The dynamic Web is making it much more difficult for run-of-the-mill security technologies to pin down malicious content, as malware authors use the same technology that makes it easy for Web app developers to change Web content on the fly to hide malware on a site.
We recently caught up with Sarit Kozokin, director of product management for Trustwave, for a Q&A about how the dynamic nature of the today's typical Web content and new attack techniques require a shift in the way content security looks for malicious code.
Q: Would you say there are limitations in most of today's content-examining technologies?
A: Yes. The problem with many of the content security options on the market today is that they examine code elements in isolation. They're looking at these elements statically to root out malicious indicators that these elements may be capable of bad stuff. The problem is that the way the bulk of websites work today is that they use technology like PHP, J2EE and ASP.NET to deliver up dynamic Web content based on these elements.
Certain elements of code and content only come into play if specific variables or conditions are met. Otherwise they just don't execute or display. This offers Web site developers a ton of flexibility, but it also presents the perfect way for malicious hackers to hide evidence of what's lurking on a site. They essentially use HTML elements to hide executable JavaScript elements. That way all the pieces that make up an attack that is built dynamically once conditions are just right seem safe at rest. It's only when the code is put together for execution that the real intent is revealed. The code doesn't become malicious until all of the pieces across the site are put together and executed.
Q: How can new tech overcome these limitations?
A: When code is designed for dynamic attacks, the only way to see through the obfuscation is to examine how the code acts when executed. This means that content security techniques can only be effective if they're examining websites through the lens of some kind of simulation of how the code runs.
This is exactly the principle we've used to design the Malware Entrapment Engine in the Trustwave Secure Web Gateway. It works by using what's called Document Object Model (DOM) analysis. DOM is an application programming interface for HTML and XML documents that defines the logical structure of documents and the way a document is access and manipulated.
The motivation of the new design of our Entrapment Engine is the understanding that our gateway couldn't just be examining content statically a piece at a time. We recognized that in order to be effective, content security must be able to inspect a webpage holistically, looking at all of the embedded objects or resources like JavaScript or CSS files so it can detect dynamic capabilities and understand the real intent of how the code is supposed to execute.
Q: What kind of attacks does this thwart?
A: The beauty of the Entrapment Engine is that it doesn't just look for exploits from a set signature of potential attacks. It takes a bigger picture view, identifying conditions that would result in exploitation. The technology is keyed into the code's potential malicious behavior. This kind of inspection can be made across all potential vectors of attack, including HTML, JavaScript, VBScript and PDF.
This is a huge advance in helping organizations detect zero-day attacks, which go after previously unknown vulnerabilities using never-before-seen exploits. Attackers target zero-day vulnerabilities because they know there is necessarily a window of opportunity for them to attack unknown vulnerabilities until security vendors can scramble to put a patch together and add the attack to signatures.
By taking this behavioral, conditions-based approach, the Entrapment Engine offers an effective means of zero-day protection. We've found that it essentially closes the 60 percent malware gap that exists in other content secure Web gateways.
To learn more about the Trustwave Secure Web Gateway Malware Entrapment Engine, check out our latest whitepaper [PDF] that more fully explains how the technology works.
