Method and system for preventing fraudulent activities

• US 7,606,821 B2
• Filed: 06/30/2004
• Issued: 10/20/2009
• Est. Priority Date: 06/30/2004
• Status: Active Grant

• Current Assignee: eBay Inc.
• Original Assignee: eBay Inc.
• Inventors: Lalonde, Chris, Brown, Andy, Agrawal, Ajay, King, Jeffrey L., Taylor, Jeffrey, Leahy, Scott, Embree, Kevin H, Henley, Mathew Gene
• Primary Examiner(s): BOCCIO, VINCENT F
• Application Number:
  US10/883,454
• Publication Number:
  US 20060021031A1
• Time in Patent Office: 1,938 Days
• Field of Search: 707/3, 707/4, 707/9, 707/10, 707/102, 709/206, 726/22, 726 26- 27
• US Class Current: 1/1
• CPC Class Codes: A61K 2039/5154 Antigen presenting cells [APCs], e.g. dendritic cells or macrophages
• CPC Class Codes: A61K 2039/57 characterised by the type of response, e.g. Th1, Th2
• CPC Class Codes: C12N 2501/51 B7 molecules, e.g. CD80, CD86, CD28 (ligand), CD152 (ligand)
• CPC Class Codes: C12N 2501/515 CD3, T-cell receptor complex
• CPC Class Codes: C12N 2531/00 Microcarriers
• CPC Class Codes: C12N 2533/40 Polyhydroxyacids, e.g. polymers of glycolic or lactic acid (PGA, PLA, PLGA); Bioresorbable polymers
• CPC Class Codes: C12N 5/0636 T lymphocytes
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface

Abstract

A method and system to protect users against potentially fraudulent activities associated with spoof web sites are described. According to one aspect of the present invention, the URL of a document downloaded via a web browser client is compared to the URLs in a list of URLs for known spoof sites. If the URL for the downloaded document is found in the list of URLs for known spoof sites, a security indicator is displayed to the user to indicate to the user that the downloaded document is associated with a known spoof site. According to another aspect of the invention, a security server maintains a master black list and periodically communicates updates of the master black list to the local list of a client security application.

Claims

1. A method, performed at a client security application, of protecting a password from being submitted to a spoof site, the method comprising:

scanning a form to be posted to a first universal resource locator (URL) for the password;

comparing the password from the form with passwords stored in a password storage module to identify a matched password from among the passwords, the password storage module further storing a second URL associated with the matched password;

comparing the first URL to which the password is being submitted with the second URL associated with the matched password; and

if the first URL does not match the second URL, displaying a warning that the password is being submitted to the spoof site.

2. The method of claim 1, further including:

temporarily blocking the password from being submitted to the first URL associated with the spoof site.

3. The method of claim 1, wherein the second URL is associated with a trusted site.

4. A system including:

a password storage module to store a password and a first universal resource locator (URL) associated with the password;

a password detection module to scan a form for the password and to compare a second URL to which the form is being submitted with the first URL associated with the password, the second URL being associated with a server; and

a display indicator module to display a security warning when the password is being submitted to the server that is not associated with the first URL.

5. The system of claim 4, wherein the password detection module temporarily blocks the password from being submitted to the server.

6. The system of claim 4, wherein the password detection module is to compare the second URL after the scan and the display indicator module is to display the security warning after the compare.

7. A client security system for preventing a password from being submitted to a spoof site, the client security system comprising:

a processor-implemented password storage module to store a list of universal resource locators and passwords associated with the universal resource locators;

a processor-implemented password detection module to detect an attempt to submit the password to a server, the server being associated with a universal resource locator;

a processor-implemented password comparison module to compare the password being submitted with the passwords stored in the password storage module to identify a matched password from among the passwords, and further to compare the universal resource locator associated with the server with a universal resource locator associated with the matched password; and

a processor-implemented display indicator module to display a security warning based on the comparison of the universal resource locator associated with the server with the universal resource locator associated with the matched password.

8. The client security system of claim 7, wherein the processor-implemented password detection module is to detect the attempt by scanning text fields of a form for the password, the form being posted on the universal resource locator associated with the server.

9. The client security system of claim 8, wherein the text fields are labeled as password fields.

10. The client security system of claim 7, wherein the client security system is to halt the password from being submitted based on a mismatch between the universal resource locator associated with the server and the universal resource locator associated with the matched password.

11. The client security system of claim 7, wherein the universal resource locators stored in the processor-implemented password storage module are associated with trusted sites.

12. The client security system of claim 7, wherein the universal resource locators stored in the processor-implemented password storage module are associated with spoof sites.