APPARATUS, SYSTEM, AND METHOD FOR PROTECTING AGAINST KEYLOGGING MALWARE

• US 20160323314A1
• Filed: 07/11/2016
• Published: 11/03/2016
• Est. Priority Date: 04/23/2008
• Status: Active Grant

• Current Assignee: Trusted Knight Corporation
• Original Assignee: Trusted Knight Corporation
• Inventors: Reddington, Raymond Lloyd
• Granted Patent: US 9,503,473 B1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/031 Protect user input by software means
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

An apparatus, system, and method is disclosed for protecting against key logger malware. The protection includes protection form grabbing keylogger malware. In response to detecting a form submission event from a browser associated with a user entering data into a form, confidential data is cleared to prevent it being captured by malware. Additional protection of data inputs, entered at a driver level, may be provided as an additional level of protection against hook based malware operating at a virtual keyboard level or operating system level. Data inputs received at a physical driver level may be protected as they pass through a virtual keyboard level and an operating system level. The projection against malware may be provided as a preventive measure that does not require detection of the key logger malware itself.

Claims

1. A method for preventing software key logging executable by a microprocessor, comprising:

detecting a browser form submission initiation call event associated with data inputs entered by a user, wherein the form submission initiation call event is an OnSubmit call event or a BeforeNavigate call event;

submitting the data inputs to a designated entity; and

clearing confidential data from the data inputs, thereby protecting against the threat of key logging malware capturing the confidential data.

2. The method of claim 1, wherein the clearing of the confidential data is performed without requiring detection of the key logging malware.

3. The method of claim 1, where the detecting of a browser form submission initiation call event occurs at a most privileged access level.

4. The method of claim 1, wherein the microprocessor is disposed within a computer, a mobile communication device, or a mobile Internet device.

5. The method of claim 4, wherein the mobile Internet device is one of a PDA, a handheld computer, a tablet computer, a laptop computer, or a notebook computer.

6. The method of claim 1, wherein the detecting and the clearing are performed in a browser.

7. The method of claim 1, wherein the clearing of confidential data comprises identifying form input fields on a web page and clearing confidential data after allowing the confidential data to be submitted to the designated entity to prevent capture of the confidential data by the key logging malware.

8. The method of claim 1, wherein an antikeylogger performs the detecting and the clearing and the method further comprises:

installing the anti-key logger at a most privileged access level for browser events in an API stack, thereby preventing a keylogger from having a superior level of access for the browser events.

9. The method of claim 1, wherein an antikeylogger performs the detecting and the clearing and the method further comprises:

protecting, by the anti-key logger, data inputs received at a physical driver level passing through a virtual keyboard level and an operating system level.

10. The method of claim 1, wherein the data inputs are keyed in by a user.

11. A computer program product to prevent software key logging including computer program code embedded in a non-transitory microprocessor-readable storage medium executable by a microprocessor, which when executed on the microprocessor, implements a method, comprising:

detecting a browser form submission initiation call event associated with data inputs entered by a user, wherein the form submission initiation call event is an OnSubmit call event or a BeforeNavigate call event;

submitting the data inputs to a designated entity; and

clearing confidential data from the data inputs, thereby protecting against the threat of key logging malware capturing the confidential data.

12. The computer program product of claim 11, wherein said clearing of the confidential data is performed without requiring detection of the key logging malware.

13. The computer program product of claim 11, where the detection of a browser form submission initiation call event occurs at a most privileged access level.

14. The computer program product of claim 11, wherein the microprocessor is disposed within a computer, a mobile communication device, or a mobile Internet device.

15. The computer program product of claim 14, wherein the mobile Internet device is one of a PDA, a handheld computer, a tablet computer, a laptop computer, or a notebook computer.

16. The computer program product of claim 11, wherein the detecting and the clearing are performed in a browser.

17. The computer program product of claim 11, further comprising inserting software processes for performing the detecting and clearing at the most privileged access level in an API stack of a browser.

18. The computer program product of claim 11, wherein the clearing of confidential data comprises identifying form input fields on a web page and clearing at least some form input fields of confidential data after allowing the data to be submitted to the designated entity to prevent capture of the confidential data by the key logging malware.

19. The computer program product of claim 11, wherein the data inputs are keyed in by a user.

20. The computer program product of claim 11, wherein an antikeylogger performs the detecting and the clearing and the method further comprises:

installing the anti-key logger at a most privileged access level for browser events in an API stack, thereby preventing a keylogger from having a superior level of access for the browser events.

21. The computer program product of claim 11, wherein an antikeylogger performs the detecting and the clearing and the method further comprises:

protecting, by the anti-key logger, data inputs received at a physical driver level passing through a virtual keyboard level and an operating system level.

22. A method for preventing software key logging executable by a microprocessor, comprising:

detecting a browser form submission initiation call event associated with data inputs entered by a user in a user input area of a web page, wherein the form submission initiation call event is an OnSubmit call event or a BeforeNavigate call event;

submitting the confidential data to a designated entity;

identifying form input fields on the web page having confidential data;

clearing the confidential data to prevent capture of the confidential data by key logging malware; and

wherein the clearing of the confidential data is performed regardless of whether keylogging malware is present.

23. The method of claim 22, wherein an antikeylogger performs the detecting and the clearing and the method further comprises:

installing the anti-key logger at a most privileged access level for browser events in an API stack, thereby preventing a keylogger from having a superior level of access for the browser events.

24. The method of claim 22, wherein an antikeylogger performs the detecting and the clearing and the method further comprises:

protecting, by the anti-key logger, data inputs received at a physical driver level passing through a virtual keyboard level and an operating system level.

25. The method of claim 23, wherein an antikeylogger performs the detecting and the clearing and the method further comprises:

protecting, by the anti-key logger, data inputs received at a physical driver level passing through a virtual keyboard level and an operating system level.

26. A computer program product to prevent software key logging including computer program code embedded in a non-transitory microprocessor-readable storage medium executable by a microprocessor, which when executed on the microprocessor, implements a method, comprising:

detecting a browser form submission initiation call event associated with data inputs entered by a user in a user input area of a web page, wherein the form submission initiation call event is an OnSubmit call event or a BeforeNavigate call event;

submitting the confidential data to a designated entity;

identifying form input fields on the web page having confidential data;

clearing the confidential data to prevent capture of the confidential data by key logging malware; and

wherein the clearing of the confidential data is performed regardless of whether keylogging malware is present.

27. The computer program product of claim 26, wherein an antikeylogger performs the detecting and the clearing and the method further comprises:

installing the anti-key logger at a most privileged access level for browser events in an API stack, thereby preventing a keylogger from having a superior level of access for the browser events.

28. The computer program product of claim 26, wherein an antikeylogger performs the detecting and the clearing and the method further comprises:

protecting, by the anti-key logger, data inputs received at a physical driver level passing through a virtual keyboard level and an operating system level.

29. The computer program product of claim 27, wherein an antikeylogger performs the detecting and the clearing and the method further comprises:

protecting, by the anti-key logger, data inputs received at a physical driver level passing through a virtual keyboard level and an operating system level.