Granted Patent B1

US 10,348,755 · App. 15/199,149 · Granted Jul 9, 2019

Abstract

Claims (55)

1. A computer-implemented method for detecting network security deficiencies on endpoint devices, at least a portion of the method being performed by a network device comprising at least one processor, the method comprising:

intercepting, at the network device, a request from an endpoint device to automatically connect to a wireless network;

evaluating whether the endpoint device is vulnerable to network attacks involving attempts to connect the endpoint device to illegitimate networks by:

extracting, from the request, a network identifier of the wireless network requested by the endpoint device;

creating, by the network device, a wireless network that appears to be the wireless network requested by the endpoint device but is not actually the requested wireless network;

indicating that the wireless network that appears to be the requested wireless network is available to the endpoint device by sending, to the endpoint device from the network device, a response that contains the network identifier of the requested wireless network;

determining that the endpoint device establishes a network connection to the wireless network that appears to be the requested wireless network; and

determining, based on the endpoint device establishing the network connection to the wireless network that appears to be the requested wireless network, that the endpoint device is vulnerable to the network attacks; and

directing, via the network connection, a user of the endpoint device to increase network security protocols on the endpoint device by at least one of:

preventing the endpoint device from automatically attempting to connect to the requested wireless network; and

removing the requested wireless network from a list of trusted wireless networks that indicates wireless networks to which the endpoint device automatically attempts to connect.

2. The method of claim 1 , further comprising determining that the endpoint device is known to the network device before evaluating whether the endpoint device is vulnerable to the network attacks.

3. The method of claim 2 , wherein determining that the endpoint device is known to the network device comprises determining that the endpoint device has previously connected to a legitimate wireless network provided by the network device.

4. The method of claim 3 , further comprising:

before detecting the request from the endpoint device to automatically connect to the wireless network, detecting an additional request from the endpoint device to automatically connect to the legitimate wireless network provided by the network device; and

facilitating the endpoint device establishing the network connection to the wireless network that appears to be the requested wireless network rather than establishing a network connection between the endpoint device and the legitimate wireless network.

5. The method of claim 4 , further comprising establishing the network connection between the endpoint device and the legitimate wireless network after the user of the endpoint device has increased the network security protocols on the endpoint device.

6. The method of claim 2 , further comprising managing network connections between a plurality of endpoint devices known to the network device and wireless networks that appear to be wireless networks requested by the plurality of endpoint devices based on input from an administrator of the network device.

7. The method of claim 1 , wherein:

indicating that the wireless network that appears to be the requested wireless network is available further comprises indicating that the wireless network that appears to be the requested wireless network does not utilize an authentication scheme that is used by the requested wireless network; and

determining that the endpoint device is vulnerable to the network attacks comprises determining that the endpoint device connected to the wireless network that appears to be the requested wireless network despite the indication that the wireless network that appears to be the requested wireless network does not utilize the authentication scheme.

8. The method of claim 1 , wherein directing the user of the endpoint device to increase the network security protocols further comprises presenting, on the endpoint device, a captive portal that prompts the user to increase the network security protocols before the endpoint device is allowed to access network resources via the network connection.

9. A system for detecting network security deficiencies on endpoint devices, the system comprising:

a detection module, stored in memory, that is configured to intercept, at a network device, a request from an endpoint device to automatically connect to a wireless network;

a connection module, stored in memory, that is configured to evaluate whether the endpoint device is vulnerable to network attacks involving attempts to connect the endpoint device to illegitimate networks by:

extracting, from the request, a network identifier of the wireless network requested by the endpoint device;

creating, by the network device, a wireless network that appears to be the wireless network requested by the endpoint device but is not actually the requested wireless network;

indicating that the wireless network that appears to be the requested wireless network is available to the endpoint device by sending, to the endpoint device from the network device, a response that contains the network identifier of the requested wireless network; and

determining that the endpoint device establishes a network connection to the wireless network that appears to be the requested wireless network;

a determination module, stored in memory, that is configured to determine, based on the endpoint device establishing the network connection to the wireless network that appears to be the requested wireless network, that the endpoint device is vulnerable to the network attacks;

a security module, stored in memory, that is configured to direct, via the network connection, a user of the endpoint device to increase network security protocols on the endpoint device by at least one of:

preventing the endpoint device from automatically attempting to connect to the requested wireless network; and

removing the requested wireless network from a list of trusted wireless networks that indicates wireless networks to which the endpoint device automatically attempts to connect; and

at least one hardware processor configured to execute the detection module, the connection module, the determination module, and the security module.

10. The system of claim 9 , wherein the determination module further determines that the endpoint device is known to the network device before the connection module evaluates whether the endpoint device is vulnerable to the network attacks.

11. The system of claim 10 , wherein the determination module determines that the endpoint device is known to the network device by determining that the endpoint device has previously connected to a legitimate wireless network provided by the network device.

12. The system of claim 11 , wherein:

before detecting the request from the endpoint device to automatically connect to the wireless network, the detection module detects an additional request from the endpoint device to automatically connect to the legitimate wireless network provided by the network device; and

the connection module facilitates the endpoint device establishing the network connection to the wireless network that appears to be the requested wireless network rather than establishing a network connection between the endpoint device and the legitimate wireless network.

13. The system of claim 12 , wherein the connection module further establishes the network connection between the endpoint device and the legitimate wireless network after the user of the endpoint device has increased the network security protocols on the endpoint device.

14. The system of claim 10 , wherein the connection module further manages network connections between a plurality of endpoint devices known to the network device and wireless networks that appear to be wireless networks requested by the plurality of endpoint devices based on input from an administrator of the network device.

15. The system of claim 9 , wherein:

the connection module further indicates that the wireless network that appears to be the requested wireless network is available but that the wireless network that appears to be the requested wireless network does not utilize an authentication scheme that is used by the requested wireless network; and

the determination module determines that the endpoint device is vulnerable to the network attacks by determining that the endpoint device connected to the wireless network that appears to be the requested wireless network despite the indication that the wireless network that appears to be the requested wireless network does not utilize the authentication scheme.

16. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a network device, cause the network device to:

intercept, at the network device, a request from an endpoint device to automatically connect to a wireless network;

evaluate whether the endpoint device is vulnerable to network attacks involving attempts to connect the endpoint device to illegitimate networks by:

extracting, from the request, a network identifier of the wireless network requested by the endpoint device;

creating, by the network device, a wireless network that appears to be the wireless network requested by the endpoint device but is not actually the requested wireless network;

indicating that the wireless network that appears to be the requested wireless network is available to the endpoint device sending, to the endpoint device from the network device, a response that contains the network identifier of the requested wireless network;

determining that the endpoint device establishes a network connection to the wireless network that appears to be the requested wireless network; and

determining, based on the endpoint device establishing the network connection to the wireless network that appears to be the requested wireless network, that the endpoint device is vulnerable to the network attacks; and

direct, via the network connection, a user of the endpoint device to increase network security protocols on the endpoint device by at least one of:

preventing the endpoint device from automatically attempting to connect to the requested wireless network; and

removing the requested wireless network from a list of trusted wireless networks that indicates wireless networks to which the endpoint device automatically attempts to connect.

Assignments (6)

Cited By (10)

US 12,200,006 US 12,223,060 US 12,273,367 US 12,282,564 US 12,335,297 US 12,348,485 US 12,353,563 US 12,425,437 US 12,587,555 US 12,621,331