System and method for preventing web frauds committed using client-scripting attacks
A method for detecting and blocking Javascript hijacking attacks, comprising checking if an incoming request belongs to a valid session established between a client and a trusted server. When said incoming request does belong to a valid session, it is checked if a Referer header of said incoming request includes a valid domain name. The incoming request is marked as suspicious, when said incoming request does not include a valid domain name. It is checked if a respective response of said suspicious incoming request includes a script code. A preventive action responsive to a user input is taken when said respective response includes a script code.
1. A method for detecting and blocking Javascript hijacking attacks, comprising:
checking, by a secure gateway connected to at least a trusted server and communicatively coupled to a client, if an incoming request does not belong to a valid session established between a client and a trusted server and transferring the incoming request to the trusted server in response to the incoming request not belonging to the valid session thereby completing the method; otherwise,
when said incoming request does belong to the valid session, checking if a Referer header field of said incoming request includes a domain name that is of a protected web-site hosted by the trusted server;
marking said incoming request as suspicious, when said incoming request does not include the domain name;
transferring the suspicious incoming request to the trusted server;
checking if a respective response of said suspicious incoming request includes a script code; and
taking a preventive action responsive to a user input when said respective response includes the script code by skipping processing of the respective response based on the user input, such that a hijacking attack to gain access to sensitive information conveyed to the client is prevented.
2. The method of claim 1 , wherein said preventive action is selected from a group consisting of: generating an alert, blocking said incoming request and blocking said respective response.
3. The method of claim 1 , wherein said user input is sought for by one of: displaying a request for user authorization and displaying an alert in a pop-up window.
4. The method of claim 2 , wherein generating the alert further comprises:
inserting a special purpose script code in a response sent to the client, wherein the special purpose script code allows a user to block the response from being executed over the client.
5. A non-transitory computer-readable medium having stored thereon computer executable code for detecting and blocking Javascript hijacking attacks, the computer executable code comprising:
checking, by a secure gateway connected to at least a trusted server and communicatively coupled to a client, if an incoming request does not belong to a valid session established between a client and a trusted server and transferring the incoming request to the trusted server in response to the incoming request not belonging to the valid session thereby completing the method; otherwise,
when said incoming request does belong to the valid session, checking if a Referer header field of said incoming request includes a domain name that is of a protected web-site hosted by the trusted server;
marking said incoming request as suspicious, when said incoming request does not include the domain name;
transferring the suspicious incoming request to the trusted server;
checking if a respective response of said suspicious incoming request includes a script code; and
taking preventive action responsive to a user input when said respective response includes the script code by skipping processing of the respective response based on the user input, such that a hijacking attack to gain access to sensitive information conveyed to the client is prevented.
6. The computer executable code of claim 5 , wherein said preventive action is selected from a group consisting of: generating an alert, blocking said incoming request and blocking said respective response.
7. The computer executable code of claim 5 , wherein said user input is sought for by one of: displaying a request for user authorization and displaying an alert in a pop-up window.
8. The computer executable code of claim 6 , wherein generating said alert further comprises:
inserting a special purpose script code in a response sent to said client, wherein said special purpose script code allows a user to block said respective response from being executed over said client.