When Web pages are infected with malicious code, the current security practice is to block the entire page and warn users not to go there. But what if the infected page is on a legitimate site that needs that page up in order to do business?
In a presentation here Wednesday, a Black Hat speaker proposed a new technology that strips out malware from infected Web pages, effectively allowing sites to continue to serve Web content even after a page has been infected.
The new "mod_antimalware" Web server module, which is outlined in a white paper at Black Hat, is designed to recognize malware by its behavior on a website, says Neil Daswani, CTO of upstart security vendor Dasient and co-author of the paper.
"When a PC gets infected with malware, you don’t tell the user to stop using it," Daswani says. "But that’s basically what happens to Web pages that get infected — the whole page is blocked, and your site may even be blacklisted, all because one element on one page is infected."
Mod_antimalware monitors Websites for malicious behavior, such as redirecting users to other sites or attempting to download Trojan horses, Daswani explains. It then identifies the code that instigated the malicious behavior and strips it off the page, allowing the rest of the Web content to continue being served safely.