How does web site defacement monitoring actually work?

Question

I wish to outsource a web site defacement monitoring services to a third party and am wondering how does this type of monitoring work? If my front page has a lot of dynamic components, eg image changes, how can such monitoring detect that it is actually a real hack and not my web editors changing the page for legitimate business purpose?

Answer 1

The problem here is with dynamic pages, because with static you could do a CHECKSUM comparison.

With dynamic you could:

• Add HTML meta tag with validation code and checks if it's on page.

• Track key elements that allow you to identify major changes, such as in defacements.

I found this website that taks more about some of the ways you can use.

Answer 2

Here's an overview:

Step 1. The monitoring agent obtains the resource and detects modifications (which could be either authorized, or unauthorized).

Modification detection methods may vary, from simple HTML page "checksum" methods (as pointed out by G4spr), to more sophisticated "browser" agents that would actually interpret/render the content of your webpage, fetch any/all additional resources, execute any JavaScript, etc.

Some services would store cached ("reference") versions of your page for comparison, and will provide detailed information on what exactly has been modified within the page.

Many services allow specifying exclusions and rules, e.g. if your webpage holds areas of real-time or automatically modified content, such as news feeds, the time, etc. These must be used sparingly and carefully, or the service may fail to recognize an unauthorized modification.

Step 2. Alert - via SMS, phone call, e-mail, etc.

In order to distinguish between an approved (authorized) modification to your website, some services introduce "maintenance" triggers that would give you a time slot during which you can make modifications, which would be considered "approved". This practically turns off some alerts (e.g. instead of sending you a SMS, they would notify a list of people via e-mail). Once you're done modifying, you would turn alerting back on.

Generally, good services would notify you of what exactly has changed in your web page.

Step 3. Optional - automated recovery.

Some niche agent-based systems may restore the page automatically if the change has not been automated. This is less common and frequently the cheaper services offer support for recovery/restoration only of static pages. However, some of the more expensive solutions would be able to restore "dynamic" content, e.g. content stored in databases (e.g. CMS).

Answer 3

Defacement monitors will typically use a full-browser and take a screenshot, extract the rendered DOM (i.e., after loading all Javascript), and extract text. Then, comparisons to a baseline will be performed for each of these. For example, a pixel-by-pixel overlay for screenshot comparison and line-by-line comparisons for DOM/text. When changes are registered for any of these, you will be alerted.

However, as you describe, false positives are common for any Web change monitoring solution, particularly for defacement monitoring (which is relatively rare). Vendors have developed a number of techniques to minimize false positives such as these.

Products such as Fluxguard, for example, allow you to configure "DOM filters" to exclude (or include) certain frequently changing areas of a page with CSS selectors. For example, you might choose to exclude div.footer from any comparison. This way, for example, you can exclude a rotating banner ad at the top of a page that is constantly triggering change alerts. Other tools, such as Versionista, let you enter specific keywords that will trigger alerts (for example, naughty word lists).

At core, though, defacement monitors will ultimately require some human review to determine if a detected change is a false positive, or an actual defacement incident.