Systems and methods for detecting illegitimate out-of-band authentication attempts
View Patent ↗A computer-implemented method for detecting illegitimate out-of-band authentication attempts may include 1) identifying a text message that includes a confirmation code for an out-of-band authentication procedure, 2) detecting an attempt to access the text message, 3) determining that the attempt to access the text message was configured to avoid user participation, and 4) performing, in response to determining that the attempt to access the text message was configured to avoid user participation, a remediation action that addresses an illegitimate out-of-band authentication attempt that includes the attempt to access the text message. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for detecting illegitimate out-of-band authentication attempts, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
determining that a text message comprises a confirmation code for an out-of-band authentication procedure based on at least one of:
a format of the text message;
a source of text message;
detecting an attempt to access the text message;
determining that the attempt to access the text message was configured to avoid participation by a user of a device on which the attempt to access the text message occurred;
performing, in response to determining both that the attempt to access the text message was configured to avoid participation by the user and that the text message comprises the confirmation code for the out-of-band authentication procedure, a remediation action that addresses an illegitimate out-of-band authentication attempt, the illegitimate out-of-band authentication attempt comprising the attempt to access the text message, wherein performing the remediation action comprises at least one of:
blocking the attempt to access the text message;
warning a user of the attempt;
warning a sender of the text message of the attempt;
disabling an application with a permission to access text messages.
2. The computer-implemented method of claim 1 , wherein:
the attempt to access the text message comprises an attempt to delete the text message;
determining that the attempt to access the text message was configured to avoid participation by the user comprises determining that the attempt to delete the text message happened within a suspiciously short amount of time according to a predefined suspicion heuristic.
3. The computer-implemented method of claim 1 , wherein:
the attempt to access the text message comprises an attempt to forward the text message;
determining that the attempt to access the text message was configured to avoid participation by the user comprises determining that the attempt to forward the text message happened within a suspiciously short amount of time according to a predefined suspicion heuristic.
4. The computer-implemented method of claim 1 , wherein determining that the attempt to access the text message was configured to avoid participation by the user comprises determining that the text message was marked as unread at a time of the attempt to access the text message.
5. The computer-implemented method of claim 1 , wherein determining that the attempt to access the text message was configured to avoid participation by the user comprises determining that the attempt was not performed via a text messaging application.
6. The computer-implemented method of claim 1 , wherein:
the attempt to access the text message comprises an attempt to forward the text message;
determining that the attempt to access the text message was configured to avoid participation by the user comprises determining that a target recipient of the attempt to forward the text message is a non-trusted recipient.
7. The computer-implemented method of claim 1 , wherein:
the attempt to access the text message comprises an attempt to forward the text message;
determining that the attempt to access the text message was configured to avoid participation by the user comprises determining that information identifying a target recipient of the attempt to forward the text message was deleted.
8. A system for detecting illegitimate out-of-band authentication attempts, the system comprising:
a memory;
an identification module, stored in the memory, that determines that a text message comprises a confirmation code for an out-of-band authentication procedure based on at least one of:
a format of the text message;
a source of text message;
a detection module, stored in the memory, that detects an attempt to access the text message;
a determination module, stored in the memory, that determines that the attempt to access the text message was configured to avoid participation by a user of a device on which the attempt to access the text message occurred;
a remediation module, stored in the memory, that performs, in response to determining both that the attempt to access the text message was configured to avoid participation by the user and that the text message comprises the confirmation code for the out-of-band authentication procedure, a remediation action that addresses an illegitimate out-of-band authentication attempt, the illegitimate out-of-band authentication attempt comprising the attempt to access the text message, wherein the remediation action comprises at least one of:
blocking the attempt to access the text message;
warning a user of the attempt;
warning a sender of the text message of the attempt;
disabling an application with a permission to access text messages;
at least one physical processor that executes the identification module, the detection module, the determination module, and the remediation module.
9. The system of claim 8 , wherein:
the attempt to access the text message comprises an attempt to delete the text message;
the determination module is programmed to determine that the attempt to access the text message was configured to avoid participation by the user by determining that the attempt to delete the text message happened within a suspiciously short amount of time according to a predefined suspicion heuristic.
10. The system of claim 8 , wherein:
the attempt to access the text message comprises an attempt to forward the text message;
the determination module is programmed to determine that the attempt to access the text message was configured to avoid participation by the user by determining that the attempt to forward the text message happened within a suspiciously short amount of time according to a predefined suspicion heuristic.
11. The system of claim 8 , wherein the determination module is programmed to determine that the attempt to access the text message was configured to avoid participation by the user by determining that the text message was marked as unread at a time of the attempt to access the text message.
12. The system of claim 8 , wherein the determination module is programmed to determine that the attempt to access the text message was configured to avoid participation by the user by determining that the attempt was not performed via a text messaging application.
13. The system of claim 8 , wherein:
the attempt to access the text message comprises an attempt to forward the text message;
the determination module is programmed to determine that the attempt to access the text message was configured to avoid participation by the user by determining that a target recipient of the attempt to forward the text message is a non-trusted recipient.
14. The system of claim 8 , wherein:
the attempt to access the text message comprises an attempt to forward the text message;
the determination module is programmed to determine that the attempt to access the text message was configured to avoid participation by the user by determining that information identifying a target recipient of the attempt to forward the text message was deleted.
15. A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
determine that a text message comprises a confirmation code for an out-of-band authentication procedure based on at least one of:
a format of the text message;
a source of text message;
detect an attempt to access the text message;
determine that the attempt to access the text message was configured to avoid participation by a user of a device on which the attempt to access the text message occurred;
perform, in response to determining both that the attempt to access the text message was configured to avoid participation by the user and that the text message comprises the confirmation code for the out-of-band authentication procedure, a remediation action that addresses an illegitimate out-of-band authentication attempt, the illegitimate out-of-band authentication attempt comprising the attempt to access the text message, wherein the remediation action comprises at least one of:
blocking the attempt to access the text message;
warning a user of the attempt;
warning a sender of the text message of the attempt;
disabling an application with a permission to access text messages.
16. The computer-readable-storage medium of claim 15 , wherein: the attempt to access the text message comprises an attempt to delete the text message;
determining that the attempt to access the text message was configured to avoid participation by the user comprises determining that the attempt to delete the text message happened within a suspiciously short amount of time according to a predefined suspicion heuristic.
17. The computer-readable-storage medium of claim 15 , wherein: the attempt to access the text message comprises an attempt to forward the text message;
determining that the attempt to access the text message was configured to avoid participation by the user comprises determining that the attempt to forward the text message happened within a suspiciously short amount of time according to a predefined suspicion heuristic.
18. The computer-readable-storage medium of claim 15 , wherein determining that the attempt to access the text message was configured to avoid participation by the user comprises determining that the text message was marked as unread at a time of the attempt to access the text message.
19. The computer-readable-storage medium of claim 15 , wherein determining that the attempt to access the text message was configured to avoid participation by the user comprises determining that the attempt was not performed via a text messaging application.
20. The computer-readable-storage medium of claim 15 , wherein: the attempt to access the text message comprises an attempt to forward the text message;
determining that the attempt to access the text message was configured to avoid participation by the user comprises determining that a target recipient of the attempt to forward the text message is a non-trusted recipient.