Shape Security, Inc.

Other

Marc R Hansen

Justin David Call

Subramanian Varadarajan

Xiaoming Zhou

Xiaohan Huang

Sumit Agarwal

Xinran Wang

Bryan D Hanks

Xiaochan Huang

Roger S Hoover

Shuman Ghosemajumder

Shishir Krovvidi Ramam

Techniques are provided for request modification for web security challenge. Data corresponding to a web page request by a client computing device for a web page is received. The web page comprises web code that allows a user to submit a request to initiate a web transaction with a web server system. Challenge code is generated that determines one or more values that are a valid solution to a challenge. The challenge code is provided for integrated code to be served in response to the web page request. The integrated code comprises the challenge code and modified web code that adds one or more parameters for the valid solution to the request. A particular request is received to initiate the web transaction. It is determined that the one or more parameter values are not a valid solution. In response, the web server system is prevented from processing the particular request.

Request modification for web security challenge

An API call filtering system filters responses to API call requests received, via a network, from UEs. The API call filtering system is configured to require personalized API call requests wherein each API call (except for some minor exceptions) includes a unique UE identifier ('UEIN') of the UE making the request. Using the UEIN, the web service or other service protected by the API call filtering system can be secured against excessive request iterations from a set of rogue UEs while allowing for ordinary volumes of requests of requests the UEs, wherein one or more boundaries between what is deemed to be an ordinary volume of requests and what is deemed to be excessive request iterations are determined by predetermined criteria.

Using individualized APIs to block automated attacks on native apps and/or purposely exposed APIs with forced user interaction

This document describes, among other things, a computer-implemented method for improving the security of one or more computing systems. The method can include receiving, at a computing system, first code that defines at least a portion of an electronic resource that is to be served to a client computing device. The method can include generating code that defines a challenge to be solved by the client computing device, in which the code is arranged to cause the client computing device to determine values for one or more parameters that comprise a solution to the challenge, and the values for the one or more parameters that comprise the solution to the challenge may be required for the client computing device to make valid requests to initiate one or more web-based transactions. The computing system can determine whether particular values for the parameters comprise a valid solution to the challenge.

Asymmetrical challenges for web security

Blocking automated attacks with forced user interaction

A computer-implemented method for coordinating content transformation includes receiving, at a computer server subsystem and from a web server system, computer code to be served in response to a request from a computing client over the internet; modifying the computer code to obscure operation of the web server system that could be determined from the computer code; generating transformation information that is needed in order to reverse the modifications of the computer code to obscure the operation of the web server system; and serving to the computing client the modified code and the reverse transformation information.

Stateless web content anti-automation

Techniques are provided for using instrumentation code to detect bots or malware. Data corresponding to requests from a plurality of client devices for a web resource comprising web code is obtained. The web resource is hosted by a first web server system. For a first client device of the plurality of client devices, instrumentation code is served. The instrumentation code is configured to execute on the first client device to monitor execution of the web code of the web resource at the first client device. One or more responses generated by the instrumentation code at the first client device are received from the first client device. The one or more responses are based one or more interactions with the web code at the first client device.

Using instrumentation code to detect bots or malware

A computer-implemented method for identifying abnormal computer behavior includes receiving, at a computer server subsystem, data that characterizes subsets of particular document object models for web pages rendered by particular client computers; identifying clusters from the data that characterize the subsets of the particular document object models; and using the clusters to identify alien content on the particular client computers, wherein the alien content comprises content in the document object models that is not the result of content that is the basis of the document object model served.

Protecting a server computer by detecting the identity of a browser on a client computer

A computer-implemented method includes receiving, at a primary security sub-system, code to be served from a web server system to one or more computing devices; forwarding a representation of the code to a secondary security sub-system that is remote from the primary security sub-system; receiving, from the secondary sub-system and in response to the forwarding, a template created from analysis of the representation of the code that indicates changes to be made to the code and locations of the changes; and using the template to recode the code, by the primary security sub-system, before serving the code to the one or more computing devices.

Background analysis of web content

In one implementation, a computer-implemented method can identify abnormal computer behavior. The method can receive, at a computer server subsystem and from a web server system, computer code to be served in response to a request from a computing client over the internet. The method can also modify the computer code to obscure operational design of the web server system that could be determined from the computer code, and supplement the computer code with instrumentation code that is programmed to execute on the computing client. The method may serve the modified and supplemented computer code to the computing client.

Protecting against the introduction of alien content

Detecting the introduction of alien content

A computer-implemented method involves identifying an initial element for serving by a web server system to a client device and recoding the element by creating a plurality of different elements that each represent a portion of the initial element. The different elements are then served in place of the initial element. A response is received form the client device and has portions that correspond to the different elements, and a combined response is created by combining the received portions in a manner that corresponds to a manner in which the initial element was recoded to create the plurality of different elements.

Dynamic field re-rendering

In some implementations, a computer system for obfuscating text in an electronic document can include an analysis module, a font data repository, a re-coding module, and a data interface. The analysis module is operable to identify strings of text from an electronic document. The font data repository can include one or more character maps that correlate, for each character map in the one or more character maps, a first set of characters with a respective different second set of characters. The re-coding module can generate a re-coded document by re-mapping, using a particular one of the one or more character maps, the identified strings of text into corresponding obfuscated strings of text, and by replacing the identified strings of text with the corresponding obfuscated strings of text from the electronic document. The data interface can transmit the re-coded document to a client computing device.

Content modification in served code

A coupled set of servers in a server system protect an application programming interface ('API') from unwanted automation facilitated by unauthorized reverse engineering of an endpoint app or communications channel used by the endpoint app. The server system comprises at least one secure app update server that transforms an app code object received from an enterprise app server into a transferred app code object, and at least one secure application programming interface ('API') server that interacts with an endpoint device that executes the transformed app code object. The secure API is adapted to convert API requests made by the transformed app code object into renormalized API requests formatted for processing by an enterprise API server. The transforming of the app code object results in API requests from the client that would constitute invalid API requests if presented to the enterprise API server without renormalization.

Growing community of inventors

Mountain View, CA, United States of America

Marc R Hansen