Protection from telephone phishing

• US 8,463,235 B1
• Filed: 09/14/2010
• Issued: 06/11/2013
• Est. Priority Date: 09/14/2010
• Status: Active Grant

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Antonov, Vadim, Levichev, Kirill
• Primary Examiner(s): Afshar, Kamran
• Assistant Examiner(s): Behnamian, Shahriar
• Application Number:
  US12/881,915
• Time in Patent Office: 1,001 Days
• Field of Search: 455/410, 455/411, 455/461, 455/551
• US Class Current: 455/410
• CPC Class Codes: H04M 1/663 Preventing unauthorised calls to a telephone set
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 3/436 Arrangements for screening incoming calls , i.e. evaluating the characteristics of a call before deciding whether to answer it based on the calling party profile H04M3/42059; based on location H04M3/42348; based on presence H04M3/42365; diversion H04M3/54

Abstract

Attempts to communicate telephonically by a mobile phone are detected. When an attempt is detected, an associated phone number is identified and transmitted to a server in order to glean corresponding security information. On the server, a database is maintained containing 1) phone numbers known to present potential security concerns and 2) descriptive security information concerning each of these phone numbers. The server receives phone numbers from mobile phones to check for security information, searches the database for received phone numbers, and transmits corresponding security information to the originating mobile phones. Security information concerning identified telephone numbers is received from the server by mobile phones. Responsive to the contents of the received security information, detected attempts to communicate telephonically are allowed to processed, blocked or otherwise processed.

Claims

1. A computer implemented method for protecting mobile users from telephone phishing, the method comprising the steps of:

detecting, by a mobile phone, an attempt to communicate telephonically;

identifying, by the mobile phone, a phone number associated with the detected attempt to communicate telephonically;

transmitting, by the mobile phone, the identified phone number to a remote computing device in order to glean security information concerning whether the identified telephone number is from a list of unallowable numbers that is automatically gathered from a plurality of independent data sources;

receiving, by the mobile phone, automatically gathered security information concerning whether the identified telephone number is from the list of unallowable phone numbers from the remote computing device; and

responsive to the received automatically gathered security information from the remote computing device, processing, by the mobile phone, the detected attempt to communicate telephonically.

2. The method of claim 1 further comprising:

maintaining, by at least one server computer,

     1) a database of phone numbers known to present potential security concerns and

     2) descriptive automatically gathered security information concerning each said phone number;

receiving, by the at least one server computer, at least one phone number being used by at least one mobile phone;

responsive to receiving a specific phone number being used by a specific mobile phone, searching the database, by the at least one server computer, for the specific phone number; and

transmitting, by the at least one server computer, security information to the specific mobile phone by which the specific phone number is being used.

3. The method of claim 2 wherein transmitting, by the at least one server computer, automatically gathered security information to the specific mobile phone by which the specific phone number is being used further comprises:

responsive to not finding the specific phone number in the database, transmitting, by the at least one server computer, automatically gathered security information to the specific mobile phone indicating that there are no known security threats associated with the specific phone number.

4. The method of claim 2 wherein transmitting, by the at least one server computer, automatically gathered security information to the specific mobile phone by which the specific phone number is being used further comprises:

responsive to finding the specific phone number in the database, transmitting, by the at least one server computer, the descriptive automatically gathered security information concerning the specific phone number from the database to the specific mobile phone.

5. The method of claim 1 wherein detecting, by the mobile phone, an attempt to communicate telephonically further comprises a step from a group of steps consisting of:

detecting, by the mobile phone, an incoming telephone call, from a specific originating phone number; and

detecting, by the mobile phone, an incoming text message, from a specific originating phone number.

6. The method of claim 1 wherein detecting, by the mobile phone, an attempt to communicate telephonically further comprises a step from a group of steps consisting of:

detecting, by the mobile phone, an attempt to place an outgoing telephone call, to a specific target phone number; and

detecting, by the mobile phone, an attempt to send an outgoing text message, to a specific target phone number.

7. The method of claim 1 further comprising:

responsive to receiving automatically gathered security information indicating that there are no known security threats associated with the identified telephone number from the remote computing device, allowing, by the mobile phone, the detected attempt to communicate telephonically to proceed.

8. The method of claim 1 further comprising:

responsive to receiving automatically gathered security information describing at least one potential security concern associated with the identified telephone number from the remote computing device, blocking, by the mobile phone, the detected attempt to communicate telephonically.

9. The method of claim 1 further comprising:

responsive to receiving security information describing at least one potential security concern associated with the identified telephone number from the remote computing device, displaying, by the mobile phone, a security warning concerning the at least one potential security concern associated with the identified telephone number.

10. The method of claim 9 further comprising performing a step from a group of steps consisting of:

responsive to receiving user input acknowledging the display of the security warning and directing the mobile phone to proceed with the attempt to communicate telephonically, allowing, by the mobile phone, the detected attempt to communicate telephonically to proceed; and

responsive to receiving user input acknowledging the display of the security warning and directing the mobile phone not to proceed with the attempt to communicate telephonically, blocking, by the mobile phone, the detected attempt to communicate telephonically.

11. At least one non-transitory computer readable storage medium storing a computer program product for protecting mobile users from telephone phishing, the computer program product comprising:

program code for detecting, by a mobile phone, an attempt to communicate telephonically;

program code for identifying, by the mobile phone, a phone number associated with the detected attempt to communicate telephonically;

program code for transmitting, by the mobile phone, the identified phone number to a remote computing device in order to glean security information concerning whether the identified telephone number is from a list of unallowable numbers that is automatically gathered from a plurality of independent data sources;

program code for receiving, by the mobile phone, automatically gathered security information concerning whether the identified telephone number is from the list of unallowable phone numbers from the remote computing device; and

program code for, responsive to the received automatically gathered security information from the remote computing device, processing, by the mobile phone, the detected attempt to communicate telephonically.

12. The computer program product of claim 11 further comprising:

program code for maintaining, by at least one server computer,

     1) a database of phone numbers known to present potential security concerns and

     2) descriptive automatically gathered security information concerning each said phone number;

program code for receiving, by the at least one server computer, at least one phone number being used by at least one mobile phone;

program code for, responsive to receiving a specific phone number being used by a specific mobile phone, searching the database, by the at least one server computer, for the specific phone number; and

program code for transmitting, by the at least one server computer, automatically gathered security information to the specific mobile phone by which the specific phone number is being used.

13. The computer program product of claim 12 wherein the program code for transmitting, by the at least one server computer, automatically gathered security information to the specific mobile phone by which the specific phone number is being used further comprises:

program code for, responsive to not finding the specific phone number in the database, transmitting, by the at least one server computer, automatically gathered security information to the specific mobile phone indicating that there are no known security threats associated with the specific phone number.

14. The computer program product of claim 12 wherein the program code for transmitting, by the at least one server computer, automatically gathered security information to the specific mobile phone by which the specific phone number is being used further comprises:

program code for, responsive to finding the specific phone number in the database, transmitting, by the at least one server computer, the descriptive automatically gathered security information concerning the specific phone number from the database to the specific mobile phone.

15. The computer program product of claim 11 wherein the program code for detecting, by the mobile phone, an attempt to communicate telephonically further comprises program code for performing at least one step from a group of steps consisting of:

detecting, by the mobile phone, an incoming telephone call, from a specific originating phone number; and

detecting, by the mobile phone, an incoming text message, from a specific originating phone number.

16. The computer program product of claim 11 wherein the program code for detecting, by the mobile phone, an attempt to communicate telephonically further comprises program code for performing at least one step from a group of steps consisting of:

detecting, by the mobile phone, an attempt to place an outgoing telephone call, to a specific target phone number; and

detecting, by the mobile phone, an attempt to send an outgoing text message, to a specific target phone number.

17. The computer program product of claim 11 further comprising:

program code for, responsive to receiving automatically gathered security information indicating that there are no known security threats associated with the identified telephone number from the remote computing device, allowing, by the mobile phone, the detected attempt to communicate telephonically to proceed.

18. The computer program product of claim 11 further comprising:

program code for, responsive to receiving automatically gathered security information describing at least one potential security concern associated with the identified telephone number from the remote computing device, blocking, by the mobile phone, the detected attempt to communicate telephonically.

19. The computer program product of claim 11 further comprising:

program code for, responsive to receiving automatically gathered security information describing at least one potential security concern associated with the identified telephone number from the remote computing device, displaying, by the mobile phone, a security warning concerning the at least one potential security concern associated with the identified telephone number; and

program code for performing at least one step from a group of steps consisting of;

responsive to receiving user input acknowledging the display of the security warning and directing the mobile phone to proceed with the attempt to communicate telephonically, allowing, by the mobile phone, the detected attempt to communicate telephonically to proceed; and

responsive to receiving user input acknowledging the display of the security warning and directing the mobile phone not to proceed with the attempt to communicate telephonically, blocking, by the mobile phone, the detected attempt to communicate telephonically.

20. A computer system for protecting mobile users from telephone phishing, the computer system comprising:

at least one processor;

system memory;

a detecting module to detect an attempt to communicate telephonically;

a number identifying module to identify a phone number associated with the detected attempt to communicate telephonically;

a transmitting module to transmit the identified phone number to a remote computing device in order to glean security information concerning whether the identified telephone number is from a list of unallowable numbers that is automatically gathered from a plurality of independent data sources;

a receiving module to receive automatically gathered security information concerning whether the identified telephone number is from a list of unallowable numbers that is automatically gathered from the remote computing device; and

responsive to the received automatically gathered security information from the remote computing device, a blocking module to process, the detected attempt to communicate telephonically.