Device, system, and method of detecting a remote access user
Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a possible attacker. The methods include monitoring of user-side input-unit interactions, in general and in response to an interference introduced to user-interface elements. The monitored interactions are used for detecting an attacker that utilizes a remote access channel; for detecting a malicious automatic script, as well as malicious code injection; to identify a particular hardware assembly; to perform user segmentation or user characterization; to enable a visual login process with implicit two-factor authentication; to enable stochastic cryptography; and to detect that multiple users are utilizing the same subscription account.
1. A method comprising:
determining whether a human user, who utilizes a computing device to interact with a computerized service, (i) is a human user that is co-located physically near said computing device, or (ii) is a human user that is located remotely from said computing device and is controlling remotely said computer device via a remote access channel;
wherein the determining comprises:
(a) injecting, to a graphical user interface (GIU) of said computerized service, a GUI interference which affects differently local human users and remote human users who interact with said user interface of said computerized service;
(b) monitoring interactions of the user with an input unit, in response to said GUI interference;
(c) based on said monitoring of user response to said GUI interference, determining whether said human user (i) is a human user that is co-located physically at said computing device, or (ii) is a human user that is located remotely from said computing device and is controlling remotely said computing device via said remote access channel.
2. The method of claim 1 , wherein the determining of step (c) is based on a latency between (A) the injecting of said GUI interference, and (B) the input unit interactions of said human user in response to said interference.
3. The method of claim 1 , wherein the determining of step (c) is based on a type of reaction of said human user to the injecting of said GUI interference.
4. The method of claim 1 , comprising:
hiding a mouse-pointer on a screen of said computerized service;
monitoring input unit reactions of said human user in response to the hiding of the mouse-pointer;
based on the input unit reactions of said human user in response to the hiding of the mouse-pointer, determining whether said user (i) is a human user that is co-located physically at said computing device, or (ii) is a human user that is located remotely from said computing device and is controlling remotely said computing device via said remote access channel.
5. The method of claim 1 , comprising:
replacing an original mouse-pointer on a screen of said computerized service, with a fake mouse-pointer deviated from a location of said original mouse-pointer;
monitoring input unit interactions of said human user when the fake mouse-pointer is displayed on said computing device that is accessing said computerized service;
based on the input unit interactions with the fake mouse-pointer, determining whether said human user (i) is a human user that is co-located physically at said computing device, or (ii) is a human user that is located remotely from said computing device and is controlling remotely said computing device via said remote access channel.
6. The method of claim 1 , comprising:
sampling multiple interactions of said human user with said input unit;
based on a frequency of said sampling, determining whether said human user (i) is a human user that is co-located physically at said computing device, or (ii) is a human user that is located remotely from said computing device and is controlling remotely said computing device via said remote access channel.
7. The method of claim 1 , comprising:
overloading one or more resources of the computing device which is used for accessing said computerized service;
measuring an effect of said overloading on frequency of sampling user interactions via an input unit;
based on the measured effect of said overloading, determining whether said human user (i) is a human user that is co-located physically at said computing device, or (ii) is a human user that is located remotely from said computing device and is controlling remotely said computing device via said remote access channel.
8. The method of claim 1 , comprising:
overloading a data transfer communication channel of the computing device that is used for accessing said computerized service;
measuring an effect of said overloading on frequency of sampling user interactions via an input unit;
based on the measured effect of said overloading, determining whether said human user (i) is a human user that is co-located physically at said computing device, or (ii) is a human user that is located remotely from said computing device and is controlling remotely said computing device via said remote access channel.
9. The method of claim 1 , comprising:
overloading a screen display of the computing device that is used for accessing said computerized service;
measuring an effect of said overloading on frequency of sampling user interactions via an input unit;
based on the measured effect of said overloading, determining whether said human user (i) is a human user that is co-located physically at said computing device, or (ii) is a human user that is located remotely from said computing device and is controlling remotely said computing device via said remote access channel.
10. The method of claim 1 , comprising:
displaying an instantaneous priming message on a screen of the computing device that is utilized for accessing said computerized service;
measuring an effect of the instantaneous priming message on sampled user interactions via an input unit;
based on the measured effect of said instantaneous priming message, determining whether said human user (i) is a human user that is co-located physically at said computing device, or (ii) is a human user that is located remotely from said computing device and is controlling remotely said computing device via said remote access channel.
11. The method of claim 1 , comprising:
injecting, into a log-in screen of the computerized service, a user interface interference that causes non-remote human users to perform corrective mouse gestures;
immediately after a log-in into the computerized service, displaying a subsequent screen of the computerized service without said user interface interference;
monitoring mouse gestures of the user in the subsequent screen;
if the monitored mouse gestures in the subsequent screen comprise corrective mouse gestures, then, determining that the user of the subsequent screen is a local human user that is located physically at the computing device;
if the monitored mouse gestures in said subsequent screen lacks corrective mouse gestures, then, determining that the user of the subsequent screen is a human user that is located remotely from said computing device and is controlling remotely said computing device via said remote access channel.
12. The method of claim 1 , comprising:
sampling user interactions with an input unit of said computing device;
based on said sampling, determining that said human user is utilizing a first set of hardware components which is capable of sampling the input unit at a first frequency;
subsequently, (A) sampling additional, subsequent user interactions; (B) determining that a second, lower, frequency characterizes said subsequent sampling; (C) determining that a second, different, set of hardware components is being used; (D) determining that a non-authorized person is accessing said computerized service.
13. The method of claim 1 , comprising:
sampling user interactions with an input unit of a mobile computing device;
analyzing temporal relationship between touch and accelerometer events of sampled user interactions with said input unit of the mobile computing device;
based on analysis of temporal relationship between touch and accelerometer events, of sampled user interactions with said input unit of the mobile computing device, determining whether the said mobile computing device is controlled remotely by a human user that operates via said remote access channel.
14. A system comprising:
a user identity determination module to determine whether a human user, who utilizes a computing device to interact with a computerized service, is either (i) a human user that is co-located physically near said computing device, or (ii) a human user that is located remotely from said computing device and is controlling remotely said computer device via a remote access channel;
wherein the user identity determination module is:
(a) to inject, to a graphical user interface (GUI) of said computerized service, a GUI interference which affects differently local human users and remote human users who interact with said user interface of said computerized service;
(b) to monitor interactions of the user with an input unit, in response to said GUI interference;
(c) based on the monitored interactions of the user in response to said GUI interference, to determine whether said human user (i) is a human user that is co-located physically at said computing device, or (ii) is a human user that is located remotely from said computing device and is controlling remotely said computing device via said remote access channel.
15. The system of claim 14 , wherein the user identity determination module is to determine in step (c), based on a latency between (A) injection of said GUI interference, and (B) the input unit interactions of said human user in response to said GUI interference.
16. The system of claim 14 , wherein the user identity determination module is to determine in step (c), based on a type of reaction of said human user to the injecting of said GUI interference.