JavaScript Detection Module for MITB Attack Prevention

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Traditional methods relying on JavaScript to encrypt or obfuscate data are inadequate in preventing Man-in-the-Browser (MITB) attacks, as JavaScript can be intentionally or unintentionally disabled, leaving devices vulnerable to security breaches.

Innovation Solution

A JavaScript detection module is implemented to determine if JavaScript is enabled on a network device, and a restriction module is used to block subsequent communications until JavaScript is enabled for accessing confidential web pages, ensuring enhanced security against MITB attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If JavaScript is used to encrypt or obfuscate data, then data security is improved, but the system becomes vulnerable when JavaScript is disabled

Engineering Contradiction:

Improvedata securityVSAvoidvulnerability to MITB attacks

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary detection of JavaScript enablement status before allowing access to confidential web pages. The JavaScript detection module checks whether JavaScript is enabled on the client device prior to permitting the web page to load, preventing potential MITB attacks before they can occur.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary detection module that acts as a mediator between the client device and the confidential web page. This module independently verifies JavaScript enablement status and uses this information to control access, separating the security verification function from the web page delivery function.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If JavaScript detection and restriction modules are added, then security against MITB attacks is improved, but device complexity increases

Engineering Contradiction:

Improvesecurity against MITB attacksVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The JavaScript detection module is integrated into the existing web page delivery system, allowing it to serve multiple functions: detecting JavaScript enablement status, controlling access to confidential pages, and maintaining compatibility with existing web browsers. This multi-functionality reduces the need for separate dedicated security systems.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The detection module automatically determines JavaScript enablement status by analyzing browser behavior and sending test HTML code snippets. The system self-verifies security conditions without requiring manual user input or complex configuration, reducing operational complexity while maintaining security.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS20230007017A1Enforcing javascript for MITB detection

Publication Date: 2023.01.05 FORTINET INC

AI summary

A request for a confidential web page, and in response, can transmit an HTML code snippet to a browser running on a network device coupled to the data communication network to determine whether JavaScript is enabled locally at the network device. The confidential web page can be, for example, a log in, or other sensitive or personal data, vulnerable to browser-based intrusions. Responsive to detecting that JavaScript has been disabled, restricts subsequent communication by the network device, wherein the application firewall requires enabling of JavaScript to continue to the confidential web page. On the other hand, responsive to detecting that JavaScript has not been disabled, allowing the request for the confidential web page to proceed.