Neutralizing malicious locators
Methods and systems for neutralizing malicious locators. Threat actors may shut down their web pages or applications (i.e., resources) that serve malicious content upon receiving request(s) configured to be perceived by the resource as non-browser requests. Therefore, initiating (large-scale) non-browser requests, or requests that are at least perceived as non-browser requests, may effectively act to inhibit, or even nullify, intended attack vectors.
1. A method for neutralizing at least one malicious locator accessible through a network, the method comprising:
identifying, through a computer interface within a computing device comprising a non-transitory computer-readable medium that is not a transitory signal, a locator referring to a location of a potentially malicious network-accessible resource;
requesting content from the locator via a program that at least appears to be a non-browser program until the potentially malicious network-accessible resource discontinues serving content; and
issuing an alert to inform an end-user that the potentially malicious network-accessible resource has discontinued serving content or adding the locator to a list of malicious network locations.
2. The method of claim 1 wherein requesting content from the locator via the program that at least appears to be a non-browser program includes requesting content via a non-browser program.
3. The method of claim 2 wherein the program that at least appears to be a non-browser program is a browser program, and the method further includes executing, using a processor, a plug-in to change a user agent string of the browser so that the request from the browser appears to be coming from a non-browser program.
4. The method of claim 3 wherein the request appears to be coming from a curl command.
5. The method of claim 3 wherein the request appears to be coming from a wget command.
6. The method of claim 1 wherein the program is a non-browser program exclusively is configured to selectively use a browser-based application user agent string to not be detected.
7. The system of claim 1 wherein the locator is a uniform resource identifier (URI).
8. The system of claim 1 wherein the locator is a uniform resource identifier (URI).
9. A system for neutralizing at least one malicious locator accessible through a network, the system comprising:
an interface to a computer-readable medium that is not a signal;
a network interface; and
a hardware processor in communication with the computer-readable medium and the network interface, the hardware processor configured to:
identify a locator referring to a location of a potentially malicious network-accessible resource,
request content from the locator via a program that at least appears to be a non-browser program until the potentially malicious network-accessible resource discontinues serving content, and
issue an alert to inform an end-user that the potentially malicious network-accessible resource has discontinued serving content or adding the locator to a list of malicious network locations.
10. The system of claim 9 wherein the program that at least appears to be a non-browser program is a non-browser program.
11. The system of claim 10 wherein the program that at least appears to be a non-browser program is a browser program, and the processor is further configured to execute a plug-in to change a user agent string of the browser so that the request from the browser appears to be coming from a non-browser program.
12. The system of claim 11 wherein the request appears to be coming from a curl command.
13. The system of claim 11 wherein the request appears to be coming from a wget command.
14. The system of 9 wherein the program is a non-browser program exclusively and is configured to selectively use a browser-based application user agent string to not be detected.
15. A non-transitory computer readable medium containing computer-executable instructions for performing a method for neutralizing at least one malicious locator accessible through a network, the method comprising: computer-executable instructions for identifying, through a computer interface within a computing device comprising a non-transitory computer-readable medium that is not a transitory signal, a locator referring to a location of a potentially malicious network-accessible resource; computer-executable instructions for requesting content from the locator via a program that at least appears to be a non-browser program until the potentially malicious network-accessible resource discontinues serving content; and computer-executable instructions for issuing an alert to inform an end-user that the potentially malicious network-accessible resource has discontinued serving content or adding the locator to a list of malicious network locations.