Feeds

Ex-Google, Mozilla bods to outwit EVIL BOTS with 'polymorphic' defence

ShapeShifter will see off automated attacks on websites

The Power of One eBook: Top reasons to choose HP BladeSystem

Startup Shape Security is re-appropriating a favourite tactic of malware writers in developing a technology to protect websites against automated hacking attacks.

Trojan authors commonly obfuscate their code to frustrate reverse engineers at security firms. The former staffers from Google, VMWare and Mozilla (among others) have created a network security appliance which takes a similar approach (dubbed real-time polymorphism) towards defending websites against breaches - by hobbling the capability of malware, bots, and other scripted attacks to interact with web applications.

Polymorphic code was originally used by malicious software to rewrite its own code every time a new machine was infected. Shape has invented patent-pending technology that is able to implement "real-time polymorphism" - or dynamically changing code - on any website. By doing this, it removes the static elements which botnets and malware depend on for their attacks.

How it works

When a ShapeShifter appliance protects a website, instead of encountering an application with fixed elements that are trivial to program an attack against, cybercriminals now face the difficult task of getting their malware to interact with a web app that is a moving target, constantly rewriting itself. This is done while keeping all of the user interaction functionality intact for legitimate users. And it works better than earlier approaches such as IP reputation or throttling, the pitch goes.

Shape Security said its technology is able to defend against common hacking attacks such as SQL injection attacks as well as attempts by hackers to brute force logins to websites and application layer DDoS attacks.

The technology, in development over the past two years, also defends against so-called man-in-the-browser attacks, which are commonly used in combination with Trojans on a victim's PC to defeat the additional layer of protection offered by two-factor authentication technology.

Shuman Ghosemajumder, Shape Security VP of strategy, told El Reg that its technology relies on deflecting automated attacks rather than detection. Detection of attacks based on signatures or heuristics, is an approach taken by established technologies such as Web Application Firewalls. Ghosemajumder explained how ShapeShifter is designed to screw up automated attack code without messing things up for regular users.

"ShapeShifter institutes the same new policy for every website visitor, regardless of whether it is a legitimate user or an attacker: real-time polymorphism," he told El Reg. By constantly rewriting the code of the website's user interface, malware, bots, and scripts simply have their capability to attack the website disabled, since their own attack instructions, as coded by their authors, are rendered immediately out-of-date and invalid. Meanwhile, real users, who do not interact directly with the website's underlying user interface code, are unaffected."

No change to a customer web applications is needed in order to deploy the technology, Ghosemajumder adds.

Shape Security raised $26m in funding from investors including Google Ventures, Kleiner Perkins Caufield & Byers, Google chairman Eric Schmidt’s TomorrowVentures, and former Symantec chief exec Enrique Salem. Its business model is still being refined.

"The pricing model is still being finalised, but we are considering a subscription model as well as an appliance sales model," Ghosemajumder explained. "For early adopters we have focused on an unlimited use model and seven-figure enterprise-wide deals. We have achieved bookings in the low seven figures already and are estimating bookings of low eight figures in 2014." ®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.