Browser extension for validating communications
A computing device comprising a secure browser extension for a web browser monitors for satisfaction of one or more operating conditions to identify whether one or more unauthorized applications are intercepting web browser communications. Based on satisfaction of at least one operating condition, the secure browser extension of the computing device sends an HTTPS request to a known service via the web browser. The secure browser extension receives an HTTPS response to the HTTPS request via the web browser. The secure browser extension determines whether the certificate included in the HTTPS response is trusted by the secure browser extension. Based on determining the certificate is not trusted, the secure browser extension terminates the web browser session and generates a notification for display at the computing device that indicates web browser communications are compromised.
1 . A system comprising:
a server hosting a trusted service, wherein the trusted service provides a trusted certified certificate; and
a computing device, comprising:
a processor;
a communication interface communicatively coupled to the processor; and
non-transitory memory storing computer-readable instructions that, when executed by the processor, cause the computing device to:
identify, by a secure extension of a web browser, an outgoing connection request to a remote service, wherein the trusted service is identified in a secure extension configuration;
send, based on the outgoing connection request to the remote service and by the secure extension, a Hypertext Transfer Protocol Secure (HTTPS) request to the trusted service, wherein the trusted service is different than the remote service;
receive, by the web browser, an HTTPS response to the HTTPS request wherein the HTTPS response comprises a second certificate;
identify, by the secure extension and based on a difference between the second certificate and the trusted certificate, operation of a middle agent; and
display, by the secure extension and based on the difference between the trusted certificate and the second certificate, an indication that enterprise network communications are compromised by the middle agent.
2 . The system of claim 1 , wherein the instructions further cause the computing device to:
monitor, by the secure extension, for an expiration of a time duration, wherein the time duration is defined in the configuration of the secure extension; and
send, via the network based on an indication of the expiration of the time duration and by the secure extension, the HTTPS request to the trusted service.
3 . The system of claim 1 , wherein the instructions further cause the computing device to:
identify, by the secure extension and based on the second certificate, an indication of certificate validity comprising: a valid response signature, an active certificate validity period, an active certificate, and a valid certificate authority; and
cause, by the secure extension and via the web browser based on an identified certificate validity indication, display of a second notification, wherein the second notification comprises an indication that communications via the web browser are secure.
4 . The system of claim 1 , wherein the instructions further cause the computing device to monitor, by the secure extension and based on the HTTPS request, communications received by the web browser for the HTTPS response at the web browser.
5 . The system of claim 1 , wherein the instructions further cause the computing device to deactivate, based on an indication of certificate replacement, the web browser.
6 . The system of claim 1 , wherein the instructions further cause the computing device to generate, by the secure extension, an indication of certificate replacement based on an identification of one or more of:
an invalid response signature;
an inactive certificate validity period;
a certificate revocation; and
an invalid certificate authority.
7 . The system of claim 1 , wherein the configuration of the secure extension is defined by a developer associated with the secure extension or by an enterprise organization associated with the computing device.
8 . A method, comprising:
identifying, by a secure extension of a web browser and from outgoing enterprise network connections, a connection request to a remote service;
requesting, based on an indication of the connection request to the remote service and by the secure extension, a Hypertext Transfer Protocol Secure (HTTPS) request to a trusted service identified in a secure extension configuration, wherein the trusted service is different than the remote service;
receiving, by the web browser, an HTTPS response to the HTTPS request wherein the HTTPS response comprises a second certificate;
identifying, by the secure extension and based on the second certificate of the HTTPS response being different than a trusted certificate of the trusted service, operation of a middle agent; and
displaying, by the secure extension and via the web browser, an indication that enterprise network communications are compromised by the middle agent.
9 . The method of claim 8 , further comprising:
monitoring, by the secure extension, for an activation of the web browser; and
sending, via the network based on an indication of the activation of the web browser and by the secure extension, the HTTPS request to the trusted service.
10 . The method of claim 8 , further comprising:
identifying, by the secure extension and based on the second certificate, a difference between the trusted certificate and the second certificate based on a response signature, an active certificate validity period, an active certificate, and a valid certificate authority.
11 . The method of claim 8 , further comprising:
monitoring, by the secure extension and based on the HTTPS request, communications received by the web browser for the HTTPS response at the web browser.
12 . The method of claim 8 , further comprising deactivating, based on an identification of a replacement certificate, networked communications via the web browser.
13 . The method of claim 8 , further comprising generating, by the secure extension, an indication of a replacement certificate based on an identification of one or more of:
an invalid response signature;
an inactive certificate validity period;
a certificate revocation; and
an invalid certificate authority.
14 . The method of claim 8 , wherein the trusted service is accessible via network and wherein the trusted service is hosted at a server computing device.
15 . A computing device comprising
a processor; and
one or more non-transitory computer-readable media storing instructions that, when executed by a computing device, cause the computing device to:
identify, by a secure extension of a web browser, a connection request from an enterprise network to a remote service, wherein a secure extension configuration comprises an indication of a trusted service different than the remote service;
send, based on an indication of the connection request to the remote service and by the secure extension, a Hypertext Transfer Protocol Secure (HTTPS) request to the trusted service;
receive, by the secure extension, one of an HTTPS response or an HTTP response to the HTTPS request;
identify, by the secure extension and based on receipt of the HTTPS response comprising a second certificate different the trusted certificate associated with the trusted service, operation of a middle agent; and
display, by the secure extension, an indication that enterprise network communications are compromised by the middle agent.
16 . The computing device of claim 15 , wherein the trusted service is an HTTPS service or a configured domain, wherein the configured domain is identified in the configuration of the secure extension, and wherein the configuration of the secure extension is defined by a developer associated with the secure extension or by an enterprise organization associated with the computing device.
17 . The computing device of claim 15 , wherein the instructions further cause the computing device to:
identify, by the secure extension and based on the second certificate, an indication of certificate validity comprising: a valid response signature, an active validity period, an active certificate, and a valid certificate authority; and
cause display, by the secure extension and via the web browser based on an identification that the second certificate is valid, of a second notification, wherein the second notification comprises an indication that communications via the web browser are secure.
18 . The computing device of claim 15 , wherein the instructions further cause the computing device to monitor, by the secure extension and based on the HTTPS request, communications received by the web browser for the HTTPS response at the web browser.
19 . The computing device of claim 15 , wherein the instructions further cause the computing device to deactivate, based on a certificate invalidity indication, the web browser.
20 . The computing device of claim 15 , wherein the instructions further cause the computing device to generate, by the secure extension, a certificate invalidity indication based on an identification of one or more of:
an invalid response signature;
an inactive certificate validity period;
a certificate revocation; and
an invalid certificate authority.