Startup Shape Security is re-appropriating a favourite tactic of malware writers in developing a technology to protect websites against automated hacking attacks.

Trojan authors commonly obfuscate their code to frustrate reverse engineers at security firms. The former staffers from Google, VMWare and Mozilla (among others) have created a network security appliance which takes a similar approach (dubbed real-time polymorphism) towards defending websites against breaches - by hobbling the capability of malware, bots, and other scripted attacks to interact with web applications.

Polymorphic code was originally used by malicious software to rewrite its own code every time a new machine was infected. Shape has invented patent-pending technology that is able to implement "real-time polymorphism" - or dynamically changing code - on any website. By doing this, it removes the static elements which botnets and malware depend on for their attacks.

How it works

When a ShapeShifter appliance protects a website, instead of encountering an application with fixed elements that are trivial to program an attack against, cybercriminals now face the difficult task of getting their malware to interact with a web app that is a moving target, constantly rewriting itself. This is done while keeping all of the user interaction functionality intact for legitimate users. And it works better than earlier approaches such as IP reputation or throttling, the pitch goes.

Shape Security said its technology is able to defend against common hacking attacks such as SQL injection attacks as well as attempts by hackers to brute force logins to websites and application layer DDoS attacks.

The technology, in development over the past two years, also defends against so-called man-in-the-browser attacks, which are commonly used in combination with Trojans on a victim's PC to defeat the additional layer of protection offered by two-factor authentication technology.

Shuman Ghosemajumder, Shape Security VP of strategy, told El Reg that its technology relies on deflecting automated attacks rather than detection. Detection of attacks based on signatures or heuristics, is an approach taken by established technologies such as Web Application Firewalls. Ghosemajumder explained how ShapeShifter is designed to screw up automated attack code without messing things up for regular users.

"ShapeShifter institutes the same new policy for every website visitor, regardless of whether it is a legitimate user or an attacker: real-time polymorphism," he told El Reg. By constantly rewriting the code of the website's user interface, malware, bots, and scripts simply have their capability to attack the website disabled, since their own attack instructions, as coded by their authors, are rendered immediately out-of-date and invalid. Meanwhile, real users, who do not interact directly with the website's underlying user interface code, are unaffected."

No change to a customer web applications is needed in order to deploy the technology, Ghosemajumder adds.

Shape Security raised $26m in funding from investors including Google Ventures, Kleiner Perkins Caufield & Byers, Google chairman Eric Schmidt’s TomorrowVentures, and former Symantec chief exec Enrique Salem. Its business model is still being refined.

"The pricing model is still being finalised, but we are considering a subscription model as well as an appliance sales model," Ghosemajumder explained. "For early adopters we have focused on an unlimited use model and seven-figure enterprise-wide deals. We have achieved bookings in the low seven figures already and are estimating bookings of low eight figures in 2014." ®