Passive detection of digital skimming attacks
Techniques to facilitate prevention of malicious attacks on a web service are disclosed herein. In at least one implementation, web resources associated with the web service are crawled to obtain information about internal and external web assets associated with the web service. Responses from the internal and external web assets are intercepted and content security policy headers are dynamically injected into the responses to determine internal and external dependency data associated with the internal and external web assets. The internal and external dependency data is processed with script reputation and domain reputation data to generate enriched dependency graph data. The enriched dependency graph data is analyzed to dynamically generate content security policies for the web service, and the dynamically generated content security policies are deployed to protect the web service.
1 . A method comprising:
obtaining a Uniform Resource Locator (URL) of a web asset associated with a website;
crawling the URL to identify an external domain that communicates with the web asset;
intercepting a communication between the web asset and the external domain;
injecting a Content Security Policy (CSP) header into the communication to collect CSP and Subresource Integrity (SRI) information;
determining a dependency of the web asset based on the CSP and SRI information;
generating a dependency graph based on the dependency, script reputation data associated with a script of the web asset, and domain reputation data associated with the external domain;
creating a CSP policy based on the dependency graph; and
deploying the CSP policy to protect the website.
2 . The method of claim 1 further comprising obtaining the script reputation data and domain reputation data from publicly available reputation information.
3 . The method of claim 1 further comprising utilizing a scoring algorithm to generate the script reputation data and domain reputation data.
4 . The method of claim 1 further comprising:
intercepting an additional communication between the web asset and an additional external domain;
injecting the CSP header into the communication to collect additional CSP and SRI information;
determining a new dependency of the web asset based on the additional CSP and SRI information;
updating the dependency graph based on the new dependency, the script reputation data associated with the script of the web asset, and additional domain reputation data associated with the additional external domain;
updating the CSP policy based on the updated dependency graph; and
deploying the updated CSP policy to protect the website.
5 . The method of claim 1 further comprising providing the CSP policy to a web client accessing the website via a browser; and wherein
providing the CSP policy causes the browser of the web client to verify the web asset based on the CSP policy.
6 . The method of claim 1 further comprising:
determining for a hosting provider or a name server associated with the external domain, a ratio of a number of unique domains to a number of unique companies or entities to determine a risk score of the hosting provider or name server associated with the external domain; and wherein
generating the dependency graph comprises generating the dependency graph based on the dependency, the script reputation data, the domain reputation data associated with the external domain, and the risk score.
7 . The method of claim 6 further comprising increasing the risk score as the ratio approaches 1:1.
8 . A system comprising:
processing circuitry configured to:
obtain a Uniform Resource Locator (URL) of a web asset associated with a website;
crawl the URL to identify an external domain that communicates with the web asset;
intercept a communication between the web asset and the external domain;
inject a Content Security Policy (CSP) header into the communication to collect CSP and Subresource Integrity (SRI) information;
determine a dependency of the web asset based on the CSP and SRI information;
generate a dependency graph based on the dependency, script reputation data associated with a script of the web asset, and domain reputation data associated with the external domain;
create a CSP policy based on the dependency graph; and
deploy the CSP policy to protect the website.
9 . The system of claim 8 wherein the processing circuitry is further configured to obtain the script reputation data and domain reputation data from publicly available reputation information.
10 . The system of claim 8 wherein the processing circuitry is further configured to utilize a scoring algorithm to generate the script reputation data and domain reputation data.
11 . The system of claim 8 wherein the processing circuitry is further configured to:
intercept an additional communication between the web asset and an additional external domain;
inject the CSP header into the communication to collect additional CSP and SRI information;
determine a new dependency of the web asset based on the additional CSP and SRI information;
update the dependency graph based on the new dependency, the script reputation data associated with the script of the web asset, and additional domain reputation data associated with the additional external domain;
update the CSP policy based on the updated dependency graph; and
deploy the updated CSP policy to protect the website.
12 . The system of claim 8 wherein the processing circuitry is further configured to provide the CSP policy to a web client accessing the website via a browser; and wherein
providing the CSP policy causes the browser of the web client to verify the web asset based on the CSP policy.
13 . The system of claim 8 wherein the processing circuitry is further configured to:
determine for a hosting provider or a name server associated with the external domain, a ratio of a number of unique domains to a number of unique companies or entities to determine a risk score of the hosting provider or name server associated with the external domain; and
generate the dependency graph based on the dependency, the script reputation data, the domain reputation data associated with the external domain, and the risk score.
14 . The system of claim 13 wherein the processing circuitry is further configured to increase the risk score as the ratio approaches 1:1.
15 . One or more non-transitory computer-readable media having instructions stored thereon, that, in response to execution, cause a system comprising a processor to perform operations, the operations comprising:
obtaining a Uniform Resource Locator (URL) of a web asset associated with a website;
crawling the URL to identify an external domain that communicates with the web asset;
intercepting a communication between the web asset and the external domain;
injecting a Content Security Policy (CSP) header into the communication to collect CSP and Subresource Integrity (SRI) information;
determining a dependency of the web asset based on the CSP and SRI information;
generating a dependency graph based on the dependency, script reputation data associated with a script of the web asset, and domain reputation data associated with the external domain;
creating a CSP policy based on the dependency graph; and
deploying the CSP policy to protect the website.
16 . The computer-readable storage media of claim 15 wherein the operations further comprise obtaining the script reputation data and domain reputation data from publicly available reputation information.
17 . The computer-readable storage media of claim 15 wherein the operations further comprise utilizing a scoring algorithm to generate the script reputation data and domain reputation data.
18 . The computer-readable storage media of claim 15 wherein the operations further comprise:
intercepting an additional communication between the web asset and an additional external domain;
injecting the CSP header into the communication to collect additional CSP and SRI information;
determining a new dependency of the web asset based on the additional CSP and SRI information;
updating the dependency graph based on the new dependency, the script reputation data associated with the script of the web asset, and additional domain reputation data associated with the additional external domain;
updating the CSP policy based on the updated dependency graph; and
deploying the updated CSP policy to protect the website.
19 . The computer-readable storage media of claim 15 wherein the operations further comprise providing the CSP policy to a web client accessing the website via a browser; and wherein
providing the CSP policy causes the browser of the web client to verify the web asset based on the CSP policy.
20 . The computer-readable storage media of claim 15 wherein the operations further comprise:
determining for a hosting provider or a name server associated with the external domain, a ratio of a number of unique domains to a number of unique companies or entities to determine a risk score of the hosting provider or name server associated with the external domain; and
increasing the risk score as the ratio approaches 1:1; and wherein
generating the dependency graph comprises generating the dependency graph based on the dependency, the script reputation data, the domain reputation data associated with the external domain, and the risk score.