Feeds

Ex-Google, Mozilla bods to outwit EVIL BOTS with 'polymorphic' defence

ShapeShifter will see off automated attacks on websites

Beginner's guide to SSL certificates

Startup Shape Security is re-appropriating a favourite tactic of malware writers in developing a technology to protect websites against automated hacking attacks.

Trojan authors commonly obfuscate their code to frustrate reverse engineers at security firms. The former staffers from Google, VMWare and Mozilla (among others) have created a network security appliance which takes a similar approach (dubbed real-time polymorphism) towards defending websites against breaches - by hobbling the capability of malware, bots, and other scripted attacks to interact with web applications.

Polymorphic code was originally used by malicious software to rewrite its own code every time a new machine was infected. Shape has invented patent-pending technology that is able to implement "real-time polymorphism" - or dynamically changing code - on any website. By doing this, it removes the static elements which botnets and malware depend on for their attacks.

How it works

When a ShapeShifter appliance protects a website, instead of encountering an application with fixed elements that are trivial to program an attack against, cybercriminals now face the difficult task of getting their malware to interact with a web app that is a moving target, constantly rewriting itself. This is done while keeping all of the user interaction functionality intact for legitimate users. And it works better than earlier approaches such as IP reputation or throttling, the pitch goes.

Shape Security said its technology is able to defend against common hacking attacks such as SQL injection attacks as well as attempts by hackers to brute force logins to websites and application layer DDoS attacks.

The technology, in development over the past two years, also defends against so-called man-in-the-browser attacks, which are commonly used in combination with Trojans on a victim's PC to defeat the additional layer of protection offered by two-factor authentication technology.

Shuman Ghosemajumder, Shape Security VP of strategy, told El Reg that its technology relies on deflecting automated attacks rather than detection. Detection of attacks based on signatures or heuristics, is an approach taken by established technologies such as Web Application Firewalls. Ghosemajumder explained how ShapeShifter is designed to screw up automated attack code without messing things up for regular users.

"ShapeShifter institutes the same new policy for every website visitor, regardless of whether it is a legitimate user or an attacker: real-time polymorphism," he told El Reg. By constantly rewriting the code of the website's user interface, malware, bots, and scripts simply have their capability to attack the website disabled, since their own attack instructions, as coded by their authors, are rendered immediately out-of-date and invalid. Meanwhile, real users, who do not interact directly with the website's underlying user interface code, are unaffected."

No change to a customer web applications is needed in order to deploy the technology, Ghosemajumder adds.

Shape Security raised $26m in funding from investors including Google Ventures, Kleiner Perkins Caufield & Byers, Google chairman Eric Schmidt’s TomorrowVentures, and former Symantec chief exec Enrique Salem. Its business model is still being refined.

"The pricing model is still being finalised, but we are considering a subscription model as well as an appliance sales model," Ghosemajumder explained. "For early adopters we have focused on an unlimited use model and seven-figure enterprise-wide deals. We have achieved bookings in the low seven figures already and are estimating bookings of low eight figures in 2014." ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.