Client-Side Runtime Application Security Defence
We do a good job of finding, validating and risk assessing vulnerabilities across the full stack and helping our clients manage and protect their systems from a security breach and reduce Bugbounty costs...
More Here: www.edgescan.com
An elephant in the room:
Client Security
One important part of security is a difficult "nut to crack" is client side security:
We don't know
- if a user is patched;
- using an old insecure browser;
- is infected or compromised
We have not way of knowing the "health of our users" whom use our web applications.
A common vector of attack is not to attack a system or service but to attack users given they are generally less secure.
To that end the product development team have built "edge-guard' which in effect detects client-side threats and anomalies.
Many variants of malware use HTML rewriting / webinjects to redirect and steal credentials or other data by rewriting the browser pages displayed to a client.
Examples such as
JQuery Rewriting
Mosquito
edge-guard detects client side attacks within the browser or DOM and can inform you if your client is infected and a possible risk to your business. Attacks such as
- HTML rewriting,
- Form re-direction,
- Link spoofing,
- XHR DOM exfiltration, and
- DOM/Reflected XSS
can be detected by notifying the monitoring service and its users intelligence such as
- Type of infection,
- IP of client,
- time stamp,
- location of incident in application (page in application).
You can get a reference implementation here:
A video explaining the overall solution is here:
Comments
Post a Comment