Systems and methods for collecting thief-identifying information on stolen computing devices

• US 9,256,766 B1
• Filed: 08/28/2013
• Issued: 02/09/2016
• Est. Priority Date: 08/28/2013
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Newstadt, Keith, Boucher, Matt
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): BEHESHTI SHIRAZI, SAYED ARESH
• Application Number:
  US14/012,433
• Time in Patent Office: 895 Days
• Field of Search: 726/25, 726/34
• US Class Current: 1/1
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss

Abstract

A computer-implemented method for collecting thief-identifying information on stolen computing devices may include (1) receiving an indication that a computing device has been stolen, (2) detecting an attempt by a thief of the stolen computing device to access a user account of the thief via the stolen computing device, (3) collecting, based at least in part on detecting the attempt by the thief of the stolen computing device to access the user account of the thief via the stolen computing device, information capable of identifying the thief, and (4) reporting, to a remote computing device, the information capable of identifying the thief. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for collecting thief-identifying information on stolen computing devices, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

receiving an indication that the computing device has been stolen;

determining that an attempt by a thief of the stolen computing device to log into a user account of the thief via the stolen computing device was successful;

collecting, at the stolen computing device based at least in part on determining that the attempt was successful, information capable of identifying the thief, wherein the information capable of identifying the thief is accessible at the stolen computing device only when the thief has successfully logged into the user account of the thief via the stolen computing device;

reporting, to a remote computing device, the information capable of identifying the thief.

2. The computer-implemented method of claim 1, wherein:

determining that the attempt to log into the user account of the thief was successful comprises detecting the attempt to log into the user account of the thief via the stolen computing device;

collecting the information capable of identifying the thief comprises collecting login information entered by the thief as part of the attempt to log into the user account of the thief.

3. The computer-implemented method of claim 2, wherein the login information comprises a username of the user account.

4. The computer-implemented method of claim 1, wherein:

determining that the attempt to log into the user account of the thief was successful comprises detecting an attempt to access content associated with the user account of the thief;

the content associated with the user account of the thief comprises the information capable of identifying the thief.

5. The computer-implemented method of claim 4, wherein the information capable of identifying the thief comprises at least one of

a username of the user account;

profile information of the user account.

6. The computer-implemented method of claim 1, wherein determining that the attempt to log into the user account of the thief was successful comprises detecting an attempt to access content associated with the user account of the thief via a uniform resource locator associated with the user account of the thief, wherein the uniform resource locator associated with the user account of the thief comprises the information capable of identifying the thief.

7. The computer-implemented method of claim 1, wherein:

determining that the attempt to log into the user account of the thief was successful comprises detecting an authentication token that was used to access the user account of the thief;

collecting the information capable of identifying the thief comprises using the authentication token to access content associated with the user account of the thief, wherein the content associated with the user account of the thief comprises the information capable of identifying the thief.

8. The computer-implemented method of claim 1, further comprising determining, based at least in part on the information capable of identifying the thief, the identity of the thief of the stolen computing device.

9. The computer-implemented method of claim 1, further comprising locating, based at least in part on the information capable of identifying the thief, the stolen computing device.

10. The computer-implemented method of claim 1, wherein the user account comprises a user account at a web site.

11. The computer-implemented method of claim 1, wherein the determining and collecting is performed at least in part by a web-browser plugin at the computing device.

12. The computer-implemented method of claim 1, wherein the determining and collecting is performed at least in part by a network filter at the computing device.

13. A system for collecting thief-identifying information on stolen computing devices, the system comprising:

a receiving module that receives an indication that a computing device has been stolen;

a detecting module that determines that an attempt by a thief of the stolen computing device to log into a user account of the thief via the stolen computing device was successful;

a collecting module that collects, at the stolen computing device based at least in part on the determination that the attempt was successful, information capable of identifying the thief, wherein the information capable of identifying the thief is accessible at the stolen computing device only when the thief has successfully logged into the user account of the thief via the stolen computing device;

a reporting module that reports, to a remote computing device, the information capable of identifying the thief;

at least one processor that executes the receiving module, the detecting module, the collecting module, and the reporting module.

14. The system of claim 13, wherein:

the detecting module determines that the attempt to log into the user account of the thief was successful by detecting the attempt to log into the user account of the thief via the stolen computing device;

the collecting module collects the information capable of identifying the thief by collecting login information entered by the thief as part of the attempt to log into the user account of the thief.

15. The system of claim 13, wherein:

the detecting module determines that the attempt to log into the user account of the thief was successful by detecting an attempt to access content associated with the user account of the thief;

the content associated with the user account of the thief comprises the information capable of identifying the thief.

16. The system of claim 13, wherein the detecting module determines that the attempt to log into the user account of the thief was successful by detecting an attempt to access content associated with the user account of the thief via a uniform resource locator associated with the user account of the thief, wherein the uniform resource locator associated with the user account of the thief comprises the information capable of identifying the thief.

17. The system of claim 13, wherein:

the detecting module determines that the attempt to log into the user account of the thief was successful by detecting an authentication token that was used to access the user account of the thief;

the collecting module collects the information capable of identifying the thief by using the authentication token to access content associated with the user account of the thief, wherein the content associated with the user account of the thief comprises the information capable of identifying the thief.

18. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

receive an indication that the computing device has been stolen;

determine that an attempt by a thief of the stolen computing device to log into a user account of the thief via the stolen computing device was successful;

collect, at the stolen computing device based at least in part on determining that the attempt was successful, information capable of identifying the thief, wherein the information capable of identifying the thief is accessible at the stolen computing device only when the thief has successfully logged into the user account of the thief via the stolen computing device;

report, to a remote computing device, the information capable of identifying the thief.