Browser Setting Tamper Detection via Cryptographic Hash Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need to detect when browser settings have been changed by malicious software (malware) and revert them to default values to prevent undesirable operation.
Innovation Solution
The method involves generating cryptographic hashes of browser settings at different times, comparing these hashes to determine if changes have been made outside the browser, and if so, setting the settings back to default values or their last known values stored in a datastore, while also determining confidence levels for malicious changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If cryptographic hash comparison is used to detect setting changes, then detection accuracy is improved, but computational overhead increases
Solution Approach 1:
The system pre-generates cryptographic hashes of browser settings at installation and stores them in a datastore before any potential malware infection occurs. This preliminary action allows for rapid comparison later without requiring complex real-time analysis, thus maintaining high detection accuracy while minimizing computational overhead during actual operation.
Solution Approach 2:
Instead of analyzing and comparing actual browser setting values directly (which would be computationally intensive and potentially expose sensitive information), the system creates cryptographic hash copies of the settings. These hash copies serve as simplified representations that can be quickly compared to detect changes, reducing computational requirements while preserving detection accuracy.
2Reliability
If all browser settings are monitored for changes, then detection completeness is improved, but system complexity increases
Solution Approach 1:
The system segments browser settings into different categories (e.g., security-related settings, display settings, privacy settings) and applies monitoring selectively. Critical settings that are more likely to be targeted by malware are monitored with higher priority, while less critical settings use lighter monitoring. This segmentation maintains detection completeness for important settings while reducing overall system complexity.
Solution Approach 2:
Different monitoring strategies and hash comparison frequencies are applied to different browser settings based on their importance and vulnerability to malware. High-priority settings receive continuous or frequent monitoring with strict hash comparison, while lower-priority settings use periodic checking. This local differentiation ensures comprehensive detection where needed while minimizing complexity in less critical areas.
Data Source
AI summary
A computer implemented method includes generating a first cryptographic hash based on at least one setting associated with a browser at a first time, storing the first cryptographic hash as a first bit string, generating a second cryptographic hash as a second bit string, wherein the second cryptographic hash is based on the at least one setting associated with the browser at a second time, determining that a setting associated with the browser has changed and that the setting change was made outside of the browser based on a comparison of the first and second bit strings, and if the setting change was made outside of the browser, setting the setting to a default value.