Method and system for preventing fraudulent activities

• US 20060021031A1
• Filed: 06/30/2004
• Published: 01/26/2006
• Est. Priority Date: 06/30/2004
• Status: Active Grant

• Current Assignee: eBay Inc.
• Original Assignee: eBay Inc.
• Inventors: Brown, Andy, Agrawal, Ajay, King, Jeffrey L., Taylor, Jeffrey, Leahy, Scott, Henley, Mathew Gene, Embree, Kevin H., Lalonde, Chris
• Granted Patent: US 7,606,821 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: A61K 2039/5154 Antigen presenting cells [APCs], e.g. dendritic cells or macrophages
• CPC Class Codes: A61K 2039/57 characterised by the type of response, e.g. Th1, Th2
• CPC Class Codes: C12N 2501/51 B7 molecules, e.g. CD80, CD86, CD28 (ligand), CD152 (ligand)
• CPC Class Codes: C12N 2501/515 CD3, T-cell receptor complex
• CPC Class Codes: C12N 2531/00 Microcarriers
• CPC Class Codes: C12N 2533/40 Polyhydroxyacids, e.g. polymers of glycolic or lactic acid (PGA, PLA, PLGA); Bioresorbable polymers
• CPC Class Codes: C12N 5/0636 T lymphocytes
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface

Abstract

A method and system to protect users against potentially fraudulent activities associated with spoof web sites are described. According to one aspect of the present invention, the URL of a document downloaded via a web browser client is compared to the URLs in a list of URLs for known spoof sites. If the URL for the downloaded document is found in the list of URLs for known spoof sites, a security indicator is displayed to the user to indicate to the user that the downloaded document is associated with a known spoof site. According to another aspect of the invention, a security server maintains a master black list and periodically communicates updates of the master black list to the local list of a client security application.

Claims

1. A method including:

monitoring downloaded documents to determine their source; and

,

for each downloaded document, displaying a security indicator to indicate a security ranking based on the source of the document.

2. The method of claim 1, wherein monitoring downloaded documents to determine their source, includes:

for each downloaded document, comparing a URL of the downloaded document to a list of URLs for documents associated with known spoof sites.

3. The method of claim 2, wherein displaying a security indicator to indicate a security ranking includes:

displaying a security warning if the URL of the downloaded document matches a URL from the list of URLs for documents associated with known spoof sites.

4. The method of claim 3, wherein the list of URLs for documents associated with known spoof sites is received from a remote security server.

5. The method of claim 4, wherein the list of URLs for documents associated with known spoof sites is automatically updated by the security server on a periodic basis.

6. The method of claim 1, wherein monitoring downloaded documents to determine their source, includes:

for each downloaded document, comparing a URL of the downloaded document to a list of URLs for documents associated with known trusted sites.

7. The method of claim 6, wherein displaying a security indicator to indicate a security ranking includes:

displaying a security indicator to indicate the downloaded document is associated with a known trusted site if the URL of the downloaded document matches a URL from the list of URLs for documents associated with known trusted sites.

8. The method of claim 7, wherein the list of URLs for documents associated with known trusted sites is received from a remote security server.

9. The method of claim 8, wherein the list of URLs for documents associated with known trusted sites is automatically updated by the security server on a periodic basis.

10. The method of claim 1, wherein monitoring downloaded documents to determine their source, includes:

for each downloaded document, comparing the IP address of the server from which the document was served to a list of IP addresses associated with known trusted sites.

11. The method of claim 10, wherein displaying a security indicator to indicate a security ranking includes:

displaying a security indicator to indicate the downloaded document is associated with a know trusted site if the IP address of the server from which the downloaded document was served is in the list of IP addresses associated with known trusted sites.

12. The method of claim 11, wherein the list of IP addresses associated with known trusted sites is received from a remote security server.

13. The method of claim 12, wherein the list of IP addresses associated with known trusted sites is automatically updated by the security server on a periodic basis.

14. A method including:

comparing a URL of a document downloaded by a user to a list of URLs for documents associated with known spoof sites; and

,

displaying a security warning if the URL of the document downloaded by the user matches a URL from the list of URLs for documents associated with known spoof sites.

15. The method of claim 14, further including:

prior to comparing a URL of a document downloaded by a user to a list of URLs for documents associated with known spoof sites, receiving the list of URLs for documents associated with known spoof sites from a security server.

16. The method of claim 15, wherein the list of URLs for documents associated with known spoof sites is automatically updated via a security server on a periodic basis.

17. The method of claim 16, wherein the security server maintains a master list of URLs for documents associated with known spoof sites.

18. The method of claim 17, wherein the security server is remote.

19. The method of claim 14, wherein the security warning is displayed in a toolbar of a document browser.

20. A method including:

comparing a URL of a document downloaded by a user to a list of URLs for documents associated with known trusted sites; and

,

displaying a security indicator to indicate the document downloaded by the user is from a trusted site if the URL of the document downloaded by the user matches a URL from the list of URLs for documents associated with known trusted sites.

21. The method of claim 20, further including:

prior to comparing a URL of a document downloaded by a user to a list of URLs for documents associated with known trusted sites, receiving the list of URLs for documents associated with known trusted sites from a security server.

22. The method of claim 21, wherein the list of URLs for documents associated with known trusted sites is automatically updated via a security server on a periodic basis.

23. The method of claim 22, wherein the security server maintains a master list of URLs for documents associated with known trusted sites.

24. The method of claim 23, wherein the security server is remote.

25. The method of claim 20, wherein the security indicator is displayed in a toolbar of a document browser.

26. A method including:

comparing an IP address associated with a server from which a document was served to a list of IP addresses of servers associated with known trusted sites; and

,

displaying a security indicator to indicate the server that served the document is associated with a trusted site if the IP address of the server from which the document was served matches an IP address from the list of IP addresses of servers associated with known trusted sites.

27. The method of claim 26, further including:

prior to comparing the IP address associated with the server from which the document was served to the list of IP addresses of servers associated with known trusted sites, receiving the list of IP addresses of servers associated with known trusted sites from a security server.

28. The method of claim 27, wherein the list of IP addresses of servers associated with known trusted sites is automatically updated via a security server on a periodic basis.

29. The method of claim 28, wherein the security server maintains a master list of IP addresses of servers associated with known trusted sites.

30. The method of claim 29, wherein the security server is remote.

31. The method of claim 26, wherein the security indicator is displayed in a toolbar of a document browser.

32. A method including:

communicating a URL associated with a downloaded document to a security server;

receiving, from the security server, a message indicating a security ranking for the downloaded document; and

,

displaying a security indicator to indicate the security ranking for the downloaded document.

33. The method of claim 32, wherein the security ranking is displayed in a toolbar of a document browser.

34. The method of claim 33, wherein the security ranking indicates that the downloaded document is associated with a spoof site if the URL of the downloaded document matches a URL in a list of URLs for documents associated with known spoof sites, the list of URLs for documents associated with known spoof sites hosted by the security server

35. The method of claim 33, wherein the security ranking indicates that the downloaded document is associated with a trusted site if the URL associated with the downloaded document matches a URL in a list of URLs for documents associated with known trusted sites, the list of URLs for documents associated with known trusted sites is hosted by the security server.

36. The method of claim 33, wherein the security ranking indicates that the downloaded document is not associated with a known trusted site and not associated with a known spoof site if the URL of the downloaded documents does not match a URL in a list of URLs for documents associated with known spoof sites and the URL of the downloaded document does not match a URL in a list of URLs for documents associated with known trusted sites, the list of URLs for documents associated with known trusted sites and the list of URLs for documents associated with known spoof sites hosted by the security server

37. A system including:

a list of URLs for documents associated with known spoof sites;

a URL comparator module to compare a URL of a document downloaded by a user to a list of URLs for documents associated with known spoof sites; and

,

a display indicator module to display a security warning if the URL of the document downloaded by the user matches a URL from the list of URLs for documents associated with known spoof sites.

38. The system of claim 37, further including:

a server communication interface to receive the list of URLs for documents associated with known spoof sites from a security server.

39. The system of claim 38, wherein the list of URLs for documents associated with known spoof sites is automatically updated via the security server on a periodic basis.

40. The system of claim 37, further including:

a spoof site reporting module to receive a URL of a potential spoof site from the user, wherein the server communication interface is to communicate the URL of the potential spoof site to the security server.

41. The system of claim 37, further including:

a list of URLs for documents associated with known trusted sites, wherein the display indicator module is to display a security indicator to indicate the document downloaded by the user is from a trusted site if the URL of the document downloaded by the user matches a URL from the list of URLs for documents associated with known trusted sites.

42. A system including:

a list of URLs for documents associated with known trusted sites;

a URL comparator module to compare a URL of a document downloaded by a user to a list of URLs for documents associated with known trusted sites; and

,

a display indicator module to display a security indicator to indicate the document downloaded by the user is from a trusted site if the URL of the document downloaded by the user matches a URL from the list of URLs for documents associated with known trusted sites.

43. The system of claim 42, further including:

a server communication interface to receive the list of URLs for documents associated with known trusted sites from a security server.

44. The system of claim 43, wherein the list of URLs for documents associated with known trusted sites is automatically updated via the security server on a periodic basis.

45. The system of claim 42, further including:

a spoof site reporting module to receive a URL of a potential spoof site from the user, wherein the server communication interface is to communicate the URL of the potential spoof site to the security server.

46. The system of claim 42, further including:

a list of URLs for documents associated with known trusted sites, wherein the display indicator module is to display a security indicator to indicate the document downloaded by the user is from a trusted site if the URL of the document downloaded by the user matches a URL from the list of URLs for documents associated with known trusted sites.

47. A system including:

a list of IP addresses for servers associated with known trusted sites;

an IP comparator module to compare an IP address of a server from which a document was served to the list of IP addresses for servers associated with known trusted sites; and

,

a display indicator module to display a security indicator to indicate the server from which the document was served is a trusted site if the IP address of the server from which the document was served matches an IP address from the list of IP addresses of servers associated with known trusted sites.

48. The system of claim 47, further including:

a server communication interface to receive the list of IP addresses for servers associated with known trusted sites from a security server.

49. The system of claim 48, wherein the list of IP addresses for servers associated with known trusted sites is automatically updated via the security server on a periodic basis.

50. The system of claim 47, further including:

a spoof site reporting module to receive a URL of a potential spoof site from the user, wherein the server communication interface is to communicate the URL of the potential spoof site to the security server.

51. The system of claim 47, further including:

a list of URLs for documents associated with known spoof sites, wherein the display indicator module is to display a security warning to indicate the document downloaded by the user is from a spoof site if the URL of the document downloaded by the user matches a URL from the list of URLs for documents associated with known spoof sites.

52. A system including:

a server communication interface to communicate a URL of a document downloaded by a user to a security server, the security server to;

receive the URL of the document downloaded by the user;

compare the URL of the document downloaded by the user to a list of URLs for documents associated with known spoof sites; and

,

communicate a security ranking to the server communication interface, the security ranking based on the comparison of the URL of the document downloaded by the user to the list of URLs for documents associated with known spoof sites; and

,

a display indicator module to display the security ranking.

53. The system of claim 52, further including:

a spoof site reporting module to receive a URL of a potential spoof site from the user, wherein the server communication interface is to communicate the URL of the potential spoof site to the security server.

54. A system including:

a server communication interface to communicate a URL of a document downloaded by a user to a security server, the security server to;

receive the URL of the document downloaded by the user;

compare the URL of the document downloaded by the user to a list of URLs for documents associated with known trusted sites; and

,

communicate a security ranking to the server communication interface, the security ranking based on the comparison of the URL of the document downloaded by the user to the list of URLs for documents associated with known trusted sites; and

,

a display indicator module to display the security ranking.

55. The system of claim 54, further including:

a spoof site reporting module to receive a URL of a potential spoof site from the user, wherein the server communication interface is to communicate the URL of the potential spoof site to the security server.

56. A system including:

a master list of URLs for documents associated with known spoof sites; and

,

a client communication interface to automatically communicate the master list of URLs for documents associated with known spoof sites to a client application on a periodic basis.

57. The system of claim 56, wherein the client application compares a URL of a document downloaded by a user to a local list of URLs for documents associated with known spoof sites, the local list automatically updated from the master list.

58. The system of claim 56, further including:

an administrative interface to manage the list of URLs for documents associated with known spoof sites, and to review a URL of potential spoof site received from the client application via the client communication interface.

59. A system including:

a master list of URLs for documents associated with known trusted sites; and

,

a client communication interface to automatically communicate the master list of URLs for documents associated with known trusted sites to a client application on a periodic basis.

60. The system of claim 59, wherein the client application compares a URL of a document downloaded by a user to a local list of URLs for documents associated with known trusted sites, the local list automatically updated from the master list.

61. The system of claim 59, further including:

an administrative interface to manage the list of URLs for documents associated with known trusted sites.

62. A system comprising:

a master list of URLs for documents associated with known spoof sites;

a client communication interface to receive, from a client, a URL of a document downloaded by a user;

a URL comparator module to compare the URL of the document downloaded by the user to the list of URLs for documents associated with known spoof sites, wherein the client communication interface communicates a security warning to the client to indicate the URL of the document downloaded by the user is associated with a known spoof site, if the URL of the document downloaded by the user matches a URL from the master list of URLs.

63. The system of claim 62, further including:

an administrative interface to manage the list of URLs for documents associated with known spoof sites, and to review a URL of a potential spoof site received from the client application via the client communication interface.

64. A system comprising:

a master list of URLs for documents associated with known trusted sites;

a client communication interface to receive, from a client, a URL of a document downloaded by a user;

a URL comparator module to compare the URL of the document downloaded by the user to the list of URLs for documents associated with known trusted sites, wherein the client communication interface communicates a security ranking to the client to indicate the URL of the document downloaded by the user is associated with a known trusted site, if the URL of the document downloaded by the user matches a URL from the master list of URLs.

65. The system of claim 64, further including:

an administrative interface to manage the list of URLs for documents associated with known trusted sites, and to review a URL of a potential spoof site received from the client application via the client communication interface.

66. A method including:

detecting when a user is submitting a password associated with a particular account to a server not associated with the particular account; and

,

warning the user that the password associated with the particular account is being submitted to a server not associated with the particular account.

67. The method of claim 66, further including:

temporarily blocking the user from submitting the password associated with the particular account to the server not associated with the particular account.

68. The method of claim 66, wherein detecting when a user is submitting a password associated with a particular account to a server not associated with the particular account, includes:

scanning a form submitted by a user for a password stored in a password storage module; and

,

if the password is in the submitted form, comparing the URL to which the form is being submitted with the URL associated with the password in the password storage module.

69. A system including:

a password detection module to detect when a user is submitting a password associated with a particular account to a server that is not associated with the particular account; and

,

a display indicator module to display a security warning when the user attempts to submit the password associated with the particular account to the server that is not associated with the particular account.

70. The system of claim 69, wherein the password detection module temporarily blocks the user from submitting the password associated with the particular account to the server not associated with the particular account.

71. The system of claim 69, wherein the password detection module scans a form submitted by a user for a password stored in a password storage module, and compares the URL to which the form is being submitted with the URL associated with the password in the password storage module.

72. A machine-readable medium embodying a sequence of instructions, the instructions, when executed by a machine, cause the machine to:

monitor downloaded documents to determine their source; and

,

for each downloaded document, display a security indicator to indicate a security ranking based on the source of the document.

73. The machine-readable medium of claim 72, including further instructions that, when executed by a machine, cause the machine to:

for each downloaded document, compare a URL of the downloaded document to a list of URLs for documents associated with known spoof sites; and

,

display a security warning if the URL of the downloaded document matches a URL from the list of URLs for documents associated with known spoof sites.

74. The machine-readable medium of claim 72, including further instructions that, when executed by a machine, cause the machine to:

for each downloaded document, comparing a URL of the downloaded document to a list of URLs for documents associated with known trusted sites; and

,

display a security indicator to indicate the downloaded document is associated with a known trusted site if the URL of the downloaded document matches a URL from the list of URLs for documents associated with known trusted sites.

75. The machine-readable medium of claim 72, including further instructions that, when executed by a machine, cause the machine to:

for each downloaded document, compare the IP address of the server from which the document was served to a list of IP addresses associated with known trusted sites; and

display a security indicator to indicate the downloaded document is associated with a know trusted site if the IP address of the server from which the downloaded document was served is in the list of IP addresses associated with known trusted sites.

76. A system including:

means for receiving a list of URLs for documents associated with known spoof sites;

means for comparing a URL of a document downloaded by a user to the list of URLs for documents associated with known spoof sites; and

,

means for displaying a security warning if the URL of the document downloaded by the user matches a URL from the list of URLs for documents associated with known spoof sites.

77. A system including:

means for receiving a list of URLs for documents associated with known trusted sites;

means for comparing a URL of a document downloaded by a user to the list of URLs for documents associated with known trusted sites; and

,

means for displaying a security indicator to indicate the document downloaded by the user is from a trusted site if the URL of the document downloaded by the user matches a URL from the list of URLs for documents associated with known trusted sites.

78. A system including:

means for receiving a list of IP addresses of servers associated with known trusted sites;

means for comparing an IP address associated with a server from which a document was served to the list of IP addresses of servers associated with known trusted sites; and

,

means for displaying a security indicator to indicate the server that served the document is associated with a trusted site if the IP address of the server from which the document was served matches an IP address from the list of IP addresses of servers associated with known trusted sites.