Deception using screen capture

• US 10,425,445 B2
• Filed: 12/15/2016
• Issued: 09/24/2019
• Est. Priority Date: 12/15/2016
• Status: Active Grant

• Current Assignee: Interwise Ltd. (AT&T, Inc.)
• Original Assignee: Interwise Ltd. (AT&T, Inc.)
• Inventors: Belikovetsky, Sofia, Hacohen, Ofer, Lauderdale, Steven
• Primary Examiner(s): Do, Khang
• Application Number:
  US15/381,029
• Publication Number:
  US 20180176251A1
• Time in Patent Office: 1,013 Days
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

Multiple deception techniques utilized to mislead malicious entities that attempt to gather information associated with a computing device are implemented by changing a single result. In one aspect, requests for screen captures are intercepted and it is determined whether the requests are triggered due to user interaction (e.g., pressing a button and/or key) and/or received from an authorized application/device. If determined that the requests are not triggered due to user interaction and/or are received from an unauthorized application/device, a response comprising one of several pre-prepared or dynamically generated screen captures that are embedded (and/or appended) with misleading information (e.g., fake credentials, fake documents marked as important/hidden, etc.) is generated. Applications that attempt to utilize the misleading information can be flagged as malware.

Claims

1. A system, comprising:

a microprocessor; and

a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising;

receiving request data indicative of a request for media data that is being presented via an output interface of the system; and

in response to determining, based on an analysis of the request data, that the request data does not satisfy a defined access criterion,

embedding deception data into the media data to generate modified media data, wherein the media data is a screenshot image, and

employing the modified media data to respond to the request.

2. The system of claim 1, wherein the deception data comprises false login data for a login field in the screenshot image.

3. The system of claim 2, wherein the deception data comprises an additional image and wherein the embedding comprises overlaying the additional image over the screenshot image.

4. The system of claim 1, wherein the determining comprises determining that the request data has not been triggered in response to a user interaction event.

5. The system of claim 4, wherein the user interaction event comprises determining a key, associated with an input interface of the system, has been activated.

6. The system of claim 1, wherein the determining comprises determining that the request data is received from an application that has not been authorized to access the media data.

7. The system of claim 1, wherein the deception data represents false credential data.

8. The system of claim 1, wherein the deception data comprises address data representing a non-genuine internet protocol address.

9. The system of claim 1, wherein the deception data comprises non-genuine file data.

10. The system of claim 1, wherein the operations further comprise:

based on defined policy data, selecting the deception data.

11. The system of claim 1, wherein the operations further comprise:

in response to determining, based on an analysis of the request data, that the request data satisfies the defined access criterion, employing the media data to respond to the request.

12. A method, comprising:

intercepting, by a system comprising a processor, a request for display data that is being presented via an output interface of the system; and

in response to determining that the request does not satisfy a defined access criterion, modifying, by the system, the display data, wherein the modifying comprises adding deception data to the display data to generate modified display data that is to be employed to respond to the request, wherein the display data is a screenshot image of information presented via a screen associated with the system.

13. The method of claim 12, wherein the determining comprises determining that the request is initiated in response to receiving user input from an interaction with the system.

14. The method of claim 13, wherein the determining comprises determining that the request has been initiated in response to a determination that a defined key of an input interface associated with the system has been pressed.

15. The method of claim 12, wherein the determining comprises determining that the request was initiated by an unauthorized application.

16. The method of claim 12, wherein the modifying comprises adding misleading information to the display data, and wherein the misleading information is employable to facilitate detection of a malware.

17. The method of claim 12, wherein the modifying comprises superimposing the screenshot image with another image that represents the deception data.

18. A non-transitory machine-readable storage medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising:

in response to determining that command data, indicative of an instruction to provide content that has been presented via an output interface of a device, has been received, analyzing the command data, wherein the content is a screenshot image of information presented via a screen associated with the device; and

in response to determining that the command data does not satisfy a defined access criterion, providing an altered version of the content, wherein the altered version of the content comprises deception data that has been added the content.

19. The non-transitory machine-readable storage medium of claim 18, wherein the determining that the command data does not satisfy the defined access criterion comprises determining that the command data has not been received from an application authorized to access the content.

20. The non-transitory machine-readable storage medium of claim 18, wherein the determining that the command data does not satisfy the defined access criterion comprises determining that the command data has not been triggered by selecting a defined key of an input interfaces associated with the device.