Client side protection against drive-by pharming via referrer checking

1. A computer-implemented method comprising:

executing, by a processor in a client computer system, an anti-pharming application, wherein execution of said anti-pharming application generates said method comprising:

proxying an HTTP request on the client computer system prior to release to a router, said HTTP request including an HTTP header;

determining, following the proxying and prior to release to the router, whether said HTTP header identifies a referrer URL corresponding to routable, public IP address and a target URL corresponding to a non-routable, private IP address,

wherein the determining includes:

resolving said referrer URL to a referrer URL IP address;

resolving the target URL to a target URL IP address; and

comparing the referrer URL IP address and the target URL IP address to a database of known IP addresses to make the determination;

wherein upon a determination that said HTTP header identifies a referrer URL corresponding to a routable, public IP address and a target URL corresponding to a non-routable, private IP address, blocking said HTTP request; and

providing an alert notification.

2. The computer-implemented method of claim 1 further comprising:

prior to said blocking said HTTP request, determining whether to exclude said HTTP request from blocking;

upon a determination to exclude said HTTP request from blocking, releasing said HTTP request; and

upon a determination not to exclude said HTTP request from blocking, allowing said blocking said HTTP request.

3. The computer-implemented method of claim 1 further comprising:

prior to said blocking said HTTP request, prompting a user to input a confirmation or a denial of said blocking said HTTP request;

upon receipt of said denial, releasing said HTTP request; and

upon receipt of said confirmation, allowing said blocking said HTTP request.

4. The computer-implemented method of claim 1 further comprising:

wherein upon a determination that said HTTP header does not identify a referrer URL corresponding to a routable, public IP address and a target URL corresponding to a non-routable, private IP address, releasing said HTTP request, said releasing allowing said HTTP request to be sent as a released HTTP request to said target URL.

5. The computer-implemented method of claim 4 further comprising:

proxying an HTTP response received in response to said released HTTP request;

determining whether said HTTP response identifies a content of content type text/html or of content type script;

wherein upon a determination that said HTTP response does not identify said content of said content type text/html or of said content type script, releasing said HTTP response; and

wherein upon a determination that said HTTP response identifies said content of said content type text/html or of said content type script, modifying said content to prevent malicious activity, and releasing said HTTP response.

6. The computer-implemented method of claim 5 wherein upon a determination that said HTTP response identifies said content of said content type text/html, said modifying said content to prevent malicious activity includes:

parsing said content to identify each HTML-referenced URL present in said content;

determining whether said each HTML-referenced URL corresponds to a non-routable, private IP address; and

wherein when an HTML-referenced URL corresponds to a non-routable, private IP address, replacing said HTML-referenced URL with a safe URL; and

releasing said HTTP request.

7. The computer-implemented method of claim 5 further comprising:

wherein upon a determination that said HTTP response identifies said content of said content type script, said modifying said content to prevent malicious activity includes:

injecting a JavaScript override at the top of said content prior to any scripts, said JavaScript override defining a safe XMLHttpRequest API and an ActiveX replacement object;

parsing said content to identify each script other than said JavaScript override;

replacing each XMLHttpRequest API in said each script, if any, with said safe XMLHttpRequest API; and

replacing each object tag in said each script, if any, with said ActiveX replacement object; and

releasing said HTTP request.

8. A computer-program product comprising a non-transitory tangible computer readable medium containing computer program code comprising:

a client anti-pharming application for proxying an HTTP request on a client computer system prior to release to a router, said HTTP request including an HTTP header;

said client anti-pharming application further for determining, following the proxying and prior to release to the router, whether said HTTP header identifies a referrer URL corresponding to routable, public IP address and a target URL corresponding to a non-routable, private IP address,

wherein the determining includes:

resolving said referrer URL to a referrer URL IP address;

resolving the target URL to a target URL IP address; and

comparing the referrer URL IP address and the target URL IP address to a database of known IP addresses to make the determination;

wherein upon a determination that said HTTP header identifies a referrer URL corresponding to a routable, public IP address and a target URL corresponding to a non-routable, private IP address, said client anti-pharming application further for blocking said HTTP request; and

said client anti-pharming application further for providing an alert notification.

9. The computer-program product of claim 8 further comprising:

prior to blocking said HTTP request, said client anti-pharming application further for determining whether to exclude said HTTP request from blocking;

upon a determination to exclude said HTTP request from blocking, said client anti-pharming application further for releasing said HTTP request; and

upon a determination not to exclude said HTTP request from blocking, said client anti-pharming application further for allowing said blocking said HTTP request.

10. The computer-program product of claim 8 further comprising:

prior to blocking said HTTP request, said client anti-pharming application further for prompting a user to input a confirmation or a denial of said blocking said HTTP request;

upon receipt of said denial, said client anti-pharming application further for releasing said HTTP request; and

upon receipt of said confirmation, said client anti-pharming application further for releasing said HTTP request.

11. The computer-program product of claim 8 further comprising:

wherein upon a determination that said HTTP header does not identify a referrer URL corresponding to a routable, public IP address and a target URL corresponding to a non-routable, private IP address, said client anti-pharming application further for releasing said HTTP request, said releasing allowing said HTTP request to be sent as a released HTTP request to said target URL.

12. The computer-program product of claim 8 further comprising:

said client anti-pharming application further for proxying an HTTP response received in response to said released HTTP request;

said client anti-pharming application further for determining whether said HTTP response identifies a content of content type text/html or of content type script;

wherein upon a determination that said HTTP response does not identify said content of said content type text/html or of said content type script, said client anti-pharming application further for releasing said HTTP response; and

wherein upon a determination that said HTTP response identifies said content of said content type text/html or of said content type script, said client anti-pharming application further for modifying said content to prevent malicious activity, and said client anti-pharming application further for releasing said HTTP response.

13. The computer-program product of claim 12 wherein upon a determination that said HTTP response identifies said content of said content type text/html, said client anti-pharming application further for parsing said content to identify each HTML-referenced URL present in said content;

said client anti-pharming application further for determining whether said each HTML-referenced URL corresponds to a non-routable, private IP address; and

wherein when an HTML-referenced URL corresponds to a non-routable, private IP address, said client anti-pharming application further for replacing said HTML-referenced URL with a safe URL.

14. The computer-program product of claim 12 further comprising:

wherein upon a determination that said HTTP response identifies said content of said content type script,

said client anti-pharming application further for injecting a JavaScript override at the top of said content prior to any scripts, said JavaScript override including a safe XMLHttpRequest API and an ActiveX replacement object;

said client anti-pharming application further for parsing said content to identify each script other than said JavaScript override;

said client anti-pharming application further for replacing each XMLHttpRequest API in said each script, if any, with said safe XMLHttpRequest API; and

said client anti-pharming application further for replacing each object tag in said each script, if any, with said ActiveX replacement object.

15. A computer system comprising:

a memory having stored therein a client anti-pharming application; and

a processor coupled to said memory, wherein execution of said client anti-pharming application generates a method comprising:

proxying an HTTP request on a client computer system prior to release to a router, said HTTP request including an HTTP header;

determining, following the proxying and prior to release to the router, whether said HTTP header identifies a referrer URL corresponding to routable, public IP address and a target URL corresponding to a non-routable, private IP address,

wherein the determining includes:

resolving said referrer URL to a referrer URL IP address;

resolving the target URL to a target URL IP address; and

comparing the referrer URL IP address and the target URL IP address to a database of known IP addresses to make the determination;

wherein upon a determination that said HTTP header identifies a referrer URL corresponding to a routable, public IP address and a target URL corresponding to a non-routable, private IP address, blocking said HTTP request; and

providing an alert notification.

16. The computer system of claim 15 further comprising:

prior to said blocking said HTTP request, prompting a user to input a confirmation or a denial of said blocking said HTTP request;

upon receipt of said denial, releasing said HTTP request; and

upon receipt of said confirmation, allowing said blocking said HTTP request.

17. The computer system of claim 15 further comprising:

wherein upon a determination that said HTTP header does not identify a referrer URL corresponding to a routable, public IP address and a target URL corresponding to a non-routable, private IP address, releasing said HTTP request, said releasing allowing said HTTP request to be sent as a released HTTP request to said target URL.

18. The computer system of claim 17 further comprising:

proxying an HTTP response received in response to said released HTTP request;

determining whether said HTTP response identifies a content of content type text/html or of content type script;

wherein upon a determination that said HTTP response does not identify said content of said content type text/html or of said content type script, releasing said HTTP response; and

wherein upon a determination that said HTTP response identifies said content of said content type text/html or of said content type script, modifying said content to prevent malicious activity, and releasing said HTTP response.

19. The computer system of claim 18 wherein upon a determination that said HTTP response identifies said content of said content type text/html, said modifying said content to prevent malicious activity includes:

parsing said content to identify each HTML-referenced URL present in said content;

determining whether said each HTML-referenced URL corresponds to a non-routable, private IP address; and

wherein when an HTML-referenced URL corresponds to a non-routable, private IP address, replacing said HTML-referenced URL with a safe URL; and

releasing said HTTP request.

20. The computer system of claim 18 further comprising:

wherein upon a determination that said HTTP response identifies said content of said content type script, said modifying said content to prevent malicious activity includes:

injecting a JavaScript override at the top of said content prior to any scripts, said JavaScript override defining a safe XMLHttpRequest API and an ActiveX replacement object;

parsing said content to identify each script other than said JavaScript override;

replacing each XMLHttpRequest API in said each script, if any, with said safe XMLHttpRequest API; and

replacing each object tag in said each script, if any, with said ActiveX replacement object; and

releasing said HTTP request.