Systems and methods for passive monitoring of web browser upload and download activity
Patent Information
- Application Number
- PCT/US2026/018107
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2025-03-12
- Filing Date
- 2026-03-06
- Publication Date
- 2026-09-17
Smart Images
Figure US2026018107_17092026_PF_FP_ABST
Abstract
Description
Attorney Docket: 121324-12602SYSTEMS AND METHODS FOR PASSIVE MONITORING OF WEB BROWSER UPLOAD AND DOWNLOAD ACTIVITYRelated Applications
[0001] This application claims priority to U.S. Non-Pro visional Application No. 19 / 078,101, filed March 12, 2025 and titled “Systems and Methods for Passive Monitoring of Web Browser Upload and Download Activity” and naming John Dwyer, Martin Pillion, and Kevin Wenchel as inventors [Attorney Docket No. 121324-12601]
[0002] The disclosure of each of the foregoing is incorporated herein by reference, in its entirety.Technical Field
[0003] The present disclosure relates to computer networks, and more particularly, to network security for upload and download of files using a web browser.Background Art
[0004] It is known that a computer user can exfiltrate a document from a network by uploading the document to a remote source. For example, an unfaithful employee might use a web browser to upload a sensitive company document across the Internet to a remote data store for later use by the employee or a third party. Such activity presents a data security problem for the document’ s owner.
[0005] Two common approaches that have been used to address this problem 1) the use of web browser extensions and 2) the use of code injection. These are both active techniques. They require active interference with web browser processes, in ways that could impact stability or performance of the application.
[0006] The code injection approach injects a Dynamic Link Library (“DLL”) into the address space of the web browser at run-time. The DLL patches code in the web browser application to divert the processing related to file upload or download into code located in the injected DLL. The code in the injected DLL can then record the occurrence of the behavior.
[0007] The code injection approach alters the vendor delivered functionality of a web browser application by patching code and possibly internal data structures within the web browser process at run time. This is an inherently dangerous thing to do to an application of any sophistication. Mistakes or miscalculations in implementation can easily result browser application crashes. In addition, security products, and in some cases the web browserapplication itself, may attempt to interfere with or block code injection and patching of the web browser because of the tendency of malicious code to use such techniques.
[0008] The web browser extension approach uses the facilities provided by most web browsers for writing extensions in JavaScript that can interact with web pages and the web browser itself. In this approach an extension will rewrite portions of the web page code to hook common pathways by which web applications initiate file upload or download activity.
[0009] The web extension approach requires setup that adds complexity and reduces flexibility and ease of deployment. The web extension approach requires first installing the web extension into all the supported browsers that will be monitored on the on the endpoint computers. Forcing the install of a web extension without user intervention throughout an organization will typically require the use of group policies in a Microsoft Windows environment. This requires an administrative change to the network before the solution can be effectively deployed. In addition, due to security restrictions implemented by most browsers, web extensions cannot be installed from the local disk. They must be installed over the network from a web store or a URL marked as trusted as indicated through a separate policy setting. In that case, the vendor implementing such a solution would have to publish their web extension publicly to a web store or require their customer to host it locally on their internal network. Finally, after the installation of a web extension by a policy the web extension may not take effect until the web browser application is restarted.Summary of Various Embodiments
[0010] Illustrative embodiments detect file uploads and downloads initiated by user activity and captures the disk file path and URL associated with the activity. This capability has various uses in the security domain. Some embodiments are useful, for example, to monitor the exfiltration of an organization's data from endpoint computers to file sharing web sites by malicious insiders.
[0011] Various embodiments employ a unique approach to address these issues by using operating system facilities to passively observe a web browser application’s activity, such as process and file system activity, and applies heuristics to these behaviors to reliably detect the occurrence of user-initiated file upload and download in the web browser.Illustrative embodiments then employ user accessibility features available in the operating system in conjunction with heuristics to read the contents of the URL Bar from the web browser application’s user interface at the time of the upload or download.
[0012] A first illustrative embodiment includes a method of identifying exfiltration of a file from a computer system via a web browser running under an operating system, the web browser having a URL bar. The method includes:
[0013] detecting, by a session monitor monitoring a first session running under the operating system, initiation of a file upload in a web browser running in the session by:
[0014] identifying, using native resources of the operating system and without using a web browser extension and without code injection for said identifying, a head browser process for the web browser; and
[0015] detecting, using native resources of the operating system, opening of a file via the web browser;
[0016] in response to detecting opening of the file, identifying a uniform resource locator from the web browser by:
[0017] identifying, using user accessibility features of the operating system, a window in which the web browser is displayed;
[0018] identifying the web browser using user accessibility features of the operating system, said web browser being an identified web browser;
[0019] obtaining, from a computer memory, browser heuristics associated with the identified web browser;
[0020] identifying, using the browser heuristics associated with the identified web browser, the URL bar of the identified web browser;
[0021] reading, using the session monitor, the uniform resource locator from the web browser’ s URL bar; and
[0022] determining that the uniform resource locator is a prohibited URL.
[0023] Some embodiments of the method further include: prior to detecting initiation of a file upload in a web browser, detecting initiation of the web browser in the first session, and spawning the session monitor in the first session.
[0024] In some embodiments of the method, determining that the uniform resource locator is a prohibited URL comprises determining that the uniform resource locator matches a URL on a list of prohibited URLs.
[0025] In some embodiments of the method, determining that the uniform resource locator is a prohibited URL comprises determining that the uniform resource locator is not on a list of allowed URLs.
[0026] Some embodiments of the method further include: in response to determining that the uniform resource locator is a prohibited URL: preventing the upload.
[0027] Some embodiments of the method further include: in response to determining that the uniform resource locator is a prohibited URL: causing the computer system to take a screenshot of the web browser.
[0028] Some embodiments of the method further include: in response to determining that the uniform resource locator is a prohibited URL: alerting an administrator of the computer system.
[0029] Some embodiments of the method further include: in response to determining that the uniform resource locator is a prohibited URL: causing the computer system to take a screenshot of the web browser; and alerting an administrator of the computer system by sending the screenshot that administrator.
[0030] Some embodiments of the method further include: detecting initiation of a session on the computer system and, in response to said detecting, spawning the session monitor within the session.
[0031] In some embodiments of the method, the method identifies exfiltration of a file from a computer system via a web browser running under an operating system without injecting a Dynamic Link Library (“DLL”) into the address space of the web browser at runtime.
[0032] In some embodiments, the method identifies exfiltration of a file from a computer system via a web browser running under an operating system without installing a web browser extension into the web browser, which web browser extension is configured to interact with web pages and the web browser itself to rewrite portions of web page code to capture a pathway by which the web browser initiates file upload activity.
[0033] Yet another embodiments includes a computer-implemented system for identifying exfiltration of a file, the system including:
[0034] a computer system having a web browser running under an operating system, the web browser having a URL bar;
[0035] a session monitor configured to detect initiation of a file upload in the web browser running in a session by:
[0036] identifying, using resources of the operating system, a head browser process for the web browser; and
[0037] detecting, using resources of the operating system, opening of a file via the web browser;
[0038] an identifying module configured to identify, in response to detecting opening of the file by the session monitor, a uniform resource locator from the web browser by:
[0039] identifying, using user accessibility features of the operating system, a window in which the web browser is displayed;
[0040] identifying the web browser using user accessibility features of the operating system;
[0041] obtaining, from a computer memory, browser heuristics associated with the web browser;
[0042] identifying, using the browser heuristics associated with the web browser, the URL bar of the web browser;
[0043] the session monitor further configured to read the uniform resource locator from the web browser’ s URL bar; and
[0044] a determination module configured to determine whether the uniform resource locator is a prohibited URL.
[0045] In some embodiments, the determination module is configured to determine whether the uniform resource locator is a prohibited URL by determining that the uniform resource locator matches a URL on a list of prohibited URLs.
[0046] In some embodiments, the determination module is configured to determine whether the uniform resource locator is a prohibited URL by determining whether the uniform resource locator is not on a list of allowed URLs.
[0047] Some embodiments of the system further include a prevention module configured to prevent upload of the file in response to a determination, by the determination module, that the uniform resource locator is a prohibited URL.
[0048] Some embodiments of the system further include an evidence module configured to take a screenshot of the web browser in response to a determination, by the determination module, that the uniform resource locator is a prohibited URL.
[0049] Some embodiments of the system further include an alert module configured to alert an administrator of a computer system in response to a determination, by the determination module, that the uniform resource locator is a prohibited URL.
[0050] Some embodiments of the system further include a spawning module configured to detect initiation of a session on the computer system and, in response to said detection, to spawn the session monitor within the session.
[0051] Yet another embodiment includes a non-transitory computer-readable medium having computer executable code thereon, the computer executable code, when executed by a computer system, causing the computer system to perform a method, the code including:
[0052] code for detecting, by a session monitor monitoring a session, initiation of a file upload in a web browser running in the session by:
[0053] identifying, using resources of the operating system, a head browser process for the web browser; and
[0054] detecting, using resources of the operating system, opening of a file via the web browser;
[0055] code for identifying, in response to detecting opening of the file, a uniform resource locator from the web browser by:
[0056] identifying, using user accessibility features of the operating system, a window in which the web browser is displayed;
[0057] identifying the web browser using user accessibility features of the operating system;
[0058] obtaining, from a computer memory, browser heuristics associated with the web browser;
[0059] code for identifying, using the browser heuristics associated with the web browser, the URL bar of the web browser;
[0060] code for reading, using the session monitor, the uniform resource locator from the web browser’ s URL bar; and
[0061] code for determining that the uniform resource locator is a prohibited URL.
[0062] In some embodiments, code for determining that the uniform resource locator is a prohibited URL includes: code for determining that the uniform resource locator is on a list of prohibited URLs.
[0063] In some embodiments, code for determining that the uniform resource locator is a prohibited URL includes: code for determining that the uniform resource locator is not on a list of permitted URLs.
[0064] In some embodiments, the code further includes: code for preventing upload of the file in response to determining that the uniform resource locator is a prohibited URL.
[0065] In some embodiments, the code further includes: code for causing the computer system to take a screenshot of the web browser in response to determining that the uniform resource locator is a prohibited URL; and code for alerting an administrator of the computer system by sending the screenshot to that administrator.
[0066] In some embodiments, the computer executable code does not include: a web browser extension installed in the web browser, which web browser extension is configured to interact with web pages and the web browser itself to rewrite portions of web page code to capture a pathway by which the web browser initiates file upload activity; and does not include: a Dynamic Link Library (“DLL”) disposed into the address space of the web browser at run-time.Brief Description of the Drawings
[0067] The foregoing features of embodiments will be more readily understood by reference to the following detailed description, taken with reference to the accompanying drawings, in which:
[0068] Figure 1A schematically illustrates a user’s computer according to an illustrative embodiment;
[0069] Figure IB schematically illustrates an embodiment of a computer network;
[0070] Figure 2A schematically illustrates an embodiment of a system;
[0071] Figure 2B schematically illustrates an embodiment of a system;
[0072] Figure 3 is a flowchart of an embodiment of a method for identifying prohibited file operations on a computer system;
[0073] Figure 4 is a flowchart of an embodiment of a method for identifying prohibited file operations on a computer system;
[0074] Figure 5 schematically illustrates an embodiment of Process Explorer data for the various Google Chrome web browser processes that are spawned upon starting the Google Chrome web browser application on a Windows operating system;
[0075] Figure 6 schematically illustrates an embodiment of a hierarchy of user interface elements in the Google Chrome browser window;
[0076] Figure 7 schematically illustrates an embodiment of a hierarchy of user interface elements in Mozilla Firefox.Detailed Description of Illustrative Embodiments
[0077] Illustrative embodiments provide improved computer system security against exfiltration of electronic files (e.g., documents) from the computer system to an external location, and / or download of electronic files to the computer system from an external source.
[0078] Such exfiltration is a problem that arises only in computer systems.
[0079] Advantages of embodiment that employ a passive observation approach over the typical active monitoring approaches (e.g., approaches that use a browser extension or code injection) include improved run-time stability, reduced coupling with third party applications, and ease of deployment.
[0080] In contrast to conventional approaches, the risk of causing instability in the web browser application through this passive monitoring is essentially non-existent. The passive observation approach does not actively interfere with or alter the vendor delivered functionality of the web browser application at run time. It uses using operating system facilities and programming interfaces in their intended and supported fashion to monitor interactions between the operating system web browser application.
[0081] In comparison to conventional approaches, the passive observation approach is system-centric. It relies on capabilities and interfaces provided by the operating system, not third-party applications. While the passive observation approach requires knowledge of the web browsers interaction with the operating system, it does not require internal implementation details. The core algorithms employed in this approach do not change between different web browser applications, instead only the specific heuristics used in those algorithms change. In addition, an expected use case for various embodiments is endpoint security products. These products already make heavy use of operating system facilities such as kernel modules for process and file system activity monitoring. Implementing various embodiments in such applications leverages existing capabilities and developer knowledge without introducing dependencies on additional programming interfaces or languages such as JavaScript.
[0082] Definitions: As used in this description and the accompanying claims, the following terms shall have the meanings indicated, unless the context otherwise requires.
[0083] An “event record” (sometimes referred-to simply as an “event”) is a record of process of a user-initiated file upload or a user- initiated file download.
[0084] A “module” includes computer system hardware under control of computerexecutable code which code, when executed by computer system hardware, causes the computer system to perform the functionality of the associated module. A module may be configured to perform functionality by providing to a computer system computer-executable code which code, when executed by the computer system, causes the computer system to perform the functionality.
[0085] The term “real time” with regard to activity detection means operations that occur while an activity is taking place, as opposed to after the activity has taken place, for example by assessing log data.
[0086] With regard to detecting and preventing exfiltration of a file from a computer system to another computer system (e.g., a remote computer system), the term “real time” means detecting an initiated exfiltration, and preventing completion of said exfiltration of said file before the file can be exfiltrated from the computer system.
[0087] With regard to detecting and preventing download of a file to a computer system from another computer system (e.g., a remote computer system), the term “real time” means detecting an initiated download and preventing completion of said download before the file can be downloaded to the computer system.
[0088] A ‘ ‘set” includes at least one member.
[0089] Figure 1A schematically illustrates a user’s computer 100 according to an illustrative embodiment. The computer 100 includes a central processing unit 102, a computer monitor (or computer display) 104, a computer keyboard 106, and a computer mouse 108. The computer 100 includes an operating system, and a web browser operating under the operating system.
[0090] Figure IB schematically illustrates an embodiment of a computer network 110, which includes a user’s computer 100 and a remote computer 130. The user’s computer 100 is in communication with the remote computer 130 over a network 120. The network 120 may be the Internet or a wide area network, for example.
[0091] A user of the user’s computer 100 could upload (e.g., exfiltrate) an electronic file from the user’s computer, or from a company network to which the user’s computer 100 is coupled, to the remote computer 130 over the network 120.
[0092] A user of the user’s computer 100 could download an electronic file from the remote computer system 130 to the user’s computer 100 over the network 120.
[0093] Illustrative embodiments detect file uploads and / or file downloads initiated by user activity through a web browser application and captures the disk file path and URL associated with the activity. This capability has various uses in the security domain. One particular use case motivating present embodiments is the need to monitor the exfiltration of an organization's data from endpoint computers to file sharing web sites by malicious insiders.
[0094] Illustrative embodiments employ a unique approach to solve this problem. It uses operating system facilities to passively observe a web browser application’s activity, such as process and file system activity, and applies heuristics to these behaviors to reliably detect the occurrence of user-initiated file upload and download in the web browser. It then employs user accessibility features available in the operating system in conjunction with heuristics to read the contents of the URL Bar from the web browser application’s user interface at the time of the upload or download. This approach contrasts with the typicalapproaches used to solve this problem which are invasive and interfere with the web browser's functionality in ways that could impact stability or performance of the application.
[0095] Modem web browser applications employ an architecture based on the security principles of separation of duties and least privilege. The work of the various subsystems of the web browser application is divided at run-time between a myriad of separate, cooperating processes. These separate processes carry out different functions and are assigned varying levels of trust within the operating system. Under this architecture, when the web browser application starts, a head browser process is created. It then creates multiple other browser processes. Every process associated with the web browser application executes the same image on disk, but the processes are executed with different command line options to assign them their distinct roles.
[0096] The head browser process is the process that provides the graphical user interface for the web browser application. It is also the process that performs much of the file system activity associated with user-initiated file uploads and downloads in the web browser application. By applying heuristics to the command line options that were used to start the various web browser processes illustrative embodiments can uniquely identify the head browser process from amongst the other web browser processes. Once illustrative embodiments have identified the head browser process, such embodiments monitor file system activity of the head browser process and apply heuristics to identify the occurrence of user-initiated file uploads and / or downloads. When the user initiates a file upload, the head browser process opens the file for uploading. The combination of options used in the operating system application programming interface (“API”) to open the file in conjunction with the file path provide the basis for heuristics used by illustrative embodiments to determine when the web browser is attempting to upload a file. The specific heuristics differ slightly between different web browser applications.
[0097] When the user initiates a file download, the web browser application first downloads the file to a temporary location on disk. Once the web browser application finishes downloading the file to the temporary file, the head browser process renames the temporary file to the downloaded file name. The extension used for the temporary file name is consistent, and the use of that extension in file rename operations performed by the head browser process is unique to renaming downloaded files. By identifying file rename operations performed by the head browser process where the source file to be renamed has the known extension, illustrative embodiments can identify the completion of a user-initiated file download operation as well as the identify the full storage path for the downloaded file. The heuristics associated with the file rename operation differ between different web browser applications.
[0098] Once illustrative embodiments have identified the occurrence of file upload or download activity, illustrative embodiments identify the URL associated with the activity. To do this, illustrative embodiments employ user accessibility facilities provided by the operatingsystem. These facilities are often used for applications such as assisted screen reading. They provide run-time support for interrogating the user interface elements contained in an application window. Common user interface elements include edit boxes, buttons, menu items, tool bars, and panes. These user interface elements are arranged in a hierarchy within a window, and each element has an associated type and may have an assigned name. Illustrative embodiments search through the web browser application’s user interface, which is hosted by the head browser process, to find and copy the contents of user interface element corresponding to the web browser’s URL bar. The web browser’s URL bar contains the URL associated with the active browser tab. Each browser application is slightly different in terms of the hierarchical layout of user interface elements and the names or identifiers associated with the elements in use, so the heuristics for finding the URL bar differ between browser applications.
[0099] Figure 2A schematically illustrates an embodiment of a system 200. The system 200 may be implemented, in whole or in part, on a computer 100 or a plurality of computers in a network.
[0100] The inventors implemented several embodiments in the Windows operating system and supports the following web browser applications: Google Chrome, Microsoft Edge, and Mozilla Firefox. The implementation consists of a kernel module 230, a user space service referred to as the Agent Service, and a user session executable referred to as the Session Monitor. Figure 2A illustrates the relationship between these components.
[0101] The kernel module 230 monitors process activity and file system activity on the system. It generates event data in response to these activities. The Agent Service 212 uses device I / O control requests to obtain the event data from the kernel module. The Agent Service 212 applies heuristics to event data to identify file occurrence of file upload and download activity in a web browser application.
[0102] In response to file upload and download activity, the Agent Service 212 coordinates the work to obtain the URL associated with the activity. This is obtained by reading the URL bar contents from the web browser’ s user interface. However, the Agent Service 212 runs in session 0 (session zero), and operating system security policies prevent it from interacting with the user interfaces of applications running in other user sessions. So, the Agent Service 212 relies on a Session Monitor 222 which is executed inside the individual user sessions to perform the required interaction with the web browser application’s user interface. The Agent Service 212 monitors user logon activity on the endpoint and in response to new logons spawns a Session Monitor 222 executable inside that user session. The Agent Service 212 communicates requests to Session Monitor 222 instances using a named pipe.
[0103] In some embodiments, the Session Monitor 222 uses Microsoft’s UI Automation framework to interrogate the user interfaces of web browser applications. The UIAutomationcore.dll module supplied by the Windows operating system provides thesupport for this interaction. The operation of these components is described in greater detail below.
[0104] The kernel module 230 uses operating system APIs to receive notifications when processes start and exit on the system. The kernel module 230 also registers as a file system mini-filter driver to monitor when files are opened and when files are renamed. In response to these activities the kernel module 230 generates a set of structured data packets, referred to as events, that detail the activity.
[0105] A process event includes the related process ID, an indication of whether the process started or exited, the full executable path, as well as the full command line used to start the process. A file event includes the process ID of the process that performed the file operation, the type of operation, either open or rename, and the related file path data. In the case of file opens, the event data specifies the full file path that was opened. In the case of rename operations the event data includes the full path of both the source and destination file names.
[0106] The Agent Service 212 consumes the events generated by the kernel module 230. To address the scenario in which a browser application may have started prior to the loading of the kernel module 230, the Agent Service 212 also enumerates all existing processes at the time it starts and creates process events in response to them.
[0107] In response to a process start event the Agent Service 212 applies heuristics for identifying the head browser process. The heuristics used for identifying the head browser process are based on command line options and differ between browser applications. At a minimum the executable path is checked for the expected executable name of “chrome.exe”, “firefox.exe”, or “msedge.exe”. Additional checks beyond the executable name can be performed to verify the application’s provenance, such as examining the certificate information with which the application was signed. In current versions of Google Chrome and Microsoft Edge, the absence of the string “-type=” within the command line options reliably signifies the head browser process. In current versions of Mozilla Firefox absence of the string “-contentproc” signifies the head browser process.
[0108] These heuristics are developed using tools like the Syslntemals Process Explorer tool. Figure 5 shows Process Explorer data for the various Google Chrome web browser processes that are spawned upon starting the Google Chrome web browser application on Windows. The first process shown, PID 13060, is the head browser process.
[0109] In response to a file event, the Agent Service 212 checks if the process ID associated with the file event matches a head browser process ID. If a matching file event represents a file open, illustrative embodiments check the parameters to the file open system call such as desired access, share mode, creation disposition against a heuristic. Portions of the opened file path are also checked against an exclusionary path filter to reduce the risk of false positives. This is because the head browser process may sometimes open certain of its own application data files using the same file parameters used to open files for uploads. Thesecases typically involve files located in paths associated with the web browser’s installation location or data directories, and illustrative embodiment can enumerate them through testing.
[0110] In circumstances in which a matching file event represents a file rename, illustrative embodiments check the extension of the source file being renamed against heuristics. The extensions used for in-progress file downloads vary between browsers.Microsoft Edge and Google Chrome use the extensions “.crdownload” while Mozilla Firefox uses “.part”. Portions of the destination file path are also checked against an exclusionary path filter to reduce the risk of false positives. This is because there are cases in which download operations initiated by the web browser, for example during software update operations, may employ this same download technique as user-initiated downloads. These cases typically involve files being saved in path locations associated with the web browser’s installation location or data directories, and illustrative embodiments can enumerate them through testing.
[0111] After detecting a user-initiated file upload or download operation, illustrative embodiments determine the URL associated with the activity by using the Windows UI Automation framework (see, e.g., Karl-Bridge-Microsoft, “lUIAutomation (uiautomationclient.h) - Win32 Apps,” Microsoft Learn, October 5, 2021, https: / / learn.microsoft.com / en-us / windows / win32 / api / uiautomationclient / nn-uiautomationclient-iuiautomation.). Illustrative embodiments use this framework to programmatically search the hierarchy of user interface elements in the user interface of the head browser process to obtain the contents of the URL Bar. The Agent Service 212 initiates this work by sending a command over named pipe communications to the Session Monitor 222 with the process ID of the head browser process. The Session Monitor 222 uses a series of heuristics to find the window associated with the web browser application and then to read the contents of its URL bar.
[0112] First, the Session Monitor 222 determines the name of the web browser application executable based on the process ID for the head browser process by using the GetProcessImageFileName API. Based on knowing which web browser application is in use, the Session Monitor 222 selects the heuristic for the web browser’s window class name. For both Google Chrome and Microsoft Edge, the window class is "Chrome_WidgetWin_l". In the case of Mozilla Firefox, the Window class name is “MozillaWindowClass”.
[0113] Next the FindWindowsEx API is repeatedly called to return a handle for every instance of a window on the system using the expected class name. For each window instance found, the Session Monitor 222 calls the IsWindowVisible function to determine whether this window has the visible property. A web browser application may have several windows, some of which do not have the visible property. The visible property indicates that this window is allowed to be displayed on the screen. A window can be marked as hidden and effectively invisible on screen. The window containing the URL bar will always have the visible property.
[0114] Then the Session Monitor 222 uses the GetWindowThreadProcessId API to check whether the window handle is owned by the head browser process based on the process ID supplied to the Session Monitor 222 by the Agent Service 212. This is important because there may be multiple window instances in a user session using the same window class name. For example, Microsoft Edge and Google Chrome are both based on the open-source Chromium web browser, and consequently both use the same window class name of "Chrome_WidgetWin_l". It is possible the Chromium web browser may be incorporated into other applications as well.
[0115] Finally, there may be multiple windows owned by the head browser process that meet all the above criteria. This occurs for example when multiple windows are opened in a web browser application. Because the FindWindowEx API returns window handles in Z-order (see., e.g., Wikipedia contributors, “Z-order,” Wikipedia, February 13, 2024, https: / / en.wikipedia.org / wiki / Z-order.), the last window handle returned which matches all our criteria is the topmost of the matching browser windows. Because the user is actively interacting with the browser interface at the time illustrative embodiments detect the file upload or download activity, this topmost window is the correct window to interrogate.
[0116] Once a handle to the appropriate window has been obtained, the Microsoft Windows Automation API can be used to search the user interface elements within the window to find the URE bar.
[0117] Figure 6 shows the hierarchy of user interface elements in the Google Chrome browser window as displayed by Microsoft’s Inspect tool (see, e.g., Karl-Bridge-Microsoft, “Accessibility Tools - Inspect - Win32 Apps,” Microsoft Learn, February 10, 2023, https: / / learn.microsoft.com / en-us / windows / win32 / winauto / inspect-objects.). The selected element has a type of “edit”, indicating an edit control box, and a name of “Address and search bar”. The right-hand side shows the name associated with the element that illustrative embodiments use in the Automation API to search for it. The value contained within this element corresponds with the URL string displayed in the web browser’ s URL bar. This is the URL associated with the active browser tab.
[0118] Figure 7 shows the hierarchy of user interface elements in Mozilla Firefox. In this case the URL bar element has a name associated with it that changes based on the default search engine configured for the browser. Because that value may be changed according to user configuration, illustrative embodiments instead rely on the automation ID associated with this element in our search heuristics.
[0119] Figure 2B schematically illustrates an embodiment of a system.
[0120] The system includes an interface 201 configured to enable communication from each module of the system to each other module of the system.
[0121] The system includes a communications module 250 configured to enable electronic communication between the system and other electronic systems such as computers, databases, or memories.
[0122] The system includes a memory 260 configured to store code for execution by the system, and / or data.
[0123] The system includes a display driver 290 configured to generate a visual display on a computer monitor 104.
[0124] The system includes a spawning module 232, which in some embodiments may be included in Kernel module 230, configured to detect initiation of a session on the computer system and, in response to said detection, to spawn the session monitor within the session.
[0125] The system includes a session monitor module 222 configured to detect initiation of a file upload in the web browser running in a session by: identifying, using resources of the operating system, a head browser process for the web browser; and detecting, using resources of the operating system, opening of a file via the web browser.
[0126] The system includes an identifying module 224, which may be included in session monitor 222, configured to identify, in response to detecting opening of the file by the session monitor, a uniform resource locator from the web browser. In some embodiments, the identifying module 224 is configured to identify, in response to detecting opening of the file by the session monitor, a uniform resource locator from the web browser by: identifying, using user accessibility features of the operating system, a window in which the web browser is displayed; identifying the web browser using user accessibility features of the operating system; obtaining, from a computer memory, browser heuristics associated with the web browser; and identifying, using the browser heuristics associated with the web browser, the URL bar of the web browser. In some embodiments, the identifying module is configured to read the URL from the URL bar.
[0127] The system includes a determination module 270 configured to determine whether the uniform resource locator is a prohibited URL. In some embodiments, the determination module 270 is configured to determine whether the uniform resource locator is a prohibited URL by determining that the uniform resource locator matches a URL on a list of prohibited URLs. In some embodiments, determination module 270 is configured to determine whether the uniform resource locator is a prohibited URL by determining whether the uniform resource locator is not on a list of allowed URLs.
[0128] The system also includes a response module 280 configured to initiate or execute one or more responses to detecting initiation of a download of a file from a prohibited URL, and / or initiate of an upload of a file from a prohibited URL.
[0129] The system includes a prevention module 282, which in some embodiments may be included in response module 280, configured to prevent upload of the file in response to a determination, by the determination module, that the uniform resource locator is a prohibited URL.
[0130] The system includes an evidence module 284, which in some embodiments may be included in response module 280, configured to take a screenshot of the web browserin response to a determination, by the determination module, that the uniform resource locator is a prohibited URL.
[0131] The system includes an alert module 286, which in some embodiments may be included in response module 280, configured to alert an administrator of a computer system in response to a determination, by the determination module, that the uniform resource locator is a prohibited URL.
[0132] Figure 3 is a flowchart of an embodiment of method of detecting and reacting to initiation of a file upload to a remote computer system, or file download from a remote computer system, via a web browser on a user’ s computer system.
[0133] Step 310 includes detecting initiation of a file upload from a user’s computer 100 to remote computer system 130 over a network 120 via a web browser. Such a file may be referred-to as a “target” file.
[0134] Such a file upload may be initiated, for example, by a user of the web browser on the user’s computer 100. In illustrative embodiments, the initiated upload is part of uploading a file from the user’s computer 100 to the remote computer system 130, wherein the remote computer system 130 is identified by a unique uniform resource locator (or “URL”). Such a URL may be referred-to as the “target” URL. In illustrative embodiments, the user of the user’s computer 100 may be described as an “insider” in that the user is authorized to use that computer 100, and maybe authorized to access the file being uploaded, and may be authorized to access a company network with which the user’s computer is in communication. Use of the computer 100, and / or access by the user to the file, and / or access by the user to a company network, typically would not trigger an alert of unauthorized user or access. Such use and / or access would not be an intrusion into the computer 100 or a company network with which the computer 100 is in communication, and therefore would not be detected as an intrusion and would trigger an intrusion alert.
[0135] Step 320 includes identifying the target URL. A URL identified at step 320 may be referred-to as an “identified” URL.
[0136] Step 330 includes assessing the detected upload activity. In some embodiments, step 330 includes comparing the identified URL against a set of prohibited URLs to determine whether the initiated upload is attempting to, or intended to, upload the file to a URL or computer system to which such uploads are prohibited. Such a set of prohibited URLs may be defined, for example, by the owner of the target file.
[0137] In some embodiments, determining that the uniform resource locator is a prohibited URL includes determining that the uniform resource locator matches a URL on a list of prohibited URLs.
[0138] In some embodiments, determining that the uniform resource locator is a prohibited URL includes determining that the uniform resource locator is not on a list of allowed URLs.
[0139] Step 340 includes taking action to secure the file (and thereby, for example, securing a company’s data) in response to detecting upload activity to the identified URL. The action may include preventing successful completion of a detected upload by, for example, terminating or freezing the operation of the web browser, and / or terminating the web browser on the user’s computer 100, to name but a few examples.
[0140] Figure 4 is a flowchart of a method of preparing a computer 100 to implement embodiments described herein.
[0141] Step 410 includes detecting initiation of a browser instance on a user’s computer system.
[0142] Step 415 includes spawning a session monitor (e.g., an instance of a session monitor module 222).
[0143] Step 420 includes identifying a head browser process for the detected browser instance.
[0144] Step 425 includes detecting a file action from the detected browser. A file action may include initiation of a file upload to a URL from the user’s computer system via the browser, and / or initiation from within the browser of a file download to the user’s computer system.
[0145] Step 430 includes identifying the browser type associated with the file action. For example, a browser type may be Google Chrome, Firefox, or Microsoft Edge, to name but a few examples.
[0146] Step 435 includes obtaining or accessing a set of browser heuristics, which browser heuristics are associated with the identified browser type. In illustrative embodiments, an associated (or “corresponding”) set of heuristics may be stored in, and accessible from, a computer’s memory, and / or a remote computer or database 110 accessible from the computer 100 directly, or over network 120.
[0147] The process also identifies the window in which the identified browser is operating. To that end, step 440 includes identifying windows running on the user’s computer system. Step 445 includes identifying, from the windows identified at step 440, which of the identified windows is visible.
[0148] Step 450 includes confirming the window handle.
[0149] Step 455 includes identifying a specific browser process.
[0150] The process also includes identifying the URL associated with the file action in the identified browser (an embodiment of step 320 from Figure 3). To that end, step 460 includes identifying the URL bar within the identified browser, and step 465 includes reading the URL from the URL bar.
[0151] Step 470 includes assessing the URL to determine whether the URL is a prohibited URL (e.g., an embodiment of step 330 from Figure 3). A prohibited URL is a URL to which file upload and / or from which file download is prohibited by a policy applicable to the user’ s computer system.
[0152] Step 475 (e.g., an embodiment of step 340 from Figure 3) includes initiating a response action when a file action includes a file upload to a prohibited URL and / or file download from a prohibited URL. A response action may include, for example, one or more of the following: preventing the file action (e.g., preventing the upload; preventing the download); causing the computer system to take a screenshot of the web browser; and / or alerting an administrator of the computer system; and / or causing the computer system to take a screenshot of the web browser; and alerting an administrator of the computer system by sending the screenshot that administrator.
[0153] A listing of certain reference numbers is presented below.
[0154] 100: User’s computer system;
[0155] 102: Central processing unit;
[0156] 104: Computer display monitor;
[0157] 106: Computer Keyboard;
[0158] 108: Computer mouse;
[0159] 110: Database;
[0160] 120: Computer network;
[0161] 130: Remote computer;
[0162] 200: System;
[0163] 201: Communications interface;
[0164] 210: Session zero;
[0165] 212: Agent Service (or Agent Service Module);
[0166] 220: Session One;
[0167] 222: Session Monitor (or Session Monitor Module);
[0168] 224: Browser Application;
[0169] 230: Kemal Module;
[0170] 250: Communications Module;
[0171] 260: Memory Module;
[0172] 270: Determination Module;
[0173] 280: Response Module;
[0174] 290: Display Driver Module;
[0175] Various embodiments may be characterized by the potential claims listed in the paragraphs following this paragraph (and before the actual claims provided at the end of this application). These potential claims form a part of the written description of this application. Accordingly, subject matter of the following potential claims may be presented as actual claims in later proceedings involving this application or any application claiming priority based on this application. Inclusion of such potential claims should not be construed to mean that the actual claims do not cover the subject matter of the potential claims. Thus, a decision to not present these potential claims in later proceedings should not be constmed as a donation of the subject matter to the public.
[0176] Without limitation, potential subject matter that may be claimed (prefaced with the letter “P” so as to avoid confusion with the actual claims presented below) includes:
[0177] Pl. A method of identifying exfiltration of a file from a computer system via a web browser running under an operating system, the web browser having a URL bar, the method comprising:
[0178] detecting, by a session monitor monitoring a session, initiation of a file upload in a web browser running in the session by:
[0179] identifying, using native resources of the operating system, a head browser process for the web browser; and
[0180] detecting, using native resources of the operating system, opening of a file via the web browser;
[0181] in response to detecting opening of the file, identifying a uniform resource locator from the web browser by:
[0182] identifying, using user accessibility features of the operating system, a window in which the web browser is displayed;
[0183] identifying the web browser using user accessibility features of the operating system, said web browser being an identified web browser;
[0184] obtaining, from a computer memory, browser heuristics associated with the identified web browser;
[0185] identifying, using the browser heuristics associated with the identified web browser, the URL bar of the identified web browser;
[0186] reading, using the session monitor, the uniform resource locator from the web browser’s URL bar; and
[0187] determining that the uniform resource locator is a prohibited URL.
[0188] P2. The method of Pl, wherein determining that the uniform resource locator is a prohibited URL comprises determining that the uniform resource locator matches a URL on a list of prohibited URLs.
[0189] P3. The method of Pl, wherein determining that the uniform resource locator is a prohibited URL comprises determining that the uniform resource locator is not on a list of allowed URLs.
[0190] P4. The method of any of P1-P3, further comprising: in response to determining that the uniform resource locator is a prohibited URL: preventing the upload.
[0191] P5. The method of any of P1-P4, further comprising: in response to determining that the uniform resource locator is a prohibited URL: causing the computer system to take a screenshot of the web browser.
[0192] P6 The method of any of P1-P5, further comprising: in response to determining that the uniform resource locator is a prohibited URL: alerting an administrator of the computer system.
[0193] P7. The method of any of P1-P6, further comprising: in response to determining that the uniform resource locator is a prohibited URL: causing the computer system to take a screenshot of the web browser; and alerting an administrator of the computer system by sending the screenshot that administrator.
[0194] P8. The method of any of P1-P7, further comprising:
[0195] detecting initiation of a session on the computer system and, in response to said detecting, spawning the session monitor within the session.
[0196] P9. The method of any of P1-P8, wherein the method identifies exfiltration of a file from a computer system via a web browser running under an operating system without the use of a web browser extension and without the use of code injection.
[0197] PIO. The method of any of P1-P9, wherein the method identifies exfiltration of a file from a computer system via a web browser running under an operating system without injecting a Dynamic Link Library (“DLL”) into the address space of the web browser at runtime.[O198]P11. The method of any of Pl -P10, wherein the method identifies exfiltration of a file from a computer system via a web browser running under an operating system without installing a web browser extension into the web browser, which web browser extension is configured to interact with web pages and the web browser itself to rewrite portions of web page code to capture a pathway by which the web browser initiates file upload activity.
[0199] Pl 12. A computer-implemented system for identifying exfiltration of a file, the system comprising:
[0200] a computer system having a web browser running under an operating system, the web browser having a URL bar;
[0201] a session monitor configured to detect initiation of a file upload in the web browser running in a session by:
[0202] identifying, using resources of the operating system, a head browser process for the web browser; and
[0203] detecting, using resources of the operating system, opening of a file via the web browser;
[0204] an identifying module configured to identify, in response to detecting opening of the file by the session monitor, a uniform resource locator from the web browser by:
[0205] identifying, using user accessibility features of the operating system, a window in which the web browser is displayed;
[0206] identifying the web browser using user accessibility features of the operating system;
[0207] obtaining, from a computer memory, browser heuristics associated with the web browser;
[0208] identifying, using the browser heuristics associated with the web browser, the URL bar of the web browser;
[0209] the session monitor further configured to read the uniform resource locator from the web browser’ s URL bar; and
[0210] a determination module configured to determine whether the uniform resource locator is a prohibited URL.[O211]P113. The system of Pl 12 wherein the determination module is configured to determine whether the uniform resource locator is a prohibited URL by determining that the uniform resource locator matches a URL on a list of prohibited URLs.
[0212] Pl 14. The system of any of Pl 12-P113 wherein the determination module is configured to determine whether the uniform resource locator is a prohibited URL by determining whether the uniform resource locator is not on a list of allowed URLs.
[0213] Pl 15. The system of any of Pl 12-P114, further comprising a prevention module configured to prevent upload of the file in response to a determination, by the determination module, that the uniform resource locator is a prohibited URL.
[0214] Pl 16. The system of any of Pl 12-P115, further comprising an evidence module configured to take a screenshot of the web browser in response to a determination, by the determination module, that the uniform resource locator is a prohibited URL.
[0215] Pl 17. The system of any of Pl 12-P116 further comprising an alert module configured to alert an administrator of a computer system in response to a determination, by the determination module, that the uniform resource locator is a prohibited URL.
[0216] Pl 18. The system of any of Pl 12-P117 further comprising a spawning module configured to detect initiation of a session on the computer system and, in response to said detection, to spawn the session monitor within the session.
[0217] P219. A non-transitory computer-readable medium having computer executable code thereon, the computer executable code, when executed by a computer system, causing the computer system to perform a method, the code comprising:
[0218] code for detecting, by a session monitor monitoring a session, initiation of a file upload in a web browser running in the session by:
[0219] identifying, using resources of the operating system, a head browser process for the web browser; and
[0220] detecting, using resources of the operating system, opening of a file via the web browser;
[0221] code for identifying, in response to detecting opening of the file, a uniform resource locator from the web browser by:
[0222] identifying, using user accessibility features of the operating system, a window in which the web browser is displayed;
[0223] identifying the web browser using user accessibility features of the operating system;
[0224] obtaining, from a computer memory, browser heuristics associated with the web browser;
[0225] code for identifying, using the browser heuristics associated with the web browser, the URL bar of the web browser;
[0226] code for reading, using the session monitor, the uniform resource locator from the web browser’ s URL bar; and
[0227] code for determining that the uniform resource locator is a prohibited URL.
[0228] P220. The non-transitory computer-readable medium of P219, wherein code for determining that the uniform resource locator is a prohibited URL comprises:
[0229] code for determining that the uniform resource locator is on a list of prohibited URLs.
[0230] P221. The non-transitory computer-readable medium of any of P219-P220, wherein code for determining that the uniform resource locator is a prohibited URL comprises:
[0231] code for determining that the uniform resource locator is not on a list of permitted URLs.
[0232] P222. The non-transitory computer-readable medium of any of P219-P221, further comprising code for preventing upload of the file in response to determining that the uniform resource locator is a prohibited URL.
[0233] P223. The non-transitory computer-readable medium of any of P219-P222, further comprising:
[0234] code for causing the computer system to take a screenshot of the web browser in response to determining that the uniform resource locator is a prohibited URL; and
[0235] code for alerting an administrator of the computer system by sending the screenshot to that administrator.
[0236] P224. The non-transitory computer-readable medium of any of P219-P223, wherein the computer executable code does not comprise:
[0237] a web browser extension installed in the web browser, which web browser extension is configured to interact with web pages and the web browser itself to rewrite portions of web page code to capture a pathway by which the web browser initiates file upload activity.
[0238] P225. The non-transitory computer-readable medium of any of P219-P224, wherein the computer executable code does not comprise:
[0239] a Dynamic Link Library (“DLL”) disposed into the address space of the web browser at run-time.
[0240] P301. A non-transitory computer-readable medium having computer executable code thereon, the computer executable code, when executed by a computer system, causing the computer system to perform a method of any of Pl - Pl 1.
[0241] Various embodiments of this disclosure may be implemented at least in part in any conventional computer programming language. For example, some embodiments may be implemented in a procedural programming language (e.g., “C”), or in an object-oriented programming language (e.g., “C++”), or in Python, R, Java, LISP or Prolog. Other embodiments of this disclosure may be implemented as preprogrammed hardware elements (e.g., application specific integrated circuits, FPGAs, and digital signal processors), or other related components.
[0242] In an alternative embodiment, the disclosed apparatus and methods may be implemented as a computer program product for use with a computer system. Such implementation may include a series of computer instructions fixed either on a tangible medium, such as a non-transitory computer readable medium (e.g., a diskette, CD-ROM, ROM, FLASH memory, or fixed disk). The series of computer instructions can embody all or part of the functionality previously described herein with respect to the system.
[0243] Those skilled in the art should appreciate that such computer instructions can be written in a number of programming languages for use with many computer architectures or operating systems. Furthermore, such instructions may be stored in any memory device, such as semiconductor, magnetic, optical or other memory devices, and may be transmitted using any communications technology, such as optical, infrared, microwave, or other transmission technologies.
[0244] Among other ways, such a computer program product may be distributed as a removable medium with accompanying printed or electronic documentation (e.g., shrink wrapped software), preloaded with a computer system (e.g., on system ROM or fixed disk), or distributed from a server or electronic bulletin board over the network (e.g., the Internet or World Wide Web). Of course, some embodiments of this disclosure may be implemented as a combination of both software (e.g., a computer program product) and hardware. Still other embodiments of this disclosure are implemented as entirely hardware, or entirely software.
[0245] Computer program logic implementing all or part of the functionality previously described herein may be executed at different times on a single processor (e.g., concurrently) or may be executed at the same or different times on multiple processors and may run under a single operating system process / thread or under different operating system processes / threads. Thus, the term “computer process” refers generally to the execution of a set of computer program instructions regardless of whether different computer processes are executed on the same or different processors and regardless of whether different computer processes run under the same operating system process / thread or different operating system processes / threads.
[0246] The embodiments described above are intended to be merely exemplary; numerous variations and modifications will be apparent to those skilled in the art. All such variations and modifications are intended to be within the scope of the present disclosure as defined in any appended claims.
Claims
What is claimed is:
1. A method of identifying exfiltration of a file from a computer system via a web browser running under an operating system, the web browser having a URL bar, the method comprising:detecting, by a session monitor monitoring a first session running under the operating system, initiation of a file upload in the web browser running in the session by:identifying, using native resources of the operating system and without using a web browser extension and without code injection for said identifying, a head browser process for the web browser; and detecting, using native resources of the operating system, opening of a file via the web browser;in response to detecting opening of the file, identifying a uniform resource locator from the web browser by:identifying, using user accessibility features of the operating system, a window in which the web browser is displayed;identifying the web browser using user accessibility features of the operating system, said web browser being an identified web browser; obtaining, from a computer memory, browser heuristics associated with the identified web browser;identifying, using the browser heuristics associated with the identified web browser, the URL bar of the identified web browser;reading, using the session monitor, the uniform resource locator from the web browser’s URL bar; anddetermining that the uniform resource locator is a prohibited URL.
2. The method of claim 1, further comprising, prior to detecting initiation of a file upload in a web browser, detecting initiation of the web browser in the first session, and spawning the session monitor in the first session.
3. The method of claim 1, wherein determining that the uniform resource locator is a prohibited URL comprises determining that the uniform resource locator matches a URL on a list of prohibited URLs.
4. The method of claim 1, wherein determining that the uniform resource locator is a prohibited URL comprises determining that the uniform resource locator is not on a list of allowed URLs.
5. The method of claim 1, further comprising: in response to determining that the uniform resource locator is a prohibited URL: preventing the upload.
6. The method of claim 1, further comprising: in response to determining that the uniform resource locator is a prohibited URL: causing the computer system to take a screenshot of the web browser.
7. The method of claim 1, further comprising: in response to determining that the uniform resource locator is a prohibited URL: alerting an administrator of the computer system.
8. The method of claim 1, further comprising: in response to determining that the uniform resource locator is a prohibited URL: causing the computer system to take a screenshot of the web browser; and alerting an administrator of the computer system by sending the screenshot that administrator.
9. The method of claim 1, further comprising:detecting initiation of a session on the computer system and, in response to said detecting, spawning the session monitor within the session.
10. The method of claim 1, wherein the method identifies exfiltration of a file from a computer system via a web browser running under an operating system without injecting a Dynamic Link Library (“DLL”) into the address space of the web browser at run-time.
11. The method of claim 1, wherein the method identifies exfiltration of a file from a computer system via a web browser running under an operating system without installing a web browser extension into the web browser, which web browser extension is configured to interact with web pages and the web browser itself to rewrite portions of web page code to capture a pathway by which the web browser initiates file upload activity.
12. A computer-implemented system for identifying exfiltration of a file, the system comprising:a computer system having a web browser running in a first session under an operating system, the web browser having a URL bar;a session monitor configured to detect initiation of a file upload in the first session by:identifying, using resources of the operating system, a head browser process for the web browser; anddetecting, using resources of the operating system, opening of a file via the web browser;an identifying module configured to identify, in response to detecting opening of the file by the session monitor, a uniform resource locator from the web browser by:identifying, using user accessibility features of the operating system, a window in which the web browser is displayed;identifying the web browser using user accessibility features of the operating system;obtaining, from a computer memory, browser heuristics associated with the web browser;identifying, using the browser heuristics associated with the web browser, the URL bar of the web browser;the session monitor further configured to read the uniform resource locator from the web browser’s URL bar; anda determination module configured to determine whether the uniform resource locator is a prohibited URL.
13. The system of claim 12 wherein the determination module is configured to determine whether the uniform resource locator is a prohibited URL by determining that the uniform resource locator matches a URL on a list of prohibited URLs.
14. The system of claim 12 wherein the determination module is configured to determine whether the uniform resource locator is a prohibited URL by determining whether the uniform resource locator is not on a list of allowed URLs.
15. The system of claim 12, further comprising:a prevention module configured to prevent upload of the file in response to a determination, by the determination module, that the uniform resource locator is a prohibited URL; andan evidence module configured to take a screenshot of the web browser in response to a determination, by the determination module, that the uniform resource locator is a prohibited URL; andan alert module configured to alert an administrator of a computer system in response to a determination, by the determination module, that the uniform resource locator is a prohibited URL.
16. The system of claim 12 further comprising a spawning module configured to detect initiation of a session on the computer system and, in response to said detection, to spawn the session monitor within the first session.
17. A non-transitory computer-readable medium having computer executable code thereon, the computer executable code, when executed by a computer system, causing the computer system to perform a method, the code comprising:code for detecting, by a session monitor monitoring a session, initiation of a file upload in a web browser running in the session by:identifying, using resources of the operating system, a head browser process for the web browser; anddetecting, using resources of the operating system, opening of a file via the web browser;code for identifying, in response to detecting opening of the file, a uniform resource locator from the web browser by:identifying, using user accessibility features of the operating system, a window in which the web browser is displayed;identifying the web browser using user accessibility features of the operating system;obtaining, from a computer memory, browser heuristics associated with the web browser;code for identifying, using the browser heuristics associated with the web browser, the URL bar of the web browser;code for reading, using the session monitor, the uniform resource locator from the web browser’s URL bar; andcode for determining that the uniform resource locator is a prohibited URL.
18. The non-transitory computer-readable medium of claim 17, wherein code for determining that the uniform resource locator is a prohibited URL comprises:code for determining that the uniform resource locator is on a list of prohibited URLs.
19. The non-transitory computer-readable medium of claim 17, wherein code for determining that the uniform resource locator is a prohibited URL comprises:code for determining that the uniform resource locator is not on a list of permitted URLs.
20. The non-transitory computer-readable medium of claim 17, further comprising at least one of:code for preventing upload of the file in response to determining that the uniform resource locator is a prohibited URL;code for causing the computer system to take a screenshot of the web browser in response to determining that the uniform resource locator is a prohibited URL; and code for alerting an administrator of the computer system by sending the screenshot to that administrator.