I’m always on the lookout for the latest innovations in security, and so we’re hoping that the new ShapeShifter Botwall lives up to the hype. Having just released in the US, the Shape Security’s ShapeShifter differs from traditional firewall systems in that it uses real-time polymorphism. Instead of preventing against specific attacks, the ShapeShifter aims to continuously modify the code of a website in order to make it a ‘moving target’. Shape Security’s threat brief details some types of attacks that the ShapeShifter can prevent. These include Man-in-the-Browser malware, stolen card payment checks, cross-site request forgery, and account takeover through password theft.

How it’s different

While polymorphism itself isn’t a new concept, the ShapeShifter is the first purpose-built hardware appliance that I’ve seen to use the technology in real-time. The idea is to morph the code on a website, including input fields and forms, so that vulnerabilities found by automatic indexing tools no longer exist by the time an attacker tries to exploit them.

Malware, bots and other scripted attacks already make use of polymorphism to circumvent heuristic detection and appear invisible to other security products. The ShapeShifter uses that same technology to protect websites by destroying the methods in which these vulnerabilities can be exploited. The ShapeShifter Botwall is available as a hardware appliance in the US, and we’re looking forward to seeing it in the UK so that we can fully test its effectiveness. I think that this is an exciting concept, and is definitely one to keep an eye on to see how things develop. via Shape Security