Systems and methods for warning mobile device users about potentially malicious near field communication tags

1. A computer-implemented method for warning mobile device users about potentially malicious Near Field Communication (NFC) tags, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

prior to a mobile device scanning at least one NFC tag, obtaining, by the mobile device from a remote server, NFC-tag information that identifies:

a geo-location of the NFC tag;

a result of at least one malware analysis performed on an NFC message received by another mobile device from the NFC tag via NFC transmission;

determining, based at least in part on the result of the malware analysis performed on the NFC message, that the NFC tag includes potentially malicious content;

determining, based at least in part on the geo-location of the NFC tag, that the mobile device is located in proximity of the NFC tag;

in response to determining that the mobile device is located in the proximity of the NFC tag, providing an alert that warns a user of the mobile device against scanning the NFC tag due at least in part to the potentially malicious content included in the NFC tag.

2. The method of claim 1 , wherein the NFC-tag information further identifies:

a geo-location of at least one additional NFC tag;

a result of at least one malware analysis performed on the additional NFC tag;

further comprising:

determining, based at least in part on the result of the malware analysis performed on the additional NFC tag, that the additional NFC tag does not include malicious content;

determining, based at least in part on the geo-location of the additional NFC tag, that the mobile device is located in proximity of the additional NFC tag;

in response to determining that the mobile device is located in the proximity of the additional NFC tag, providing an alert that notifies the user of the mobile device that the additional NFC tag is safe to scan since the additional NFC tag does not include malicious content.

3. The method of claim 1 , further comprising:

receiving, by the mobile device, an NFC message via NFC transmission from an additional NFC tag located in proximity of the mobile device;

performing at least one malware analysis on the NFC message received from the additional NFC tag;

providing, to the remote server, at least one result of the malware analysis performed on the NFC message received from the additional NFC tag to enable the remote server to distribute the result of the malware analysis to at least one additional mobile device.

4. The method of claim 3 , wherein:

performing the malware analysis on the NFC message comprises generating a hash of the NFC message;

providing the result of the malware analysis comprises providing, to the remote server, the hash of the NFC message to enable the remote server to monitor the NFC tag based at least in part on the hash.

5. The method of claim 1 , further comprising:

receiving, by the mobile device, an NFC message via NFC transmission from an additional NFC tag located in proximity of the mobile device;

identifying a computing payload within the NFC message received from the additional NFC tag;

providing, to the remote server, the computing payload identified within the NFC message to enable the remote server to:

perform at least one malware analysis on the computing payload identified within the NFC message;

distribute at least one result of the malware analysis performed on the NFC message to at least one additional mobile device.

6. The method of claim 5 , wherein the computing payload comprises at least one of:

an executable;

a uniform resource locator that identifies content stored on a remote device.

7. The method of claim 1 , wherein the NFC-tag information further identifies:

an additional geo-location where at least one additional NFC tag was previously scanned by an additional mobile device;

a hash of an NFC message received by the additional mobile device from the additional NFC tag;

further comprising determining that the additional NFC tag has been replaced by another NFC tag at the additional geo-location by:

receiving, by the mobile device, an NFC message via NFC transmission from the other NFC tag currently located at the additional geo-location;

generating a hash of the NFC message received from the other NFC tag currently located at the additional geo-location;

comparing the hash of the NFC message received from the other NFC tag currently located at the additional geo-location with the hash of the NFC message received from the additional NFC tag;

determining, based at least in part on the comparison, that the hash of the NFC message received from the other NFC tag currently located at the additional geo-location differs from the hash of the NFC message received from the additional NFC tag.

8. The method of claim 7 , wherein the NFC-tag information further identifies:

a result of at least one malware analysis performed on the additional NFC tag;

a timestamp used to identify a period of validity for the malware analysis performed on the additional NFC tag;

further comprising, prior to receiving the NFC message from the other NFC tag currently located at the additional geo-location:

determining, based at least in part on the timestamp used to identify the period of validity, that the result of the malware analysis performed on the additional NFC tag is still valid;

in response to determining that the result of the malware analysis performed on the additional NFC tag is still valid, enabling the mobile device to scan the other NFC tag at the additional geo-location.

9. The method of claim 7 , further comprising:

performing at least one malware analysis on the NFC message received from the other NFC tag currently located at the additional geo-location;

providing, to the remote server, at least one result of the malware analysis performed on the NFC message currently located at the additional geo-location to enable the remote server to distribute the result of the malware analysis to at least one other mobile device.

10. The method of claim 7 , further comprising:

identifying a computing payload within the NFC message received from the other NFC tag currently located at the additional geo-location;

providing, to the remote server, the computing payload identified within the NFC message to enable the remote server to:

perform at least one malware analysis on the computing payload identified within the NFC message;

distribute at least one result of the malware analysis performed on the computing payload to at least one other mobile device.

11. The method of claim 1 , wherein the result of the malware analysis performed on the NFC message comprises a result of at least one malware analysis performed on a duplicate of the NFC message stored within an additional instance of the NFC tag located at an additional geo-location.

12. A system for warning mobile device users about potentially malicious Near Field Communication (NFC) tags, the system comprising:

at least one processor of a mobile device configured to execute:

an obtainment module that obtains, prior to the mobile device scanning at least one NFC tag, NFC-tag information from a remote server that identifies:

a geo-location of the NFC tag;

a result of at least one malware analysis performed on an NFC message received by another mobile device from the NFC tag via NFC transmission;

a determination module that:

determines, based at least in part on the result of the malware analysis performed on the NFC message, that the NFC tag includes potentially malicious content;

determines, based at least in part on the geo-location of the NFC tag, that the mobile device is located in proximity of the NFC tag;

a provisioning module that provides, in response to the determination that the mobile device is located in the proximity of the NFC tag, an alert that warns a user of the mobile device against scanning the NFC tag due at least in part to the potentially malicious content included in the NFC tag.

13. The system of claim 12 , wherein:

the NFC-tag information further identifies:

a geo-location of at least one additional NFC tag;

a result of at least one malware analysis performed on the additional NFC tag;

the determination module further:

determines, based at least in part on the result of the malware analysis performed on the additional NFC tag, that the additional NFC tag does not include malicious content;

determines, based at least in part on the geo-location of the additional NFC tag, that the mobile device is located in proximity of the additional NFC tag;

the provisioning module further provides, in response to the determination that the mobile device is located in the proximity of the additional NFC tag, an alert that notifies the user of the mobile device that the additional NFC tag is safe to scan since the additional NFC tag does not include malicious content.

14. The system of claim 12 , wherein:

the processor of the mobile device is further configured to execute:

a reception module that receives an NFC message via NFC transmission from an additional NFC tag located in proximity of the mobile device;

an analysis module that performs at least one malware analysis on the NFC message received from the additional NFC tag;

the provisioning module further provides, to the remote server, at least one malware analysis performed on the NFC message received from the additional NFC tag to enable the remote server to distribute the result of the malware analysis to at least one additional mobile device.

15. The system of claim 14 , wherein:

the processor of the mobile device is further configured to execute a hashing module that generates a hash of the NFC message;

the provisioning module further provides, to the remote server, the hash of the NFC message to enable the remote server to monitor the additional NFC tag based at least in part on the hash.

16. The system of claim 12 , wherein:

the processor of the mobile device is further configured to execute:

a reception module that receives an NFC message via NFC transmission from an additional NFC tag located in proximity of the mobile device;

an identification module that identifies a computing payload within the NFC message received from the additional NFC tag;

the provisioning module further provides, to the remote server, the computing payload identified within the NFC message to enable the remote server to:

perform at least one malware analysis on the computing payload identified within the NFC message;

distribute at least one result of the malware analysis performed on the NFC message to at least one additional mobile device.

17. The system of claim 16 , wherein the computing payload comprises at least one of:

an executable;

a uniform resource locator that identifies content stored on a remote device.

18. The system of claim 12 , wherein the NFC-tag information further identifies:

an additional geo-location where at least one additional NFC tag was previously scanned by an additional mobile device;

a hash of an NFC message received by the additional mobile device from the additional NFC tag;

further comprising:

a reception module that receives an NFC message via NFC transmission from the other NFC tag currently located at the additional geo-location;

a hashing module that generates a hash of the NFC message received from the other NFC tag currently located at the additional geo-location;

wherein the determination module further determines that the additional NFC tag has been replaced by another NFC tag at the additional geo-location by:

comparing the hash of the NFC message received from the other NFC tag currently located at the additional geo-location with the hash of the NFC message received from the additional NFC tag;

determining, based at least in part on the comparison, that the hash of the NFC message received from the other NFC tag currently located at the additional geo-location differs from the hash of the NFC message received from the additional NFC tag.

19. The system of claim 18 , wherein:

the NFC-tag information further identifies:

a result of at least one malware analysis performed on the additional NFC tag;

a timestamp used to identify a period of validity for the malware analysis performed on the additional NFC tag;

the determination module further determines, based at least in part on the timestamp used to identify the period of validity, that the malware analysis performed on the additional NFC tag is still valid;

the provisioning module further enables the mobile device to scan the other NFC tag at the additional geo-location in response to the determination that the malware analysis performed on the additional NFC tag is still valid.

20. A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a mobile device, cause the mobile device to:

prior to the mobile device scanning at least one NFC tag, obtain, from a remote server, NFC-tag information that identifies:

a geo-location of the NFC tag;

a result of at least one malware analysis performed on an NFC message received by another mobile device from the NFC tag via NFC transmission;

determine, based at least in part on the result of the malware analysis performed on the NFC message, that the NFC tag includes potentially malicious content;

determine, based at least in part on the geo-location of the NFC tag, that the mobile device is located in proximity of the NFC tag;

in response to determining that the mobile device is located in the proximity of the NFC tag, providing an alert that warns a user of the mobile device against scanning the NFC tag due at least in part to the potentially malicious content included in the NFC tag.