Security system for detecting malicious actor's observation
A website vulnerability test is performed by automatically checking that a website has not been compromised by malicious third party scripts. A system can test a dynamic behavior of a website that indicates a functional user flow through the website. A set of rules are applied against a log of dynamic behavior of the website, as well as static code of the website, to identify potential compromise by malicious scripts. Some rules can be configured for detecting modification of a third party script, or modified behavior of a third party script, in an attempt to detect security monitoring activity against the script and hide its presence from the security monitoring activity.
1 . A method for testing a website vulnerability, the method comprising:
retrieving website code of a website, the website code including a script;
debugging the website code;
searching for an indicator of malicious action during the debugging, wherein searching for the indicator of malicious action during the debugging comprises identifying that one or more messages are modified in a console log;
determining presence of a potential malicious script based on the indicator; and
returning an alert of the presence of the potential malicious script in the website.
2 . The method of claim 1 , wherein retrieving the website code includes retrieving the website code on a browser, the method further comprising:
running a code evaluation tool on the browser.
3 . The method of claim 1 , wherein the indicator is indicative of binding events to timing events.
4 . The method of claim 1 , wherein the indicator is indicative of accessing event calls for timing-related functions.
5 . The method of claim 1 , wherein the indicator is indicative of binding events to start and stop timings of an operation.
6 . The method of claim 1 , wherein based on retrieving the website code of the website, the method further comprises:
simulating a functional user flow on the website;
recording dynamic behavior of the website during simulation of the functional user flow;
retrieving malicious actor detection rules;
applying the retrieved rules to the recorded dynamic behavior of the website; and
detecting, based on applying the retrieved rules, the presence of the potential malicious script in the website.
7 . The method of claim 6 , wherein simulating the functional user flow on the website comprises:
applying a website test wrapper to the website code including the script; and
automatically executing, based on applying the wrapper to the website code including the script, an automation script that provides simulated user inputs to interact with the website.
8 . The method of claim 7 , further comprising:
generating, by the wrapper, a dynamic website log that records behavior of the website in response to the simulated user inputs provided by the automation script.
9 . The method of claim 1 , wherein searching for the indicator of malicious action during the debugging comprises detecting that a browser for the website is operating slower than an expected speed.
10 . The method of claim 1 , wherein searching for the indicator of malicious action during the debugging comprises detecting an unexpected crash of a browser for the website.
11 . The method of claim 1 , further comprising:
aggregating the indicator with a plurality of indicators; and
transmitting the aggregated indicators to a computing device of a security analyst.
12 . A client computing device for testing a website vulnerability, comprising:
a data processing apparatus; and
a memory device storing instructions that when executed by the data processing apparatus cause the client computing device to perform operations comprising:
retrieving website code of a website on a browser, the website code including a script;
running a code evaluation tool on the browser;
debugging the website code;
searching for an indicator of malicious action during the debugging;
determining presence of a potential malicious script based on the indicator; and
returning an alert of the presence of the potential malicious script in the website.
13 . The client computing device of claim 12 , wherein the indicator is indicative of at least one of:
binding events to timing events;
accessing event calls for timing-related functions; or
binding events to start and stop timings of an operation.
14 . The client computing device of claim 12 , wherein searching for the indicator of malicious action during the debugging comprises identifying that one or more messages are removed from a console log.
15 . The client computing device of claim 12 , wherein based on retrieving the website code of the website, the operations further comprising:
simulating a functional user flow on the website;
recording dynamic behavior of the website during simulation of the functional user flow;
retrieving malicious actor detection rules;
applying the retrieved rules to the recorded dynamic behavior of the website; and
detecting, based on applying the retrieved rules, the presence of the potential malicious script in the website.
16 . The client computing device of claim 15 , wherein simulating the functional user flow on the website comprises:
applying a website test wrapper to the website code including the script; and
automatically executing, based on applying the wrapper to the website code including the script, an automation script that provides simulated user inputs to interact with the website.
17 . The client computing device of claim 16 , the operations further comprising:
generating, by the wrapper, a dynamic website log that records behavior of the website in response to the simulated user inputs provided by the automation script.
18 . A method for testing a website vulnerability, the method comprising:
retrieving website code of a website, the website code including a script;
debugging the website code;
searching for an indicator of malicious action during the debugging, wherein searching for the indicator of malicious action during the debugging comprises identifying that one or more messages are removed in a console log;
determining presence of a potential malicious script based on the indicator; and
returning an alert of the presence of the potential malicious script in the website.
19 . The method of claim 18 , wherein the indicator is indicative of at least one of:
binding events to timing events;
accessing event calls for timing-related functions; or
binding events to start and stop timings of an operation.
20 . The method of claim 18 , wherein retrieving the website code includes retrieving the website code on a browser, the method further comprising:
running a code evaluation tool on the browser.