GRED Web Check
Early Warning System Against
Website Malware Injection(whitepaper revision 2023-MAR)Overview
In the present landscape, a website for your business is no longer
optional. It is key to reaching the target audience that is the most
likely to become loyal clientele. Without an official online presence,
you run the risk of losing a significant share of profit opportunities.
Nevertheless, there are intricacies that make managing a website
challenging. When it comes to cybersecurity, hackers are an everpresent threat to the integrity of your online presence. Even withminimal know-how, hackers are able to introduce malware to yourwebsite. The presence of malware puts you and your customer’s
privacy at risk.
Instances like this not only threatens the safety of your clients
but it also casts a negative light onto your business. According toresearch, in 2019, 62% of consumers are already not confident about
the security of the data they share with websites and retailers. Asa business, you don’t want your brand to be associated with thisnegative connotation. After all, your website is a reflection of the kindof company that you run. It should be running as smoothly as yourday-to-day operation; if they can’t trust your site, then they won’t
trust you as a brand.
Arguably, one of the most common forms of cyber breaches is
the introduction of malware otherwise known as website malware
injection. According to the most recent Google Transparency report,over 50,000 websites are deemed unsafe because of the presence of
malware. Despite the sobering statistics, traditional website security
options fail to effectively prevent attacks and safeguard a website
from malicious software.
GRED Web Check is a service that is necessary for you to managea website with peace of mind. It acts as an early warning solution
capable of alerting a web administrator in the event of a real-timeattack. This cloud-based solution continuously runs security checks
ensuring that your website is free from malware at all times.

Threats and Risks:
Common Website Malware Injections
Malware Propagation

90% Website
6% Email
4% Other

The recent Malwarebytes survey has revealed a shift of instances inmalware injections from individuals to organizations and businesses.
Over the last few years, consumer malware reports have dipped by
2%. Consequently, business detections have increased by more than
10%. Needless to say, getting acquainted with common website
malware injection is all the more important in light of the recent trend.
There are several ways malware can be introduced onto a website.
Drive-by downloads or DBDs are a type of malware attack that
downloads malicious programs onto a device without the consent of
the user. This type of malware can hijack a device, track information
and activity, as well as, disable the device completely.
What makes DBDs particularly concerning especially for businesses
is the fact that it can infiltrate legitimate websites. Through SQL
injections, CMS vulnerabilities, or HTML content modification, hackers
are able to attack consumers through a website unbeknownst to its
administrator.

“Malware now spread mostly throughtainted website...”Aside from DBDs, hackers are able to penetrate websites throughhostile JavaScript, web server modules, and website defacement.

USA Today (2013)

2

Status Quo: Traditional WebsiteSecurity
Malware has existed for as long as there have been computers in production. In fact, the first malware was detected almost four decades ago in
1982. With that said, securing a website is also not a new innovation.
Traditional web administrators rely on several measures in order to ensure that the pages that they manage are free from malicious software. Whilethese options are effective for more common threats, a system is no match to more sophisticated malware. Among the most common traditional
website security options are:

Web Application
Firewall or WAF

Web Content
Integrity Check

Web Application Firewall or WAF is undoubtedly one of themost popular website security options available in the market
today. This type of security mechanism filters threats byanalyzing HTTP traffic before it reaches the server.

Otherwise known as File Integrity Monitoring, Web Content
Integrity Check monitor’s a website by detecting recent
uploads, edits, or removals. This security option works bytaking a log of a website’s files and comparing it with thesite’s current version. This method is effective in uncoveringwebsite defacement threats.

While effective, using WAF to your operation’s advantage
takes time and effort. Specific filters have to be put in placein order to make this security measure work. There is quite
a substantial amount of friction required to install a WAF on
a website. Moreover, because of the restrictive and complex
nature of its detection system, a WAF can be easily
bypassed by a hacker.

Most websites today are rife with dynamic content.
Unfortunately, Web Content Integrity Checks only works forstatic HTML pages.

Vulnerability Assessments

SOC Outsourcing

Traditional web administrators rely on penetration andvulnerability checks in order to ensure that the pages thatthey manage are free from vulnerabilities. While effective,
this security option is not the most economical. The costprevents companies from undergoing these checks in therecommended period of time. Because of these lapses, thewebsites remain vulnerable to malware attacks.

Outsourcing a website’s security operations center or SOC
is a way to ensure its effectiveness. Third-party companies
that provide this service, after all, are experts in the field.
Aside from their expert knowledge, the SOC outsourcing
option takes the burden of effort off of the website owner.
This measure guarantees security with minimal effort.
However, SOC outsourcing comes with a hefty price tag.
Especially for a small operation, outsourcing security efforts
might not be the most cost-effective solution.

It should be emphasized that there is nothing wrong with employing traditional means of website security. However, these options are not enoughto truly secure the integrity of a website. It is important to have an early warning beacon to remain informed in instances of attacks and minimize
the effects of the infiltrations.

3Fortified Defense:
GRED Web Check Solution
The failure of traditional website security checks lies in the downtime
between detection and action. The shortcomings in the regularity ofthese safeguards allow malware to exist on a website for long periodsof time before it is addressed. At that point, these attacks may havealready caused severe damage to your online presence, your searchengine status, and the integrity of your website visitor’s systems.
In order to safeguard your operations and your client’s sensitive
information, your business needs an application that conducts
continuous testing and allows for real-time malware warnings.

What is GRED Web Check?
Specifically designed to address website malware injections, SecureBrain’s GRED Web Check is an invaluable tool that could
improve the quality of your operations. It is an early warning system created to monitor a website 24 hours a day, 7 days aweek, and 365 days in a year.
The service that GRED Web Check provides is particularly unique in the field because it is completely cloud-based and does
not require any installations on the website. It requires neither any hardware purchase nor any software downloads.
It is simple. It is effective. It is exactly what you need for your business.

How Does it Work?
GRED Web Check
REGISTERWEBSITE’S URLDOWNLOAD

INSPECT

TAKE ACTION

One of the best things about GRED Web Check is that it is fully automated and runs 24/7. Any web administrator would be
able to operate GRED Web Check with ease.

4

At the onset, the administrator is required to register their website’s URL onto GRED Web Check. Following the registration,
the system takes over and conducts an analysis of the entire website. This analysis is done in three parts - Download,
Inspection, and the Web Portal.
During the download phase, GRED Web Check analyses the entire website. It uses hyperlinks to navigate through all thepages and subsequently downloads information that needs to be inspected for malware.
After all the pages have been retrieved, the inspection phase commences. Using static analysis, GRED Web Check combs
through all pages in order to look for malicious software. Should the application detect malware, the web portal is activated.
This portal sends an alert email to the administrator and redirects any subsequent website visitors to a secure page.

Digging Deeper:
Exploring the GRED Web Check Systems
GRED Web Check is an invaluable tool that enables administrators or even business owners to manage and monitor websites with ease. The
beauty of this product lies with the built in systems that ensure the safety of a website from malware and other malicious software.
With that said, in order to truly grasp the importance of this product to your operation, it is time to dig deeper and explore all three systems thatmake GRED Web Check a necessity.

Website Owner
CORPORATEWEBSITE

Get
RequestENABLE WEB
REDIRECTEMAIL ALERT

Review Alert
Details Service
Configuration

Download
Web Content

DOWNLOAD
SYSTEMWEB
ADMINISTRATORINSPECTIONSYSTEMWEB
PORTAL

DETECT

Web Check5

Download
SystemAfter registering a website onto the GRED Web Check database, the application proceedswith the download system.
In this phase, GRED Web Check scans through the site in the same fashion as a potential
client. Then, it downloads all available web content including dynamic information generated
from server-side scripting and database retrievals. It is also during this stage that theapplication browses through HTML pages, URL links, and most importantly, EXE and ZIP links
that can introduce malware to the visitors of the website.
The download system is done continuously in order to ensure that all web content isaccounted for at all times. Following this phase, GRED Web Check proceedswith Inspection.

Inspection
SystemThe Inspection system is responsible for sifting through the data collected by the download
system and locating malicious software introduced by hackers lurking within the website.
It is in this stage that GRED Web Check DBD triggers on scripts that can launch andwreak havoc on a site. It uses a large whitelist database to distinguish known safe scripts
from unknown scripts that cannot be trusted. The database allows GRED Web Check to
identify scripts before it causes severe and irreparable damage.
GRED Web Check conducts the inspection stage through static analysis. The application
favors this type of inspection for a number of reasons:

Static versus
Dynamic

Traditionally, there are two methods used in malware detection - static analysis anddynamic analysis. Both are widely used and carry their own set of advantages
and disadvantages.
Dynamic analysis involves running the malware and observing its behavior to determine
its purpose, the severity of the damage that it can create, and the actions that need to betaken in order to circumvent the attack. While this type of analysis is able to detect a wider
range of malware, it is also notoriously slow.
Static analysis, on the other hand, identifies malware without the need to run the script.
It does so by locating the unique signature that every malware binary code has. It issignificantly faster in detecting common malware that plagues most websites. It is the more
efficient means in locating and inspecting malicious software.

Inspection
SystemTarget List

GRED Web Check uses static analysis in order to detect the different malware present on
a website. Because the application runs a signature-based inspection, there are common
types of malware that GRED Web Check is an expert in detecting. These types of threats
and scenarios include but aren’t limited to:•

DBD download trigger JavaScript and iframe•

Hostile JavaScript•

Script execution from untrusted domains•

Suspicious EXE and ZIP files•

Website Content Defacement•

Phishing•

Bogusware•

Google Search Engine Blacklist•

Law Enforcement Blacklist•

Government-issued Blacklist

6

Web
PortalWhen the Inspection System detects malware on a website, the Web Portal takes over andtakes action against the identified threat. The Web Portal process is two-fold. It first gathers
enough data in order to create a summary report detailing the threat. It explains the detailof the attack as well as the specific script injected on to the afflicted website.
Aside from the summary report on the Web Portal, an email is also sent to the administrator
to alert them of the current situation.
The Web Portal system is an integral part of GRED Web Check. It allows website owners
to act upon threats within minutes of its detection. The application minimizes the impact ofthe malware on the website and its visitors.

RedirectFeatureA quick and surefire way to lose a potential customer is through an unmaintained and unsafe
website. With traditional means of malware detection, malicious software goes unchecked
until a website visitor informs the administrator about the presence of malware. Not only
does this sully the company’s reputation, but it also exposes potential clients and their data
to serious security risks.
One of the best features of GRED Web Check is the Redirect function. In the case thatthe inspection system detects malware on a website, the application automatically redirects
subsequent visitors to a safe version of the web page. This prevents the malware fromreaching more victims in such a case wherein the administrator can’t get to the problem
right away.
The Redirect function only requires the website manager to install a small JavaScript on thewebsite. Once installed, redirection can already be enabled and disabled through the
web portal.

Seal
FeatureGRED Web Check provides an unmatched level of security to a website. It also allows
users to display a security seal on their website. This provides visitors and potential clientsthe assurance that the website they are visiting is safe, well-maintained, and freefrom malware.
Visitors can click through the seal. This displays the security rating of the web page as wellas the date of the most recent inspection. Without a doubt, GRED Web Check is a mustfor companies that are looking to grow their reputation online.

7

Additional
GRED
Web CheckFeatures

Aside from GRED Web Check’s world-class core functions, the system also offers
additional features that fortify a website against the most sophisticated malware.

Cross-domain Script Detection
GRED Web Check is able to identify external scripts that are inserted on a legitimate page
before it causes severe damage. These attacks are particularly worrisome because it targets
visitors and uses real webpages as a vehicle to execute the malicious script.

Defacement Detection
Website defacement occurs when hackers change, remove, or add content on a website
without the knowledge of the owner. This type of threat not only damages the reputation ofa brand but it also exposes the website as unsecure.
GRED Web Check is able to detect visual changes on the top page of a website. The
application subsequently notifies the administrator in the case of an attack.

Monitor Specific Tag Attribute Changes
Aside from visual content, GRED Web Check is also equipped to monitor changes in not
only the website’s JavaScript code but also changes in domain links within the HTML
content. This includes edits on the anchor tag, img tag, etc.

Simplified Vulnerability Assessment
GRED Web Check can streamline a website’s vulnerability assessment. This application
is able to run conduct a port scan assessment as well as perform Joomla assessment
using joomscan.

Health Check Detection
Frequent website downtime can be instrumental in an operation losing business. GREDWeb Check is equipped to run scans and confirm the availability of all registered pages.

Broken Link Detection
Ensuring that a website is devoid of broken links is important in maintaining searchengine rankings. Search engines like google penalize pages for incorporating links that don’t
exist. GRED Web Check not only detects broken links but it also itemizes the links thatneed to be replaced or edited.

Executable File Check
For example, Windows executable files or .exe files are often used as delivery systems formalware. GRED Web Check inspects these files to check for the presence ofmalicious software.

8

GRED Web Check:
Distribution and Pricing
GRED Web Check is brought to you by Japan’s leading security software provider, Securebrain. This pricing for the application varies depending
on inspection frequency and the number of web pages to be inspected and maintained.
There is a package that fits the budget and requirements of every scale of operations from small to medium businesses to multinational enterprises.
At present, volume discount and OEM is available. OEM partners are able to rebrand GRED Web Check’s Web Portal with their own logo on theheader and the footer. As of 2021, over 30 companies have opted to OEM GRED Web Check.
To learn more about GRED Web Check pricing and functions, do visit https://www.securebrain.co.jp/eng/website-scanner/ formore information and a two-week trial of the service.

GRED Web Check for Your Business
There are various ways hackers can infiltrate a website. From content defacement to information theft, the consequencesof leaving a website unprotected are serious and severe. It can be the difference between gaining customers or losing loyal
clientele. Needless to say, choosing an early warning detection system like the GRED Web Check for your operations is aninvestment worth making.

Protect Your Company’s ImageYour website is a reflection of the kind of company that you
run. It is your operations online business card. Needless tosay, a website riddled with malware puts out a statementthat your business is not to be trusted.
With that said, GRED Web Check ensures that all website
visitors are protected from various types of common
malware. The seal feature provides them the peace ofmind that every time they click-through your website, theirsystems are protected. In business, there are very few
things as important as your reputation. GRED Web Checkensures that the reputation that you built remains intact.

Avoid Expensive Repairs

Needless to say, early detection is valuable. Programs like
GRED Web Check ensure that casualties are kept to aminimum. Moreover, the application’s redirect function
prevents subsequent malware infections and contains
the issue.
Opting to subscribe to this security service prevents you
from spending thousands of dollars on website repairs.

Secure your Customer’s Loyalty andPatronage
With a formidable and trustworthy website, GRED Web
Check allows you to expand your client base online without
the risk of malware infection and spread. It provides you anavenue to reach more opportunities and close more deals.

It doesn’t take a computer expert to understand the factthat the longer a malware lurks on a website, the moredamage it creates for the website owner and its visitors.

9Appendix:
Screenshots of Web Portal

Web Portal Login Screen

Confirm details on web portal
Calendar will give you quick glance at check results. Red date mean ALERT!

10

Attack description

Automatically pinpoint injected scripts

11

12

History of previous checks. You can also download list of URL checked

13

GRED Web Checkby Securebrain
With almost two decades of experience, Securebrain is considered
as Japan’s leading security software provider. Based in Tokyo, ourcompany aims to provide a wide array of security options for every
type of business within and outside of Japan.
SecureBrain runs its own research center in order to ensure that weare providing the leading technologies in website malware detection
and protection. Our team of researchers is dedicated to identifying
new online website security risks and developing solutions to current
and future threats.
We have secured the business of several multinational companies
as well as government contracts that are specifically geared towards
cybercrime and security.

https://www.securebrain.co.jp/eng