Browser Tampering Detection via Native Code Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web browsers can be modified by malicious users to evade detection, making it difficult for online service providers to identify and mitigate suspicious activities, such as account takeovers, by falsifying browser and system properties, which undermines effective system fingerprinting and security protocols.
Innovation Solution
Incorporating tampering detection code into web pages that execute native code functions to identify overrides, allowing service providers to detect when browser software functions have been altered, thereby preventing malicious activities by denying access to resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web browsers are modified to evade detection, then user anonymity and security are improved, but system fingerprinting accuracy and security protocol effectiveness deteriorate
Solution Approach 1:
The system performs preliminary detection of browser tampering by executing native code functions and comparing their outputs against expected values before allowing access to online services. This preliminary action identifies modified browsers in advance, preventing malicious activities while maintaining security protocols for legitimate users.
Solution Approach 2:
The system implements a feedback mechanism where the execution results of native code functions are analyzed and fed back into the security decision-making process. Based on whether the outputs match expected values, the system dynamically adjusts access permissions, blocking suspicious traffic while allowing legitimate traffic to proceed.
2Reliability
If tampering detection code is implemented, then security protocol effectiveness is improved, but system complexity and computational overhead increase
Solution Approach 1:
The system leverages the browser's own native code execution capabilities to perform self-detection. By having the browser execute its own native functions and report results, the system avoids needing external detection tools or complex analysis mechanisms, thereby maintaining security effectiveness while minimizing added complexity.
Solution Approach 2:
The native code functions serve multiple purposes: they are used both for legitimate system fingerprinting and for tampering detection. This multi-functionality eliminates the need for separate detection mechanisms, reducing overall system complexity while maintaining robust security checks.
3Object-affected harmful factors
If access is denied based on tampering detection, then prevention of malicious activities is improved, but user convenience and access availability deteriorate
Solution Approach 1:
Instead of assuming all users are legitimate and trying to identify malicious ones, the system inverts the approach by assuming potential tampering and requiring proof of legitimacy through native code execution. This inversion maintains security by blocking suspicious traffic while providing seamless access to legitimate users whose browsers pass the verification.
Solution Approach 2:
The system changes the verification parameter from passive information collection to active native code execution. By requiring the browser to execute specific native functions and return expected outputs, the system creates a clear distinction between legitimate and tampered browsers, enabling automatic decision-making that protects security while maintaining convenience for legitimate users.
Data Source
AI summary
Computer system security can be threatened by users who manipulate their software to avoid detection of malicious activities—such as account takeover. Web browser software, for example, can be altered so the browser will report false information about the browser itself and/or the system on which it is running. By providing such false information, a user can try to avoid his system being fingerprinted (e.g. identified) so that the user can more effectively instigate electronic attacks without being detected. This disclosure describes techniques that allow for detection of when a user has tampered with their web browser (e.g., by overriding native code functions in the browser). Detecting that a browser has been tampered with can allow a computer server system to take mitigation actions against potentially malicious users, thus improving computer security.