Abstract: The subject disclosure is directed towards securing a computing device using content-based isolation. When the computing device requests content data having different ownership, a monitor component identifies and groups trusted portions of the content data into one or more isolation containers such that only trusted programs are permitted access. Other programs are, therefore, untrusted and can be denied access in order to prevent malicious activity, unless access is approved by the content owner.

Abstract: The subject disclosure is directed towards securing a computing device using content-based isolation. When the computing device requests content data having different ownership, a monitor component identifies and groups trusted portions of the content data into one or more isolation containers such that only trusted programs are permitted access. Other programs are, therefore, untrusted and can be denied access in order to prevent malicious activity, unless access is approved by the content owner.

Abstract: The subject disclosure is directed towards securing a computing device using content-based isolation. When the computing device requests content data having different ownership, a monitor component identifies and groups trusted portions of the content data into one or more isolation containers such that only trusted programs are permitted access. Other programs are, therefore, untrusted and can be denied access in order to prevent malicious activity, unless access is approved by the content owner.

Abstract: The subject disclosure is directed towards securing a computing device using content-based isolation. When the computing device requests content data having different ownership, a monitor component identifies and groups trusted portions of the content data into one or more isolation containers such that only trusted programs are permitted access. Other programs are, therefore, untrusted and can be denied access in order to prevent malicious activity, unless access is approved by the content owner.

Abstract: Described is a technology directed towards protecting against clickjacking attacks against interactive user interface elements in code that are described by the code author as sensitive to clickjacking attacks. Various defenses are described, including defenses to ensure target display integrity, pointer integrity, and temporal integrity. For example, a browser click on an element/web page may be determined to be invalid if target display integrity is compromised. Also described are defenses that act to increase the user's attention to what is actually being clicked, and defenses that disable or disallow functions and features used by attackers, such as when a sensitive element is being hovered over.

Abstract: A network address mapping system is described. The network address mapping system can identify a set of Web pages, collects information from the Web pages indicating geographical locations (“geolocations”), and correlate the geolocations with the network addresses from which the identified Web pages are served. The collected information can be weighted based on various factors, such as its relative position in a Web page. The collected information can then be used to identify a geolocation. The network mapping system can deduce geolocations for portions of ranges of network addresses based on the score, and can infer geolocations for other portions based on the deduced geolocations. This mapping can then be stored in a database and provided as a geomapping service. The network address mapping system is able to map network addresses to geographical locations.

Abstract: A network address mapping system is described. The network address mapping system can identify a set of Web pages, collects information from the Web pages indicating geographical locations (“geolocations”), and correlate the geolocations with the network addresses from which the identified Web pages are served. The collected information can be weighted based on various factors, such as its relative position in a Web page. The collected information can then be used to identify a geolocation. The network mapping system can deduce geolocations for portions of ranges of network addresses based on the score, and can infer geolocations for other portions based on the deduced geolocations. This mapping can then be stored in a database and provided as a geomapping service. The network address mapping system is able to map network addresses to geographical locations.