Autoplay Next video from Max length

Paolo Di Prodi Tim Burrell - Monitoring Web Sites for Malware Injection with Web Detector

466 views · Published 4 July 2014 · 42:22 · Indexed 28 October 2026

Channel: OWASP Foundation · 2014 · Science & Technology

From AppSecEU 2014 in Cambridge
https://2014.appsec.eu/

It's estimated that 86% of all websites had at least a serious vulnerability during 2012. Attackers either manually or automatically (via botnets) deploy C&C servers and malware droppers within exploited websites to infect clients. When such an intrusion is not detected by the owner, the website can deliver malware for long periods until somebody either privately or publicly notices it and maybe an investigation starts.

To tackle this, we have developed a web monitoring tool called WebDetector, that can be scheduled to run periodically over a list of domain names and to produce a score that indicates how malicious a page is.

The tool is currently written in python and relies on several open source components for mirroring, file tracking and indexing plus a set of heuristics to detect harmful components like javascripts, PDF, shockwaves, form spoofing and link redirection. The framework can be expanded with modular signatures to detect in future more types of attacks with the help of the community.

We have tested the efficacy of WebDetector by deliberately adding common malicious behaviour in a controlled Wordpress installation. More sophisticated malware strategies needs refined heuristics for detection that will be addressed in future.

Speakers

Tim Burrell

Paolo Di Prodi
Machine Learning Engineer, Microsoft
I love control systems and robotics.

Managed by the official OWASP Media Project https://www.owasp.org/index.php/OWASP_Media_Project

Paolo Di Prodi Tim Burrell - Monitoring Web Sites for Malware Injection with Web Detector

More from this channel