Detecting and blocking spoofed Web login pages

• US 20040078422A1
• Filed: 10/17/2002
• Published: 04/22/2004
• Est. Priority Date: 10/17/2002
• Status: Abandoned Application

• Current Assignee: AOL LLC (Apollo Global Management, Inc.)
• Original Assignee: AOL LLC (Apollo Global Management, Inc.)
• Inventors: Toomey, Christopher Newell
• Application Number:
  US10/273,236
• Publication Number:
  US 20040078422A1
• Time in Patent Office: Days
• US Class Current: 709/202
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A method and apparatus is provided for detecting spoofed login pages and determining and executing an appropriate course of action to prevent spoofers from obtaining users'"'"' login IDs and passwords via the spoofed login pages.

Claims

1. A method of detecting a spoofed Web page over a network, said method comprising the steps of:

obtaining a spoofer'"'"'s message, said spoofer'"'"'s message containing a hyperlink, which, when clicked opens a Web page within a Web browser;

I

providing an agent for inspecting contextual data associated with said spoofer'"'"'s message; and

said agent using said contextual data for determining whether or not said Web page is a spoofed Web page.

2. The method of claim 1, wherein said contextual data comprises content of said Web page, and sender information and content of said spoofer'"'"'s message.

3. The method of claim 1, wherein said agent is embedded in a client application, said client application containing said opened Web browser and said message application.

4. The method of claim 1, wherein said agent is embedded in said Web browser.

5. The method of claim 1, wherein said agent is embedded in said message application.

6. The method of claim 1, wherein said agent is a separate client application.

7. The method of claim 1, wherein said agent is embedded in a client operating system.

8. The method of claim 1, wherein said agent is embedded in a server application.

9. The method of claim 1, wherein said agent comprises functionality to determine quantity and content of any intermediate Web pages between said spoofer'"'"'s message and said Web page.

10. The method of claim 1, wherein said agent comprises functionality to detect if said Web page contains at least one input field for user credential data.

11. The method of claim 1, wherein said at least one input field is an ID form field or a password field.

12. The method of claim 1, wherein said agent comprises functionality to execute an appropriate course of action, and wherein said method further comprises the step of:

said agent executing an appropriate course of action upon said agent determining said Web page is a spoofed Web page.

13. The method of claim 1, wherein said agent comprises functionality to intercede between a user'"'"'s action and a spoofed Web page, and wherein said method further comprises the step of:

said agent upon determining said Web page is a spoofed Web page interceding between a user'"'"'s action and a spoofed Web page.

14. The method of claim 1, further comprising the step of:

said agent communicating with application programming interfaces to any of, or any combination of, said ISP'"'"'s message application, said Web browser application, and said client application, wherein said communication comprises, but is not limited to, sending commands and obtaining data.

15. The method of claim 1, wherein said spoofer'"'"'s message is sent via any viable communication protocol, comprising but not limited to email, instant messaging, Web pages, and the like.

16. An apparatus of detecting a spoofed Web page over a network, said apparatus comprising:

means for obtaining a spoofer'"'"'s message, said spoofer'"'"'s message containing a hyperlink, which, when clicked opens a Web page within a Web browser;

means for providing an agent for inspecting contextual data associated with said spoofer'"'"'s message; and

means for said agent using said contextual data for determining whether or not said Web page is a spoofed Web page.

17. The apparatus of claim 16, wherein said contextual data comprises content of said Web page, and sender information and content of said spoofer'"'"'s message.

18. The apparatus of claim 16, wherein said agent is embedded in a client application, said client application containing said opened Web browser and said message application.

19. The apparatus of claim 16, wherein said agent is embedded in said Web browser.

20. The apparatus of claim 16, wherein said agent is embedded in said message application.

21. The apparatus of claim 16, wherein said agent is a separate client application.

22. The apparatus of claim 16, wherein said agent is embedded in a client operating system.

23. The apparatus of claim 16, wherein said agent is embedded in a server application.

24. The apparatus of claim 16, wherein said agent comprises functionality to determine quantity and content of any intermediate Web pages between said spoofer'"'"'s message and said Web page.

25. The apparatus of claim 16, wherein said agent comprises functionality to detect if said Web page contains at least one input field for user credential data.

26. The apparatus of claim 16, wherein said at least one input field is an ID field or a password field.

27. The apparatus of claim 16, wherein said agent comprises functionality to execute an appropriate course of action, and wherein said apparatus further comprises:

means for said agent executing an appropriate course of action upon said agent determining said Web page is a spoofed Web page.

28. The apparatus of claim 16, wherein said agent comprises functionality to intercede between a user'"'"'s action and a spoofed Web page, and wherein said apparatus further comprises:

means for said agent upon determining said Web page is a spoofed Web page interceding between a user'"'"'s action and a spoofed Web page.

29. The apparatus of claim 16, further comprising:

means for said agent communicating with application programming interfaces to any of, or any combination of, said ISP'"'"'s message application, said Web browser application, and said client application, wherein said communication comprises, but is not limited to, sending commands and obtaining data.

30. The apparatus of claim 16, wherein said spoofer'"'"'s message is sent via any viable communication protocol, comprising but not limited to email, instant messaging, Web pages, and the like.

31. A method of capture prevention over a network, said method comprising the steps of:

detecting a Web page is a capture page; and

disarming said capture page to prevent current and/or future user credential capturing.

32. The method of claim 31, said detecting step further comprising any of the steps of:

detecting login ID and password entry by end users;

performing automated contextual analysis of pages; and

performing human analysis of pages.

33. The method of claim 32 wherein said detecting login ID and password entry is by keystroke monitoring.

34. The method of claim 32, said detecting step further comprising the step of:

providing Javascript access to and manipulation of a Web page'"'"'s Document Object Model for attaching to form fields on Web pages keystroke-monitoring event handlers, said handlers detecting user entry of login ID and/or password.

35. The method of claim 32, said detecting step further comprising the step of:

embedding keystroke monitoring functionality into any of;

a Web browser application associated with said Web page;

a parent client application associated with said Web page;

and a server application associated with said Web page;

wherein said keystroke monitoring functionality comprises event handlers for detecting user entry of login ID and/or password into said Web page.

36. The method of claim 32, said detecting step further comprising the step of:

providing Javascript access to said Web page'"'"'s Document Object Model to perform spoof-detection analysis on said Web page.

37. The method of claim 32, said detecting step further comprising the step of:

providing access to Web page content from a Web proxy server to perform spoof-detection analysis on said Web page.

38. The method of claim 31, said detecting step further comprising any of or any combination of, but not limited to, the steps of:

determining to which Web pages said detecting step be applied to achieve a predetermined balance between spoof detection and false alarming and performance degradation;

determining whether detecting login ID entry along with other contextual clues obviates need for detecting password entry or whether password entry detection is necessary;

if password detection is necessary, determining how to get a password or a derivative of it to a client for use by an agent; and

determining the correct response when capture is detected.

39. The method of claim 32, said step of performing automated contextual analysis of pages further comprising the steps of:

an agent applying heuristics to score a page'"'"'s probability of being a capture page; and

said agent taking appropriate actions for said score.

40. The method of claim 39, wherein said appropriate actions comprise any of:

blocking a page'"'"'s display if said agent has a level of confidence that said page is a spoof page;

sending said page and score to an anti-spoofing manager for further analysis, said further analysis comprising measuring if said score is higher or lower than a predetermined threshold value.

41. The method of claim 32, wherein said automated contextual analysis comprises clues, said clues comprising any of:

determining if the Web page navigated to is from an email hyperlink or, alternatively, how far in terms of links and/or redirects was said Web page from the last email hyperlink;

determining what host is serving said Web page;

determining whether or not there is an obfuscating “

userid;

password@”

prefix before the host name in the URL;

determining whether said Web page contains a form with input elements that could be used for login ID plus password, and

using statistics from end users receiving interactive warnings and/or confirmation dialogs about a page being a possible spoof and are given ability to proceed or cancel.

42. The method of claim 31, wherein said step of disarming said capture page to prevent either of or both of current and future user credential capturing further comprises any of:

blocking or disabling pages;

requesting ISPs and/or site owners to remove pages; and

allowing user to decide if Web pages are spoof pages, said user using an interactive warning and/or confirmation dialog.

43. The method of claim 42, said step of blocking or disabling step further comprising any of:

preventing user access to spoof pages via blocking said spoof pages altogether in a Web proxy server and/or in a client application or a Web browser application by an agent or by disabling said spoof pages;

maintaining an explicit list of URLs to block and blocking only those on said list;

maintaining a list of blocked URL domains or URL regular expressions; and

maintaining a list of allowed domains and/or regular expressions and blocking others.

44. The method of claim 39, wherein said step of allowing user to decide is used when a detection technique'"'"'s analysis results in an uncertain decision about a given page being a spoof page.

45. The method of claim 39, said step of allowing user to decide further comprises the step of:

an end user explicitly confirming that said page is legitimate before proceeding to open said page or explicitly canceling said page to abort opening the page if the user decides said page is not legitimate.

46. The method of claim 39, said step of allowing user to decide further comprises the step of:

providing statistics of proceed rates and/or abort rates to a page'"'"'s spoof scoring analysis.

47. An apparatus for capture prevention over a network, said apparatus comprising:

means for detecting a Web page is a capture page; and

means for disarming said capture page to prevent current and/or future user credential capturing.

48. The apparatus of claim 47, said means for detecting further comprising any of:

means for detecting login ID and password entry by end users;

means for performing automated contextual analysis of pages; and

means for performing human analysis of pages.

49. The apparatus of claim 48 wherein said means for detecting login ID and password entry is by keystroke monitoring.

50. The apparatus of claim 48, said means for detecting further comprising:

means for providing Javascript access to and manipulation of a Web page'"'"'s Document Object Model for attaching to form fields on Web pages keystroke-monitoring event handlers, said handlers detecting user entry of login ID and/or password.

51. The apparatus of claim 48, said detecting step further comprising the step of:

embedding keystroke monitoring functionality into any of;

a Web browser application associated with said Web page;

a parent client application associated with said Web page;

and a server application associated with said Web page;

wherein said keystroke monitoring functionality comprises event handlers for detecting user entry of login ID and/or password into said Web page.

52. The apparatus of claim 48, said detecting step further comprising the step of:

providing Javascript access to said Web page'"'"'s Document Object Model to perform spoof-detection analysis on said Web page.

53. The apparatus of claim 48, said detecting step further comprising the step of:

providing access to Web page content from a Web proxy server to perform spoof-detection analysis on said Web page.

54. The apparatus of claim 47, said means for detecting further comprising any of:

means for determining to which Web pages said means for detecting be applied to achieve a predetermined balance between spoof detection and false alarming and performance degradation;

means for determining whether detecting login ID entry along with other contextual clues obviates need for detecting password entry or whether password entry detection is necessary;

if password detection is necessary, means for determining how to get a password or a derivative of it to a client for use by an agent; and

means for determining the correct response when capture is detected.

55. The apparatus of claim 48, said means for performing automated contextual analysis of pages further comprising:

means for an agent applying heuristics to score a page'"'"'s probability of being a capture page; and

means for said agent taking appropriate actions for said score.

56. The apparatus of claim 55, wherein said appropriate actions comprise any of:

blocking a page'"'"'s display if said agent has a level of confidence that said page is a spoof page;

sending said page and score to an anti-spoofing manager for further analysis, said further analysis comprising measuring if said score is higher or lower than a predetermined threshold value.

57. The apparatus of claim 48, wherein said automated contextual analysis comprises clues, said clues comprising any:

determining if the Web page navigated to is from an email hyperlink or, alternatively, how far in terms of links and/or redirects was said Web page from the last email hyperlink;

determining what host is serving said Web page;

determining whether or not there is an obfuscating “

userid;

password@”

prefix before the host name in the URL;

determining whether said Web page contains a form with input elements that could be used for login ID plus password, and

using statistics from end users receiving interactive warnings and/or confirmation dialogs about a page being a possible spoof and are given ability to proceed or cancel.

58. The apparatus of claim 47, wherein said means for disarming said capture page to prevent either of or both of current and future user credential capturing further comprises any of:

means for blocking or disabling pages;

means for requesting ISPs and/or site owners to remove pages; and

means for allowing user to decide if Web pages are spoof pages, said user using an interactive warning and/or confirmation dialog.

59. The apparatus of claim 58, said means for blocking or disabling further comprising any of:

preventing user access to spoof pages via blocking said spoof pages altogether in a Web proxy server and/or in a client application or a Web browser application by an agent or by disabling said spoof pages;

means for maintaining an explicit list of URLs to block and blocking only those on said list;

means for maintaining a list of blocked URL domains or URL regular expressions; and

means for maintaining a list of allowed domains and/or regular expressions and blocking others.

60. The apparatus of claim 58, wherein said means for allowing user to decide is used when a detection technique'"'"'s analysis results in an uncertain decision about a given page being a spoof page.

61. The apparatus of claim 58, said means for allowing user to decide further comprises:

means for an end user explicitly confirming that said page is legitimate before proceeding to open said page or explicitly canceling said page to abort opening the page if the user decides said page is not legitimate.

62. The apparatus of claim 58, said means for allowing user to decide further comprises:

means for providing statistics of proceed rates and/or abort rates to a page'"'"'s spoof scoring analysis.

63. An agent for detecting and blocking spoofed Web pages, said agent comprising:

means for receiving notification by a Web browser when a new Web page having a Document Object Model is loaded into said Web browser;

means for accessing said Document Object Model;

means for modifying said Document Object;

means for accessing other context in said Web browser, said other context comprising URL history, a user'"'"'s cookies, and the like; and

means for accessing navigation requests made to said Web browser; and

means for overriding navigation requests made to said Web browser.

64. A method for an agent to detect and block spoofed Web pages, said method comprising the steps of:

receiving notification by a Web browser when a new Web page having a Document Object Model is loaded into said Web browser;

accessing said Document Object Model;

modifying said Document Object Model when necessary;

accessing other context in said Web browser, said other context comprising URL history, a user'"'"'s cookies, and the like;

accessing navigation requests made to said Web browser; and

overriding navigation requests made to said Web browser when necessary.