Detecting realtime phishing from a phished client or at a security server
Disclosed herein are techniques for detecting phishing websites. In one embodiment, a method is disclosed comprising receiving, at a server, a request for a webpage from a client device; generating, by the server, and inserting an encoded tracking value (ETV) into the webpage; inserting, by the server, dynamic tracking code (DTC) into the webpage, the inserting of the DTC further comprising obfuscating the DTC; and returning, by the server, the webpage including the ETV and DTC to the client device, the DTC configured to execute upon receipt at the client device and validate the ETV upon executing.
1. A method comprising:
receiving, at a server, a request for a webpage from a client device;
generating, at the server, an encoded tracking value (ETV) by encoding a value corresponding to at least one property extracted from the request;
inserting, by the server, the ETV into the webpage, the inserting the ETV comprising:
segmenting the ETV into multiple pieces,
encoding each of the multiple pieces, and
assigning each of the encoded pieces to different property values of an asset referenced by the webpage;
inserting, by the server, dynamic tracking code (DTC) into the webpage, the inserting of the DTC further comprising obfuscating the DTC; and
returning, by the server, the webpage including the ETV and DTC to the client device, the DTC configured to execute upon receipt at the client device and reconstruct and validate the generated ETV using the multiple pieces upon executing.
2. The method of claim 1 , the value corresponding to at least one property comprising a value selected from the group consisting of a timestamp when the request is received, an Internet Protocol (IP) address of the client device, and a domain name of the server.
3. The method of claim 1 , the obfuscating the DTC comprising one or more of:
encoding all references to the server in the DTC,
interleaving instructions of the DTC among the instructions of existing code in the webpage or in files referenced by the webpage,
encoding any references to document object model (DOM) elements referenced in the DTC,
placing the DTC in more than one form in more than one place in the webpage, or
obscuring a name of the server.
4. The method of claim 1 , the DTC further including a time to live (TTL) and the validating the ETV upon executing comprising determining if the TTL has expired and, if so, validating the ETV.
5. The method of claim 1 , the inserting the ETV comprising including the ETV in a uniform resource locator (URL) of a reference included in the webpage.
6. The method of claim 1 , the inserting the ETV comprising steganographically embedding the ETV into one or more media assets referenced in the webpage.
7. A non-transitory computer readable storage medium for tangibly storing computer program instructions capable of being executed by a computer processor executing on a server, the computer program instructions defining the steps of:
receiving a request for a webpage from a client device;
generating an encoded tracking value (ETV) by encoding a value corresponding to at least one property extracted from the request;
inserting the ETV into the webpage, the inserting the ETV comprising:
segmenting the ETV into multiple pieces,
encoding each of the multiple pieces, and
assigning each of the encoded pieces to different property values of an asset referenced by the webpage;
inserting dynamic tracking code (DTC) into the webpage, the inserting of the DTC further comprising obfuscating the DTC; and
returning the webpage including the ETV and DTC to the client device, the DTC configured to execute upon receipt at the client device and reconstruct and validate the generated ETV using the multiple pieces upon executing.
8. The non-transitory computer readable storage medium of claim 7 , the value corresponding to at least one property comprising a value selected from the group consisting of a timestamp when the request is received, an Internet Protocol (IP) address of the client device, and a domain name of the server.
9. The non-transitory computer readable storage medium of claim 7 , the obfuscating the DTC comprising one or more of:
encoding all references to the server in the DTC,
interleaving instructions of the DTC among the instructions of existing code in the webpage or in files referenced by the webpage,
encoding any references to document object model (DOM) elements referenced in the DTC,
placing the DTC in more than one form in more than one place in the webpage, or
obscuring a name of the server.
10. The non-transitory computer readable storage medium of claim 7 , the DTC further including a time to live (TTL) and the validating the ETV upon executing comprising determining if the TTL has expired and, if so, validating the ETV.
11. The non-transitory computer readable storage medium of claim 7 , the inserting the ETV comprising including the ETV in a uniform resource locator (URL) of a reference included in the webpage.
12. The non-transitory computer readable storage medium of claim 7 , the inserting the ETV comprising steganographically embedding the ETV into one or more media assets referenced in the webpage.
13. A server comprising:
a processor;
a storage medium for tangibly storing thereon program logic for execution by the processor, the stored program logic comprising logic performing the steps of:
receiving a request for a webpage from a client device,
generating, at the server, an encoded tracking value (ETV) by encoding a value corresponding to at least one property extracted from the request,
inserting the ETV into the webpage, the inserting the ETV comprising:
segmenting the ETV into multiple pieces,
encoding each of the multiple pieces, and
assigning each of the encoded pieces to different property values of an asset referenced by the webpage,
inserting dynamic tracking code (DTC) into the webpage, the inserting of the DTC further comprising obfuscating the DTC, and
returning the webpage including the ETV and DTC to the client device, the DTC configured to execute upon receipt at the client device and reconstruct and validate the generated ETV using the multiple pieces upon executing.
14. The server of claim 13 , the value corresponding to at least one property comprising a value selected from the group consisting of a timestamp when the request is received, an Internet Protocol (IP) address of the client device, and a domain name of the server.
15. The server of claim 13 , the obfuscating the DTC comprising one or more of:
encoding all references to the server in the DTC,
interleaving instructions of the DTC among the instructions of existing code in the webpage or in files referenced by the webpage,
encoding any references to document object model (DOM) elements referenced in the DTC,
placing the DTC in more than one form in more than one place in the webpage, or
obscuring a name of the server.
16. The server of claim 13 , the inserting the ETV comprising including the ETV in a uniform resource locator (URL) of a reference included in the webpage.
17. The server of claim 13 , the inserting the ETV comprising steganographically embedding the ETV into one or more media assets referenced in the webpage.