Thomas Henry Gallagher

US Patent:

7308648, Dec 11, 2007

Filed:

Nov 27, 2002

Appl. No.:

10/305544

Inventors:

David Michael Buchthal - Bellevue WA, US
Lucas Jason Forschler - Kirkland WA, US
Thomas Patrick Gallagher - Redmond WA, US
Christophe Rene Loisey - Kirkland WA, US
Walter David Pullen - Seattle WA, US
Andrzej Turski - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 17/00

US Classification:

715513, 715530, 715531, 715532, 715533, 704 10

Abstract:

A method and system are provided for filtering harmful HTML content from an electronic document. An application program interface (API) examines the fundamental structure of the HTML content in the document. The HTML content in the electronic document is parsed into HTML elements and attributes by a tokenizer and compared to a content library by a filter in the API. The filter removes unknown HTML content as well as known content that is listed as harmful in the content library. After the harmful HTML content has removed, a new document is encoded which includes the remaining safe HTML content for viewing in a web browser.

US Patent:

7343626, Mar 11, 2008

Filed:

Nov 12, 2002

Appl. No.:

10/291369

Inventors:

Thomas P. Gallagher - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 11/00
G06F 11/22
G06F 11/30

US Classification:

726 25, 726 22, 726 23, 726 24, 726 26, 713151, 713165, 713167, 713188, 709225, 707 3, 707 9

Abstract:

An automated method and system for testing a web site for vulnerability to a cross site scripting (XSS) attack are disclosed. The automated tool injects a tracer value into both GET and POST form data, and monitors the resultant HTML to determine whether the tracer value is returned to the local machine by the server to which it was sent. If the tracer value is returned, the automated tool attempts to exploit the web site by injecting a non-malicious script as part of an input value for some form data, based on the location in the returned HTML in which the returned tracer value was found. If the exploit is successful, as indicated by the non-malicious script, the automated tool logs the exploit to a log file that a user can review at a later time, e. g. , to assist in debugging the web site.

US Patent:

7577941, Aug 18, 2009

Filed:

May 22, 2002

Appl. No.:

10/155354

Inventors:

Thomas P. Gallagher - Redmond WA, US
Lawrence G. Landauer - Woodinville WA, US
Imran Akhtar - Sammamish WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 9/44
G06F 12/16

US Classification:

717126, 717102, 717121, 726 24

Abstract:

Controls of interest are indentified by determining which installed software objects associated with the application of interest exhibit certain characteristics, such as being publicly creatable, being designated as safe, and providing a security-related interface. Once the controls of interest are identified from the installed software objects, information associated with each control is obtained and stored. Each time the software program of interest is modified and re-installed, the information is updated to reflect the modifications. Additional information is also stored with the information. The information and the additional information may be provided to a browser for display and may be modified by a user to describe a present state associated with the control of interest (i. e. , tested, untested).

US Patent:

20070203973, Aug 30, 2007

Filed:

Feb 28, 2006

Appl. No.:

11/276454

Inventors:

Lawrence Landauer - Woodinville WA, US
Alan Myrvold - Redmond WA, US
Thomas Gallagher - Redmond WA, US
Daniel Ricker - Redmond WA, US
Hassan Sultan - Seattle WA, US
Ivan Medvedev - Bellevue WA, US
Adel Abouchaev - Redmond WA, US
Peter Oehlert - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 15/16

US Classification:

709203000, 709227000

Abstract:

A system for fuzzing requests and responses using a proxy includes a client that may include a client application, a server that may include a server application, and a proxy coupled between the client and the server. The proxy communicates message traffic between the client and the server related to testing the client application or the server application. The proxy is adapted to store a template resulting from the message traffic into a data store to facilitate later fuzzing of requests or responses contained in the message traffic. A user interface for presenting events resulting from the fuzzing is also described.

US Patent:

20130198294, Aug 1, 2013

Filed:

Jan 30, 2012

Appl. No.:

13/360816

Inventors:

Thomas Patrick Gallagher - Redmond WA, US
Venkataramann Renganathan - Sammamish WA, US
Brian Thomas Carver - Kirkland WA, US
Muhammed Serdar Soran - Seattle WA, US
Matthew Michael Swann - Bothell WA, US
Trace David Ferrier - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 15/16

US Classification:

709206

Abstract:

A canary value is used to validate a message from a non-web browser client application to a web server providing web services to mitigate cross-site forgery attacks. The canary value is generated by the server in party by applying a hash function to a user identifier and a time stamp. The server provides the canary value to the client application in response to receiving a message that does not have a canary or has an expired canary. The client application upon receiving an error message with a canary message will resend the prior message with the canary value present. The client application caches the canary value for subsequent messages until a new canary value is received. The canary value allows the server to ignore messages generated by the client application under control of an attacker.

US Patent:

60037636, Dec 21, 1999

Filed:

Dec 29, 1995

Appl. No.:

8/581184

Inventors:

Thomas Gallagher - Belmont CA
Murdoch Henretty - Half Moon Bay CA

Assignee:

Visa International Service - Foster City CA

International Classification:

G06F 1760

US Classification:

235379

Abstract:

A method and apparatus for recording magnetic information on traveler's checks. The invention is directed to a method of making it easier to validate traveler's checks and to identify stolen or counterfeit traveler's checks. The method utilizes an information carrying medium, such as a magnetic "stripe," on the surface of, or embedded into, the traveler's check itself. The information carrying medium is encoded with the unique identifying code of the check. Further, a database object corresponding to the unique identifying code is stored along with check status information in a central database. At the time of encashment, the traveler's check is run through a swipe-style reader, and the unique identifying code is sent to a central database for verification. The central database returns an indication to the merchant as to whether the traveler's check is valid.

US Patent:

40705803, Jan 24, 1978

Filed:

Feb 17, 1976

Appl. No.:

5/658386

Inventors:

Thomas F. Gallagher - Palo Alto CA
Robert M. Hill - Palo Alto CA
Stephen A. Edelstein - Palo Alto CA

Assignee:

Stanford Research Institute - Menlo Park CA

International Classification:

H01J 3708
B01D 5944

US Classification:

250423P

Abstract:

Isotope separation method and means are shown wherein an atomic beam containing two or more isotopes is exposed to radiation at a predetermined first wavelength to excite atoms of only one said isotope to a first intermediate excited state without substantially exciting atoms of other isotopes. These excited atoms are excited by a second radiation source at a second predetermined wavelength to a state of high principal quantum number, a Rydberg state, beneath the ionization continuum, again substantially without exciting atoms of said other isotopes to such high energy levels since substantially none of the other isotopes are in the intermediate excited state. From this bound atomic level only slightly below the ionization limit, the highly excited atoms are field ionized by electron tunneling and thence removed from the nonionized atoms by use of a moderate electric field.

US Patent:

40877655, May 2, 1978

Filed:

Jun 8, 1976

Appl. No.:

5/693851

Inventors:

Stephen A. Edelstein - Palo Alto CA
Donald C. Lorents - Palo Alto CA
Michael V. McCusker - Los Altos CA
Thomas F. Gallagher - Palo Alto CA

Assignee:

Stanford Research Institute - Menlo Park CA

International Classification:

H01S 300

US Classification:

331 945G

Abstract:

Organic transfer laser method and means are disclosed employing a gas mixture which includes an acceptor gas comprising an organic molecular vapor, and a donor gas comprising a noble gas or a group II B transition metal, such as mercury, in the vapor state. The donor gas atoms are excited to high energy metastable and/or excimer states by electron beam excitation or electron beam initiated-sustainer discharge type exciting means. Collisional transfer of electronic excitation from the excited donor gas to the lasing organic molecules takes place for excitation of organic molecules to excited singlet states in sufficient number to establish a population inversion in the electronic energy levels thereof for lasing. Depending upon the mixture employed, the laser is tunable over the visible and ultraviolet regions of the electromagnetic spectrum. Operation at high peak power levels with high efficiency is possible.