Systems and methods are described for allowing the execution of authorized computer program code and for protecting computer systems and networks from unauthorized code execution. In one embodiment, a multi-level proactive whitelist approach is employed to secure a computer system by allowing only the execution of authorized computer program code thereby protecting the computer system against the execution of malicious code such as viruses, Trojan horses, spy-ware, and/or the like. Various embodiments use a kernel-level driver, which intercepts or “hooks” certain system Application Programming Interface (API) calls in order to monitor the creation of processes prior to code execution. The kernel-level driver may also intercept and monitor the loading of code modules by running processes, and the passing of non-executable code modules, such as script files, to approved or running code modules via command line options, for example. Once intercepted, a multi-level whitelist approach may be used to authorize the code execution.

Secure system for allowing the execution of authorized computer program code

Protection systems and methods provide for protecting one or more personal computers (“PCs”) and/or other intermittently or persistently network accessible devices or processes from undesirable or otherwise malicious operations of Java TN applets, ActiveX™ controls, JavaScript™ scripts, Visual Basic scripts, add-ins, downloaded/uploaded programs or other “Downloadables” or “mobile code” in whole or part. A protection engine embodiment provides for monitoring information received, determining whether received information does or is likely to include executable code, and if so, causes mobile protection code (MPC) to be transferred to and rendered operable within a destination device of the received information. An MPC embodiment further provides, within a Downloadable-destination, for initiating the Downloadable, enabling malicious Downloadable operation attempts to be received by the MPC, and causing (predetermined) corresponding operations to be executed in response to the attempts.

Malicious mobile code runtime monitoring system and methods

A system and method for identifying infection of unwanted software on an electronic device is disclosed. A software agent configured to generate a bait and is installed on the electronic device. The bait can simulate a situation in which the user performs a login session and submits personal information or it may just contain artificial sensitive information. Parameters may be inserted into the bait such as the identity of the electronic device that the bait is installed upon. The output of the electronic device is monitored and analyzed for attempts of transmitting the bait. The output is analyzed by correlating the output with the bait and can be done by comparing information about the bait with the traffic over a computer network in order to decide about the existence and the location of unwanted software. Furthermore, it is possible to store information about the bait in a database and then compare information about a user with the information in the database in order to determine if the electronic device that transmitted the bait contains unwanted software.

Method and system for protection against information stealing software

Methods and systems that can launch applications into existing isolation environments do so by executing a run module on a computing machine to intercept requests to execute an application. A client communicating with the computing machine generates requests to execute an application on the computing machine. A run module identifies a profile associated with the requested application and queries an application delivery service to identify at least one isolation environment that corresponds to the profile. The run module receives from the application delivery service a response that identifies a first isolation environment associated with the application, and issues a command to a launch module to launch the application into the first isolation environment.

Methods and systems for launching applications into existing isolation environments

An electronic message is analyzed for malware contained in the message. Text of an electronic message may be analyzed to detect and process malware content in the electronic message itself. The present technology may analyze an electronic message and attachments to electronic messages to detect a uniform resource location (URL), identify whether the URL is suspicious, and analyze all suspicious URLs to determine if they are malware. The analysis may include re-playing the suspicious URL in a virtual environment which simulates the intended computing device to receive the electronic message. If the re-played URL is determined to be malicious, the malicious URL is added to a black list which is updated throughout the computer system.

Electronic message analysis for malware detection

An innovative security solution which separates a client into a Protected Context, which is the real files and resources of the client, and an Isolated Context, which is a restricted execution environment which makes use of virtualized resources to execute applications and modify content in the Isolated Context, without allowing explicit access to the resources in the Protected Context. The solution further consolidates user interfaces to allow users to seamlessly work with content in both contexts, and provide a visual indication of which display windows are rendered from content executed in the Isolated Context.

Systems and methods for secure client applications

A method includes receiving an event indicating an action associated with a first file has been performed by a user using a first client. The action is unrelated to transmitting the first file to another client. The method also includes automatically extracting content from the first file in response to the event using the first client and generating metadata to associate with the content, and transmitting, using the first client, the content and the metadata to a peer client if the peer client and the first client are currently operating and visible to each other on a network. The timing of the transmission is determined automatically after the event is received.

Multiple client search method and system

Embodiments of invention relate to automatically updating browser extensions. In an embodiment, a method for updating browser extensions is provided. In the method, an input to execute a browser extension installed in a local browser extension database is received. In response to receipt of the input, a remote server is automatically communicated with to determine whether a portion of the browser extension should be updated. An updated portion of the browser extension is received if the browser extension should be updated. Finally, the updated portion of the browser extension is installed in the local browser extension database.

Automatically updating browser extensions, and applications thereof

Methods and systems for cross-site scripting (XSS) defense are described herein. An embodiment includes, embedding one or more tags in content at a server to identify executable and non-executable regions in the content and transmitting the content with the tags to a client based on a request from the client. Another embodiment includes receiving content embedded with one or more permission tags from a server, processing the content and the permission tags, and granting permission to a browser to execute executable content in the content based on the permission tags. A method embodiment also includes receiving content embedded with one or more verify tags from a server, performing an integrity check using the verify tags and granting permission to a browser to execute executable content in the content based on the integrity check.

Methods and systems for scripting defense

Embodiments of this invention relate to an application program interface to enable browser extensions which may be executed in different browsers. In an embodiment, a browser extension may be written in using commands written in a cross-browser application program interface. When the browser extension is executed, the cross-browser commands may be translated into a native command of the browser. In an embodiment, the commands that require access to a document object model (DOM) of a page loaded in the browser may be executed on the thread that renders the loaded page. In a further embodiment the cross-browser application program interface may be, at least in part, an asynchronous interface. In this way, the cross-browser extension application program interface provides a stable, uniform interface to implement browser extensions that can operate in a plurality of different types of web browsers.

Johann Tomas Sigurdsson

Papers

Systems and methods for secure client applications

Multiple client search method and system

Automatically updating browser extensions, and applications thereof

Methods and systems for scripting defense

Interfaces to enable cross-browser extensions and applications thereof