Patent application number | Description | Published |
20090320043 | APPLICATION STATE DETECTOR AND INDUCER - A method for controlling a computer-implemented application, the method including determining a current state of a computer-implemented application, inducing the application into a predefined state associated with a target action of the application if the current state does not match the predefined state in accordance with predefined match criteria, and causing the target action to be performed. | 12-24-2009 |
20100036938 | WEB BROWSER SECURITY - A web browser security system including a network detector configured to detect when a computer attempts to connect to a computer network, and a data protector configured to move any data predefined as being private data from any private data areas that are accessible to a web browser on the computer to a secure data repository that is not accessible to the web browser, where any of the network detector and the data protector are implemented in either of computer hardware and computer software and embodied in a computer-readable medium. | 02-11-2010 |
20100088668 | Crawling of object model using transformation graph - A transformation tree for an object model (OM) is defined. The transformation tree has nodes interconnected by edges, where each node is connected to at most one other tree node. Each node corresponds to a state of the OM; each edge corresponds to an event causing the OM to transition from the state of one node to the state of another node. A transformation graph for the OM is constructed by simulating the transformation tree. The transformation graph has nodes interconnected by edges, and is a directed graph in which each node is connected to one or more other nodes. Each node corresponds to a state of the OM; each edge corresponds to an event causing the OM to transition from the state of one node to the state of another node. Crawling-oriented actions are performed in relation to the OM by being performed in relation to the transformation graph. | 04-08-2010 |
20100088761 | CROSS-DOMAIN ACCESS PREVENTION - A method, system, and computer program product for cross-domain access prevention are provided. The method includes detecting a request from a first domain to access a second domain, and applying cross-domain access heuristics to determine whether to allow the request. The cross-domain access heuristics define common ownership characteristics between the first domain and the second domain. The method further includes performing the requested access in response to determining that the request complies with at least one of the cross-domain access heuristics, and blocking the requested access in response to determining that the request fails to comply with the cross-domain access heuristics. | 04-08-2010 |
20100299754 | Identifying Security Breaches Caused by Web-Enabled Software Applications - Identifying a security breach caused when a computer-based software application uses a computer-based web browser application, including identifying at least one function within a computer-based software application that causes a computer-based web browser application to access data from a source that is external to the software application, at least partially replacing the data with malicious content that is configured to cause a predefined action to occur when the malicious content is accessed by the web browser application, where the predefined action is associated with a known security breach when the predefined action occurs subsequent to the malicious content being accessed by the web browser application, causing the software application to perform the function, and determining whether the predefined action is performed. | 11-25-2010 |
20100306745 | Efficient Code Instrumentation - A method for instrumenting a computer program, the method including identifying a program slice within a computer program, and instrumenting the program slice within the program. | 12-02-2010 |
20110066609 | Crawling Browser-Accessible Applications - Crawling a browser-accessible application by causing a target application and a bridge application to run concurrently in a browser-controllable player, and iteratively receiving from the bridge application current state information of the target application, storing the state information on a data storage device if the state information is not found on the data storage device, where the state information is stored as a descendant state of an initial state of the target application, and interacting with the target application in accordance with a predefined simulation algorithm, thereby effecting a new state of the target application, until a predefined termination condition is reached. | 03-17-2011 |
20110087892 | Eliminating False Reports of Security Vulnerabilities when Testing Computer Software - A system for eliminating false reports of security vulnerabilities when testing computer software, including a taint analysis engine configured to identify a tainted variable v in a computer application, a data mapping identification engine configured to identify a variable x within the application that holds data derived from v, where x is in a different format than v, an AddData identification engine configured to identify an AddData operation within the application that is performed on x, a signature identification engine configured to identify a Sign operation within the application that is performed on the results of the AddData operation on x, a signature comparison identification engine configured to identify an operation within the application that compares the results of the Sign operation with another value | 04-14-2011 |
20110126282 | System, Method and Apparatus for Simultaneous Definition and Enforcement of Access-control and Integrity Policies - Access-control and information-flow integrity policies are enforced in a computing system by detecting security-sensitive sinks in software code for an application running on the computing system and retrieving an access-control policy from a database accessible to the computing system. The access-control policy maps a set of access permissions within the computing system to each one of a plurality of principals. For each detected security-sensitive sink, all principals that influence that security-sensitive sink are detected and an overall access permission is assigned to each security-sensitive sink by taking the intersection of the access permission sets for all influencing principals of that security-sensitive sink. If this permission set is inadequate, an integrity violation is reported. In addition, permission labels are assigned to each value of variables used in the security-sensitive sinks. Each permission label is a set of permissions. | 05-26-2011 |
20110131656 | IDENTIFYING SECURITY VULNERABILITY IN COMPUTER SOFTWARE - Identifying a security vulnerability in a computer software application by identifying at least one source in a computer software application, identifying at least one sink in the computer software application, identifying at least one input to any of the sinks, determining whether the input derives its value directly or indirectly from any of the sources, determining a set of possible values for the input, and identifying a security vulnerability where the set of possible values for the input does not match a predefined specification of legal values associated with the sink input. | 06-02-2011 |
20110161486 | DETECTING AND MONITORING SERVER SIDE STATES DURING WEB APPLICATION SCANNING - A computer-implemented method, system, and computer program product for detecting and monitoring server side state during the scanning of a web application. The method includes: monitoring executed code of the web application while scanning the web application; retrieving code coverage information from the monitoring of the executed code and retrieving scanning information from the scanning of the web application; correlating the code coverage information with the scanning information; and determining a change in the server side state based on the correlation. The system includes one or more devices that executes the steps of the method. The computer program products includes computer program instructions stored on a computer readable storage medium, where the instructions, when executed, will cause a computer to perform the steps of the methods. | 06-30-2011 |
20110162072 | DETERMINING THE VULNERABILITY OF COMPUTER SOFTWARE APPLICATIONS TO ATTACKS - Determining the vulnerability of computer software applications to attacks by identifying a defense-related variable within a computer software application that is assigned results of a defense operation defending against a predefined type of attack, identifying a control-flow predicate dominating a security-sensitive operation within the application, identifying a data-flow dependent variable in the application that is data-flow dependent on the defense-related variable, determining whether the control-flow predicate uses the data-flow dependent variable to make a branching decision and whether a control-flow path leading to the security-sensitive operation is taken only if the data-flow dependent variable is compared against a value of a predefined type, determining that the security-sensitive operation is safe from the attack if both control-flow conditions are true, and determining that the application is safe from the attack if all security-sensitive operations in the application are determined to be safe from the attack. | 06-30-2011 |
20110225234 | Preventing Cross-Site Request Forgery Attacks on a Server - Preventing Cross-Site Request Forgery (CSRF) security attacks on a server in a client-server environment. In one aspect, this comprises embedding a nonce and a script in all responses from the server to the client wherein, when executed, the script adds the nonce to each request from the client to the server; sending the response with the nonce and the script to the client; and verifying that each request from the client includes the nonce sent by the server from the server to the client. The script preferably modifies all objects, including dynamically generated objects, in a server response that may generate future requests to the server to add the nonce to the requests. The server verifies the nonce value in a request and optionally confirms the request with the client if the value is not the same as the value previously sent by the server. Server-side aspects might be embodied in the server or a proxy between the server and the client. | 09-15-2011 |
20110302566 | FIXING SECURITY VULNERABILITY IN A SOURCE CODE - A computer implemented method for automatically fixing a security vulnerability in a source code is disclosed. The method includes obtaining identification of code that sends tainted data to corresponding sink code in the source code; and automatically fixing the vulnerability by automatically performing code modification which is selected from the group of code modifications consisting of: code motion and code duplication. Also disclosed are computer program product and data processing system. | 12-08-2011 |
20110321016 | INJECTION CONTEXT BASED STATIC ANALYSIS OF COMPUTER SOFTWARE APPLICATIONS - Embodiments of the invention generally relate to injection context based static analysis of computer software applications. Embodiments of the invention may include selecting a sink within a computer software application, tracing a character output stream leading to the sink within the computer software application, determining an injection context of the character output stream at the sink, where the injection context is predefined in association with a state of the character output stream at the sink, identifying any actions that have been predefined in association with the identified injection context, and providing a report of the actions. | 12-29-2011 |
20110321168 | THWARTING CROSS-SITE REQUEST FORGERY (CSRF) AND CLICKJACKING ATTACKS - Embodiments of the invention generally relate to thwarting fraud perpetrated with a computer by receiving a request from a computer to perform a transaction. Embodiments of the invention may include receiving the request together with transaction data and a cookie, where the transaction data are separate from the cookie; determining in accordance with predefined validation criteria whether the cookie includes a valid representation of the transaction data; and performing the transaction only if the cookie includes a valid representation of the transaction data. | 12-29-2011 |
20120023486 | Verification of Information-Flow Downgraders - A method includes determining grammar for output of an information-flow downgrader in a software program. The software program directs the output of the information-flow downgrader to a sink. The method includes determining whether the grammar of the output conforms to one or more predetermined specifications of the sink. The method includes, in response to a determination the grammar of the output conforms to the one or more predetermined specifications of the sink, determining the information-flow downgrader is verified for the sink, wherein determining grammar, determining whether the grammar, and determining the information-flow downgrader are performed via static analysis of the software program. Apparatus and computer program products are also disclosed. An apparatus includes a user interface providing a result of whether or not output of an information-flow downgrader in the software program conforms to one or more predetermined specifications of a sink in the software program. | 01-26-2012 |
20120110551 | SIMULATING BLACK BOX TEST RESULTS USING INFORMATION FROM WHITE BOX TESTING - Systems, methods are program products for simulating black box test results using information obtained from white box testing, including analyzing computer software (e.g., an application) to identify a potential vulnerability within the computer software application and a plurality of milestones associated with the potential vulnerability, where each of the milestones indicates a location within the computer software application, tracing a path from a first one of the milestones to an entry point into the computer software application, identifying an input to the entry point that would result in a control flow from the entry point and through each of the milestones, describing the potential vulnerability in a description indicating the entry point and the input, and presenting the description via a computer-controlled output medium. | 05-03-2012 |
20120180128 | Preventing Cross-Site Request Forgery Attacks on a Server - Preventing Cross-Site Request Forgery security attacks on a server in a client-server environment. In one aspect, this comprises embedding a nonce and a script in all responses from the server to the client wherein, when executed, the script adds the nonce to each request from the client to the server; sending the response with the nonce and the script to the client; and verifying that each request from the client includes the nonce sent by the server to the client. The script preferably modifies all objects, including dynamically generated objects, in a server response that may generate future requests to the server to add the nonce to the requests. The server verifies the nonce value in a request and optionally confirms the request with the client if the value differs from the value previously sent. Server-side aspects might be embodied in the server or a proxy. | 07-12-2012 |
20120215757 | WEB CRAWLING USING STATIC ANALYSIS - A crawler including a document retriever configured to retrieve a first computer-based document, a link identifier configured to identify an actual string within the computer-based document as being a hyperlink-type string, and a static analyzer configured to perform static analysis of an operation on a variable within the first computer-based document to identify a possible string value of the variable as being a hyperlink-type string, where any of the strings indicate a location of at least a second computer-based document. | 08-23-2012 |
20120253778 | Crawling Browser-Accessible Applications - Crawling a browser-accessible application by causing a target application and a bridge application to run concurrently in a browser-controllable player, and iteratively receiving from the bridge application current state information of the target application, storing the state information on a data storage device if the state information is not found on the data storage device, where the state information is stored as a descendant state of an initial state of the target application, and interacting with the target application in accordance with a predefined simulation algorithm, thereby effecting a new state of the target application, until a predefined termination condition is reached. | 10-04-2012 |
20120254839 | SIMULATING BLACK BOX TEST RESULTS USING INFORMATION FROM WHITE BOX TESTING - Systems, methods are program products for simulating black box test results using information obtained from white box testing, including analyzing computer software (e.g., an application) to identify a potential vulnerability within the computer software application and a plurality of milestones associated with the potential vulnerability, where each of the milestones indicates a location within the computer software application, tracing a path from a first one of the milestones to an entry point into the computer software application, identifying an input to the entry point that would result in a control flow from the entry point and through each of the milestones, describing the potential vulnerability in a description indicating the entry point and the input, and presenting the description via a computer-controlled output medium. | 10-04-2012 |
20120304161 | DETERMINING SUITABLE INSERTION POINTS FOR STRING SANITIZERS IN A COMPUTER CODE - A method of determining suitable insertion points for inserting string sanitizers in a computer code is provided herein. The method includes the following stages: obtaining: (i) a computer code associated with a data flow of externally supplied data, from one or more sources to one or more sinks, (ii) locations of the sources, and (iii) locations of the sinks; building a graph representing control paths, data paths and semantic relationships between the control paths and the data paths of the computer code; associating all tainted data paths on the graph, being data paths that go from sources to sinks and do not include a sanitizer; and determining, on the tainted data paths, potential control paths suitable for sanitizer insertion. | 11-29-2012 |
20130091114 | AUTOMATIC CRAWLING OF ENCODED DYNAMIC URLS - A computer program product for crawling URLs that are encoded and highly dynamic, the computer program product includes a non-transitory computer readable storage medium having computer readable program code embodied therewith. The computer readable program code includes computer readable program code configured to retrieve navigational state information corresponding to a URL and compare the navigational state information to previously stored navigational state information corresponding to one or more previously visited URLs. The computer readable program code also includes computer readable program code configured to determine if the URL has been previously visited and retrieve content associated with the URL if the URL has not been previously visited. | 04-11-2013 |
20130091115 | AUTOMATIC CRAWLING OF ENCODED DYNAMIC URLS - A method includes retrieving navigational state information corresponding to a URL; analyzing which navigational state to consider for page identification; comparing the navigational state information to previously stored navigational state information corresponding to one or more previously visited URLs; determining if the URL has been previously visited; and retrieving content associated with the URL if the URL has not been previously visited. | 04-11-2013 |
20130133075 | FIXING SECURITY VULNERABILITY IN A SOURCE CODE - A computer implemented method for automatically fixing a security vulnerability in a source code is disclosed. The method includes obtaining identification of code that sends tainted data to corresponding sink code in the source code; and automatically fixing the vulnerability by automatically performing code modification which is selected from the group of code modifications consisting of: code motion and code duplication. Also disclosed are computer program product and data processing system. | 05-23-2013 |
20130339724 | SELECTIVE ENCRYPTION IN MOBILE DEVICES - A method, product and system for selective encryption in a mobile device. The method comprising: selectively encrypting requests issued by the mobile device, wherein said selectively encrypting comprises: obtaining a request issued by an application executed by the mobile device, the request having one or more characteristics, the request has a destination; determining, based on the one or more characteristics, whether to encrypt the request; and in response to a determination to encrypt the request, re-routing the request to be transmitted to the destination through a secure channel; whereby the request is encrypted regardless of the destination being a priori associated with the secure channel. | 12-19-2013 |
20130340031 | ACCESS CONTROL SYSTEM FOR A MOBILE DEVICE - A method, apparatus and product that provide a access control system for mobile devices. The mobile device performing: selecting a proxy to handle a request to a remote server, the request is issued by a program being executed by the mobile device, wherein the proxy is configured to perform a security action in response to the request; and sending the request to the proxy; whereby selectively performing the predetermined security action on a portion of the requests issued by the mobile device. Additionally or alternatively, a computer performing: receiving from a mobile device, an instruction to provide a Proxy Auto Config (PAC) file; and generating a PAC file that comprises a function which is configured to receive a URL and return a proxy to handle a request to the URL, wherein the proxy is configured to perform a security action in response to receiving a request. | 12-19-2013 |
20140149797 | DYNAMIC CONCOLIC EXECUTION OF AN APPLICATION - Dynamic concolic execution of an application. A first hypotheses pertaining to a nature of test payloads that satisfy a specified property, and that are expected to satisfy a condition tested by the application's program code, can be generated. A plurality of first test payloads to test first hypothesis can be synthesized and submitted to the application during respective executions of the application. Whether each of the first test payloads actually satisfy the condition tested by the application's program code can be determined. When at least one of the first test payloads does not actually satisfy the condition tested by the application's program code, a second hypotheses that is expected to satisfy the condition tested by the application's program code can be generated. A plurality of second test payloads to test the second hypothesis can be synthesized and submitted to the application during respective executions of the application. | 05-29-2014 |
20140149798 | DYNAMIC CONCOLIC EXECUTION OF AN APPLICATION - Dynamic concolic execution of an application. A first hypotheses pertaining to a nature of test payloads that satisfy a specified property, and that are expected to satisfy a condition tested by the application's program code, can be generated. A plurality of first test payloads to test first hypothesis can be synthesized and submitted to the application during respective executions of the application. Whether each of the first test payloads actually satisfy the condition tested by the application's program code can be determined. When at least one of the first test payloads does not actually satisfy the condition tested by the application's program code, a second hypotheses that is expected to satisfy the condition tested by the application's program code can be generated. A plurality of second test payloads to test the second hypothesis can be synthesized and submitted to the application during respective executions of the application. | 05-29-2014 |
20140189874 | HYBRID ANALYSIS OF VULNERABLE INFORMATION FLOWS - Arrangements described herein relate to analyzing vulnerable information flows in an application. A black-box scan of the application can be performed to record a call-tree representation of call stacks arising in the application due to test inputs provided during the black-box scan. For each path in the call-tree representation that does not constitute a vulnerable information flow during the black-box scan, a static analysis can be performed to determine at least one parameter value that, when abstracted, drives execution of the application, via the path, to flow to the at least one security sink. A security report can be generated identifying at least one of the paths in the call-tree representation that does not constitute the vulnerable information flow during the black-box scan, but flows to the at least one security sink when the at least one parameter value is abstracted. | 07-03-2014 |
20140189875 | HYBRID ANALYSIS OF VULNERABLE INFORMATION FLOWS - Arrangements described herein relate to analyzing vulnerable information flows in an application. A black-box scan of the application can be performed to record a call-tree representation of call stacks arising in the application due to test inputs provided during the black-box scan. For each path in the call-tree representation that does not constitute a vulnerable information flow during the black-box scan, a static analysis can be performed to determine at least one parameter value that, when abstracted, drives execution of the application, via the path, to flow to the at least one security sink. A security report can be generated identifying at least one of the paths in the call-tree representation that does not constitute the vulnerable information flow during the black-box scan, but flows to the at least one security sink when the at least one parameter value is abstracted. | 07-03-2014 |
20150089637 | System, Method and Apparatus for Simultaneous Definition and Enforcement of Access-control and Integrity Policies - Access-control and information-flow integrity policies are enforced in a computing system by detecting security-sensitive sinks in software code for an application running on the computing system and retrieving an access-control policy from a database accessible to the computing system. The access-control policy maps a set of access permissions within the computing system to each one of a plurality of principals. For each detected security-sensitive sink, all principals that influence that security-sensitive sink are detected and an overall access permission is assigned to each security-sensitive sink by taking the intersection of the access permission sets for all influencing principals of that security-sensitive sink. If this permission set is inadequate, an integrity violation is reported. In addition, permission labels are assigned to each value of variables used in the security-sensitive sinks. Each permission label is a set of permissions. | 03-26-2015 |