Immunizing HTML browsers and extensions from known vulnerabilities

• US 20070016948A1
• Filed: 07/15/2005
• Published: 01/18/2007
• Est. Priority Date: 07/15/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Wang, Jiahe, Dubrovsky, Opher, Ein-Gil, Boaz
• Granted Patent: US 8,225,392 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

An exemplary computer-implementable method (300) transforms or “immunizes” information to reduce or eliminate risk of exploitation of a known vulnerabilty of a software service and includes receiving information (304) in response to a request, transforming the information (308) to produce transformed information and sending the transformed information (312). An exemplary firewall server (112) includes server software (144, 148) that allows the firewall server (112) to receive information from a resource (104, 108) via a network and to send information to a client computer (114) and an immunization component (264, 268) for immunizing the information to prevent exploitation of a vulnerabilty of browser software (154) on the client computer (114). Various other exemplary methods, devices, systems, etc., are also disclosed.

Claims

1. A computer-implementable method (300) comprising:

receiving information (304) in response to a request wherein the received information is for consumption by a software service;

transforming the received information (308) to produce transformed information wherein the transforming transforms the received information to reduce or eliminate the received information'"'"'s ability to exploit a known vulnerability of the software service; and

sending the transformed information (312).

2. The computer-implementable method of claim 1 wherein a server (112) receives the information in response to a client'"'"'s (114) request.

3. The computer-implementable method of claim 2 wherein the information resides on a different server (104, 108).

4. The computer-implementable method of claim 1 wherein the sending sends the transformed information from a server (104, 108, 112) to a client (114, 118).

5. The computer-implementable method of claim 1 wherein the transforming the received information comprises checking the information (608, 708) for its ability to exploit a browser software vulnerability.

6. The computer-implementable method of claim 1 wherein the received information comprises HTML code.

7. The computer-implementable method of claim 1 wherein the received information comprises script.

8. The computer-implentable method of claim 1 wherein the received information comprises a web page capable of being displayed using a browser software service.

9. The computer-implementable method of claim 1 wherein the transforming the received information comprises inserting a hook in the received information (718).

10. The computer-implementable method of claim 9 wherein the hook calls a function in response to a runtime event.

11. The computer-implementable method of claim 1 further comprising determining if a URL corresponds to a trusted resource.

12. The computer-implementable method of claim 11 further comprising deciding whether to transform the received information based on the determining.

13. One or more computer-readable media having computer-executable instructions for performing the method of claim 1.

14. A computer-implementable method comprising:

receiving HTML code (704) that includes script; and

inserting a hook into the HTML code (718) wherein the hook responds to a runtime event to call for action to prevent exploitation of a browser software vulnerability by the script.

15. The computer-implementable method of claim 14 wherein the hook comprises an event handle hook (874) that calls a function (854).

16. The computer-implementable method of claim 15 wherein the function (854) determines if the HTML code exploits a browser software vulnerability.

17. One or more computer-readable media having computer-executable instructions for performing the method of claim 14.

18. A firewall server (112) comprising:

server software (144, 148) that allows the firewall server (112) to receive information from a resource (104, 108) via a network and to send information to a client computer (114); and

an immunization component (264, 268) for immunizing the information to prevent exploitation of a vulnerability of browser software (154) on the client computer (114).

19. The firewall server (112) of claim 18 wherein the server software (144, 148) further allows the firewall server (112) to receive a URL from the client computer (114) wherein the URL corresponds to a resource (104, 108) accessible via the network.

20. The firewall server of claim 19 wherein the firewall server (112) further comprises a trust component (462, 464) to determine if the URL is associated with a trusted resource and, based at least in part on the determination, deciding whether to receive the information from the resource or to immunize the information received from the resource using the immunization component (264, 268).