutes the same new policy for every website visitor, regardless of whether it is a legitimate user or an attacker: real-time polymorphism," he told El Reg. By constantly rewriting the code of the website's user interface, malware, bots, and scripts simply have their capability to attack the website disabled, since their own attack instructions, as coded by their authors, are rendered immediately out-of-date and invalid. Meanwhile, real users, who do not interact directly with the website's underlying user interface code, are unaffected."

No change to a customer web applications is needed in order to deploy the technology, Ghosemajumder adds.

Shape Security raised $26m in funding from investors including Google Ventures, Kleiner Perkins Caufield & Byers, Google chairman Eric Schmidt’s TomorrowVentures, and former Symantec chief exec Enrique Salem. Its business model is still being refined.

"The pricing model is still being finalised, but we are considering a subscription model as well as an appliance sales model," Ghosemajumder explained. "For early adopters we have focused on an unlimited use model and seven-figure enterprise-wide deals. We have achieved bookings in the low seven figures already and are estimating bookings of low eight figures in 2014." ®

Remote control for virtualized desktops

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Managing SSL certificates with ease
The lack of operational efficiencies and compliance pitfalls associated with poor SSL certificate management, and how the right SSL certificate management tool can help.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.