Method for detecting DNS redirects or fraudulent local certificates for SSL sites in pharming/phishing schemes by remote validation and using a credential manager and recorded certificate attributes

1. A computer-implemented method comprising:

executing on a host computer system a credential manager application, wherein the executing includes:

intercepting, by the executing credential manager application on the host computer system, an SSL certificate received on the host computer system,

wherein the SSL certificate is intercepted prior to receipt by a web browser on the host computer system, and

wherein the SSL certificate is returned from a web site in response to communication from the host computer system;

obtaining, on the host computer system by the executing credential manager application, certificate information associated with said SSL certificate,

wherein said certificate information comprises:

a Uniform Resource Locator (URL) associated with a web site providing the SSL certificate;

at least one user credential of a user, wherein the user is a user of the host computer system; and

at least one certificate attribute of the SSL certificate;

querying a trusted local cache, on the host computer system by the executing credential manager application, for locally stored certificate information corresponding to said SSL certificate,

wherein said locally stored certificate information comprises:

a Uniform Resource Locator (URL) associated with a web site providing the SSL certificate;

at least one user credential of a user, wherein the user is a user of the host computer system; and

at least one certificate attribute of the SSL certificate;

determining, on the host computer system by the executing credential manager application, whether said locally stored certificate information is present in said trusted local cache;

wherein upon a determination that said locally stored certificate information is present in said trusted local cache, obtaining, on the host computer system by the executing credential manager application, said locally stored certificate information;

performing a first comparison, on the host computer system by the executing credential manager application, said first comparison comparing at least said at least one user credential and said at least one certificate attribute with corresponding information in said locally stored certificate information;

determining, on the host computer system by the executing credential manager application, whether said SSL certificate is verified based upon said first comparison;

wherein upon a determination that said SSL certificate is verified, releasing said SSL certificate; and

wherein upon a determination that said SSL certificate is not verified, taking protective action on the host computer system as the SSL certificate is indicative of malicious activity and so is indicative of a malicious attack; and

wherein the protective action includes sending an alert of the malicious activity by the executing credential manager application.

2. The computer-implemented method of claim 1 further comprising:

wherein upon a determination that said locally stored certificate information is not present in said trusted local cache, querying at least one remote trusted source for remotely stored certificate information corresponding to said SSL certificate;

obtaining said remotely stored certificate information;

comparing at least a portion of said certificate information with at least a portion of said remotely stored certificate information;

determining whether said SSL certificate is verified based upon said comparing said at least a portion of said certificate information with said at least a portion of said remotely stored certificate information;

wherein upon a determination that said SSL certificate is verified, storing said certificate information as an entry corresponding to said SSL certificate in said trusted local cache, and

releasing said SSL certificate; and

wherein upon a determination that said SSL certificate is not verified, taking said protective action.

3. The computer-implemented method of claim 1 further comprising:

prior to taking said protective action, querying at least one remote trusted source for remotely stored certificate information corresponding to said certificate information;

obtaining said remotely stored certificate information;

performing a second comparison, said second comparison comparing at least a portion of said certificate information with at least a portion of said remotely stored certificate information;

determining whether said SSL certificate is verified based upon said second comparison;

wherein upon a determination that said SSL certificate is verified based upon said second comparison, releasing said SSL certificate; and

wherein upon a determination that said SSL certificate is not verified, taking said protective action.

4. The computer-implemented method of claim 3 further comprising:

wherein upon a determination that said SSL certificate is verified based upon said second comparison, updating said locally stored certificate information in said trusted local cache to include said remotely stored certificate information.

5. The computer-implemented method of claim 1 further comprising:

intercepting a log-in form from a web site prior to display to a user on a host computer system, said log-in form including one or more user credential fields for input of one or more requested user credentials;

automatically constructing a document object model (DOM) object including said log-in form and said one or more user credential fields;

automatically obtaining one or more stored user credentials from the trusted local cache, said stored user credentials corresponding to said one or more user credential fields;

automatically embedding said one or more stored user credentials in said one or more user credential fields in said DOM; and

automatically submitting said DOM to said web site, said DOM including said one or more stored user credentials.

6. The computer-implemented method of claim 1 wherein said trusted local cache includes one or more entries, each entry including locally stored certificate information corresponding to an associated SSL certificate.

7. The computer-implemented method of claim 2 wherein said remotely stored certificate information comprises:

a Uniform Resource Locator (URL) associated with a web site;

at least one user credential; and

at least one certificate attribute.

8. The computer-implemented method of claim 1 wherein said user credential is selected from the group consisting of a username and a password.

9. The computer-implemented method of claim 1 wherein said at least one certificate attribute is selected from the group consisting of a subject, an issuer, and a last known good signer.

10. The computer-implemented method of claim 2 wherein said at least one remote trusted source utilizes a certificate signed by a known specific root.

11. The computer-implemented method of claim 2 wherein said at least one remote trusted source is one or more remote trusted peer computer systems.

12. A computer-program product comprising a non-transitory tangible computer readable medium containing computer program code comprising:

a credential manager application, said credential manager application for intercepting, on the host computer system, an SSL certificate received on a host computer system,

wherein the SSL certificate is intercepted prior to receipt by a web browser on the host computer system, and

wherein the SSL certificate is returned from a web site in response to communication from the host computer system;

said credential manager application further for obtaining, on the host computer system, certificate information associated with said SSL certificate,

wherein said certificate information comprises:

a Uniform Resource Locator (URL) associated with a web site providing the SSL certificate;

at least one user credential of a user, wherein the user is a user of the host computer system; and

at least one certificate attribute of the SSL certificate;

said credential manager application further for querying, on the host computer system, a trusted local cache for locally stored certificate information corresponding to said SSL certificate,

wherein said locally stored certificate information comprises:

a Uniform Resource Locator (URL) associated with a web site providing the SSL certificate;

at least one user credential of a user, wherein the user is a user of the host computer system; and

at least one certificate attribute of the SSL certificate;

said credential manager application further for determining, on the host computer system, whether said locally stored certificate information is present in said trusted local cache;

wherein upon a determination that said locally stored certificate information is present in said trusted local cache, said credential manager application further for obtaining, on the host computer system, said locally stored certificate information;

said credential manager application further for performing a first comparison on the host computer system, said first comparison comparing at least said at least one user credential and said at least one certificate attribute with corresponding information in said locally stored certificate information;

said credential manager application further for determining, on the host computer system, whether said SSL certificate is verified based upon said first comparison;

wherein upon a determination that said SSL certificate is verified, said credential manager application further for releasing said SSL certificate; and

wherein upon a determination that said SSL certificate is not verified, said credential manager application further for taking protective action on the host computer system as the SSL certificate is indicative of malicious activity and so is indicative of a malicious attack, wherein the protective action includes sending an alert of the malicious activity by the credential manager application.

13. The non-transitory computer-program product of claim 12 further comprising:

wherein upon a determination that said locally stored certificate information is not present in said trusted local cache, said credential manager application further for querying at least one remote trusted source for remotely stored certificate information corresponding to said SSL certificate;

said credential manager application further for obtaining said remotely stored certificate information;

said credential manager application further for comparing at least a portion of said certificate information with at least a portion of said remotely stored certificate information;

said credential manager application further for determining whether or not said SSL certificate is verified based upon said comparing said at least a portion of said certificate information with said at least a portion of said remotely stored certificate information;

wherein upon a determination that said SSL certificate is verified, said credential manager application further for storing said certificate information as an entry corresponding to said SSL certificate in said trusted local cache, and

said credential manager application further for releasing said SSL certificate; and

wherein upon a determination that said SSL certificate is not verified, said credential manager application further for taking said protective action.

14. The non-transitory computer-program product of claim 12 further comprising:

prior to taking said protective action, said credential manager application further for querying at least one remote trusted source for remotely stored certificate information corresponding to said certificate information;

said credential manager application further for obtaining said remotely stored certificate information;

said credential manager application further for performing a second comparison, said second comparison comparing at least a portion of said certificate information with at least a portion of said remotely stored certificate information;

said credential manager application further for determining whether or not said SSL certificate is verified based upon said second comparison;

wherein upon a determination that said SSL certificate is verified based upon said second comparison, said credential manager application further for releasing said SSL certificate; and

wherein upon a determination that said SSL certificate is not verified, said credential manager application further for taking said protective action.

15. The non-transitory computer-program product of claim 14 further comprising:

wherein upon a determination that said SSL certificate is verified based upon said second comparison, said credential manager application further for updating said locally stored certificate information in said trusted local cache to include said remotely stored certificate information.

16. The non-transitory computer-program product of claim 12 further comprising:

said credential manager application further for intercepting a log-in form from a web site prior to display to a user on a host computer system, said log-in form including one or more user credential fields for input of one or more requested user credentials;

said credential manager application further for automatically constructing a document object model (DOM) object including said log-in form and said one or more user credential fields;

said credential manager application further for automatically obtaining one or more stored user credentials from the trusted local cache, said stored user credentials corresponding to said one or more user credential fields;

said credential manager application further for automatically embedding said one or more stored user credentials in said one or more user credential fields in said DOM; and

said credential manager application further for automatically submitting said DOM to said web site, said DOM including said one or more stored user credentials.