Detecting local graphic password deciphering attacks

• US 7,577,994 B1
• Filed: 08/25/2005
• Issued: 08/18/2009
• Est. Priority Date: 08/25/2005
• Status: Expired due to Fees

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Sobel, William E., McCorkendale, Bruce
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Baum; Ronald
• Application Number:
  US11/213,187
• Time in Patent Office: 1,454 Days
• Field of Search: 726/22
• US Class Current: 726/22
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/554 involving event detection and direct action

Abstract

A mechanism for using a graphic password test while providing the ability for detecting attempts by programs to decipher the password for malicious attack is disclosed. An access module provides a prompt to an entity attempting to access a protected resource. An image-substitution module provides a first or second graphic image to the entity (images display a first and second password, respectively). A programmatic interface that provides access to an image displayed on a computer screen can be modified to periodically provide a second image to a computer program that is different from the first image displayed to a human user. A receiving module receives a password in response to the prompt and a determination module determines if the password is first or second password. When the second password is received, it is likely a malware attempt at bypassing the graphic password test. An analysis module responds e.g., by collecting information about the entity that attempted access.

Claims

1. A computer program product having a computer-readable medium having computer program instructions recorded thereon for detecting a password deciphering attack, the computer program instructions comprising instructions for:

providing a prompt to an entity attempting to access a protected resource, wherein the prompt is for providing access to the protected resource upon receiving entry of a first password contained in a first graphic image;

providing a graphic image to the entity attempting to respond to the prompt, wherein the graphic image comprises a second graphic image that displays a second password, the graphic image provided by modifying an interface through which graphic images are accessed to replace the first graphic image with the second graphic image for display to the entity;

receiving a password in response to the prompt;

determining whether the password received comprises the first password or the second password; and

responding based on the results of the determination.

2. The computer program product of claim 1, wherein one or more computer programs attempt to respond to the prompt by obtaining information about the prompt through the interface and wherein the second graphic image is provided to some of the one or more computer programs through the interface, while the first graphic image is provided to other of the one or more computer programs.

3. The computer program product of claim 1, wherein modifying the interface further comprises providing the second graphic image to the entity through a different access interface than the first graphic image.

4. The computer program product of claim 1, wherein one or both of the first and second graphic images is selected from a group consisting of:

a sequence of characters displayed on noisy background and a distorted sequence of characters.

5. The computer program product of claim 1, wherein modifying the interface further comprises hooking the interface to intercept the first graphic image and replace it with the second graphic image for display to the entity.

6. The computer program product of claim 1, wherein responding based on the results of the determination further comprises performing an action selected from a group consisting of:

preventing a computer program from accessing the protected resource in a response to a determination that the password comprises the second password and collecting information about a computer program attempting to access the protected resource in a response to a determination that the password comprises the second password.

7. The computer program product of claim 1, wherein the second password displayed by the second graphic image is substantially different from the first password displayed by the first graphic image, and wherein the second graphic image is substantially different from the first graphic image.

8. A computer-implemented method of detecting a password deciphering attack, the method comprising:

providing a prompt to an entity attempting to access a protected resource, wherein the prompt is for providing access to the protected resource upon receiving entry of a first password contained in a first graphic image;

providing a graphic image to the entity attempting to respond to the prompt, wherein the graphic image comprises a second graphic image that displays a second password, the graphic image provided by modifying an interface through which graphic images are accessed to replace the first graphic image with the second graphic image for display to the entity;

receiving a password in response to the prompt;

determining whether the password received comprises the first password or the second password; and

responding based on the results of the determination.

9. The method of claim 8, wherein responding based on the results of the determination comprises collecting information about methods used by a computer program attempting to access the protected resource in a response to a determination that the password comprises the second password.

10. The method of claim 8, wherein one or both of the first and second graphic images is selected from a group consisting of:

a sequence of characters displayed on noisy background and a distorted sequence of characters.

11. The method of claim 8, wherein the second password displayed by the second graphic image is substantially different from the first password displayed by the first graphic image, and the second graphic image is substantially different from the first graphic image, wherein the first graphic image is sometimes displayed to entities instead of the second graphic image.

12. The method of claim 8, wherein modifying the interface further comprises hooking the interface to intercept the first graphic image and replace it with the second graphic image for display to the entity.

13. The method of claim 8, wherein providing a prompt further comprises displaying the prompt to a user or a computer program attempting to access security settings on a computer.

14. A computer system for detecting a password deciphering attack, the system comprising:

a computer-readable storage medium storing executable software modules comprising;

an access module for providing a prompt to an entity attempting to access a protected resource, wherein the prompt is for providing access to the protected resource upon receiving entry of a first password contained in a first graphic image;

an image-substitution module for providing a graphic image to the entity attempting to respond to the prompt, wherein the graphic image comprises a second graphic image that displays a second password, the graphic image provided by modifying an interface through which graphic images are accessed to replace the first graphic image with the second graphic image for display to the entity;

a receiving module for receiving a password in response to the prompt;

a determination module for determining whether the password received comprises the first password or the second password;

an analysis module for responding based on the results of the determination; and

a processor configured to execute the software modules stored by the computer readable storage medium.

15. The system of claim 14, wherein the analysis module is further adapted for collecting information about a computer program attempting to access the protected resource in a response to a determination that the password comprises the second password.

16. The system of claim 14, wherein the analysis module is further adapted for preventing a computer program from accessing the protected resource in a response to a determination that the password comprises the second password.

17. The system of claim 14, wherein the image-substitution module is further adapted to hook the interface to intercept the first graphic image and replace it with the second graphic image for display to the entity.

18. The system of claim 14, wherein the second password displayed by the second graphic image is substantially different from the first password displayed by the first graphic image, and the second graphic image is substantially different from the first graphic image, wherein the first graphic image is sometimes displayed to entities instead of the second graphic image, and wherein one or both of the first and second graphic images comprise a CAPTCHA test.

19. A computer system for detecting a password deciphering attack, the system comprising:

a computer-readable storage medium storing executable computer instructions, the computer instructions comprising;

a means for providing a prompt to an entity attempting to access a protected resource, wherein the prompt is for providing access to the protected resource upon receiving entry of a first password displayed in a first graphic image;

a means for providing a graphic image to the entity attempting to respond to the prompt, wherein the graphic image comprises a second graphic image that displays a second password, the graphic image provided by modifying an interface through which graphic images are accessed to replace the first graphic image with the second graphic image for display to the entity;

a means for receiving a password in response to the prompt;

a means for determining whether the password received comprises the first password or the second password;

a means for responding based on the results of the determination; and

a processor configured to execute the computer program instructions stored by the computer readable storage medium.

20. The system of claim 19, wherein the second password displayed by the second graphic image is substantially different from the first password displayed by the first graphic image, and the second graphic image is substantially different from the first graphic image, and wherein the first graphic image is sometimes displayed to entities instead of the second graphic image.