Automatic placeholder finder-filler
Methods and processes are disclosed for iOS based systems and mobile devices that permit a user to securely inject passwords and related information into environments that are traditionally impossible to control, along with preserving the security of confidential information against third party attacks be they intrusive or already embedded. The methods and processes utilize a locally installed proxy securely communicating with a remote server that permit injecting a secret into the code on devices that otherwise would not have the option of doing so. In at least one embodiment this is done by using network hooks and controlling the data flow between the injected component, a proxy and an application. It is contemplated that the user can control which credentials are used, without revealing them and minimizing attacker discovery.
1. A machine readable storage device or storage disk comprising instructions that, when executed, cause a machine to at least:
establish a local proxy and a connection between the local proxy and a browser;
establish a connection between a remote server and the local proxy;
simulate the remote server to establish a server proxy;
obtain a request received from at least one of the browser or the server proxy;
send the request to the remote server;
obtain a server response sent from the remote server to the browser;
obtain a positive script injection response received from the browser, the positive script injection response based on the server response;
buffer the server response;
generate an injected script; and
send the injected script to the browser.
2. The machine readable storage device or storage disk of claim 1 , wherein the instructions, when executed, cause the machine to send the injected script to the browser by:
modifying the buffered server response with the injected script to create a modified server response; and
sending the modified server response to the browser.
3. The machine readable storage device or storage disk of claim 1 , wherein the instructions, when executed, cause the machine to:
render a modified web page on the browser.
4. The machine readable storage device or storage disk of claim 1 , wherein the instructions, when executed, cause the machine to:
establish a presence of a login form in a loaded webpage;
generate an asset request;
encrypt the asset request with a symmetric algorithm;
send the asset request to the remote server;
obtain an asset request response received from the remote server, the asset request response containing requested assets;
decrypt the asset request response with the symmetric algorithm; and
send the requested assets to at least one of the local proxy or the browser.
5. The machine readable storage device or storage disk of claim 4 , wherein the instructions, when executed, cause the machine to generate the injected script by:
generating a cryptokey, the symmetric algorithm to use the cryptokey to encrypt the asset request and decrypt the asset request response.
6. The machine readable storage device or storage disk of claim 4 , wherein the instructions, when executed, cause the machine to establish the presence of the login form in the loaded webpage by:
sending an account selection form to the browser, the account selection form including at least one account selection;
generating an account selection request, the account selection request including one of the at least one account selection; and
obtaining the account selection request from the browser.
7. The machine readable storage device or storage disk of claim 6 , wherein the account selection request is encrypted.
8. The machine readable storage device or storage disk of claim 7 , wherein the account selection request is encrypted using the symmetric encryption algorithm.
9. The machine readable storage device or storage disk of claim 7 , wherein the instructions, when executed, further cause the machine to:
generate an account selection response, the account selection response including a dummy string;
send the account selection response to the browser;
inject the dummy string into a webpage input field in the loaded web page;
obtain a second request received from the browser, the second request including the dummy string; and
replace in real-time the dummy string with a password, the password retrieved from the remote server.
10. A programmable device, comprising:
a processor; and
memory including instructions that, when executed, cause the processor to:
establish a local proxy and a connection between the local proxy and a browser;
establish a connection between a remote server and the local proxy;
simulate the remote server to establish a server proxy;
obtain a request received from at least one of the browser or the server proxy;
send the request to the remote server;
obtain a server response sent from the remote server to the browser;
obtain a positive script injection response received from the browser, the positive script injection response based on the server response,
buffer the server response;
generate an injected script; and
send the injected script to the browser.
11. The programmable device of claim 10 , wherein the instructions, when executed, cause the processor to send the injected script to the browser by:
modifying the buffered server response with the injected script to create a modified server response; and
sending the modified server response to the browser.
12. The programmable device of claim 10 , wherein the instructions, when executed, further cause the processor to:
render a modified web page on the browser.
13. The programmable device of claim 10 , wherein the instructions, when executed, further cause the processor to:
establish a presence of a login form in a loaded webpage;
generate an asset request;
encrypt the asset request with a symmetric algorithm;
send the asset request to the remote server;
obtain an asset request response received from the remote server, the asset request response containing requested assets;
decrypt the asset request response with the symmetric algorithm; and
send the requested assets to at least one of the local proxy or the web browser.
14. The programmable device of claim 13 , wherein the instructions, when executed, cause the processor to generate the injected script by generating a cryptokey, the symmetric algorithm to use the cryptokey to encrypt the asset request and decrypt the asset request response.
15. The programmable device of claim 13 , wherein the instructions, when executed, cause the processor to establish the presence of the login form in the loaded webpage by:
sending an account selection form to the browser, the account selection form including at least one account selection;
generating an account selection request, the account selection request including one of the at least one account selection; and
obtain the account selection request from the browser.
16. The programmable device of claim 15 , wherein the account selection request is encrypted.
17. The programmable device of claim 16 , wherein the account selection request is encrypted using the symmetric encryption algorithm.
18. The programmable device of claim 16 , wherein the instructions, when executed, further cause the processor to:
generate an account selection response, the account selection response including a dummy string;
send the account selection response to the browser;
inject the dummy string into a webpage input field in the loaded web page;
obtain a second request received from the browser, the second request including the dummy string; and
replace in real-time the dummy string with a password, the password retrieved from the remote server.