Devices, systems and computer-implemented methods for preventing password leakage in phishing attacks

1. A computer-implemented method of preventing leakage of user credentials to phishing websites, comprising:

capturing user credentials input to a webpage of a website;

generating a hash of the captured user credentials;

updating a stored list of trusted website credentials with the generated hashed user credentials upon determining that the domain of a Uniform Resource Locator (URL) of the website to which the user credentials were input is present in a stored list of trusted websites;

in response to determining that the domain of the URL of the website to which the user credentials were input is not present in the stored list of trusted websites, determining whether the generated hashed user credentials matches one of a plurality of hashed user credentials in the list of trusted website credentials; and subsequently

when the generated hashed user credentials matches a hashed user credential in the list of trusted website credentials, requesting input indicative of whether the URL of the website is trusted or whether the URL of the website is unknown and/or untrusted;

when the requested input indicates that URL of the website is unknown and/or untrusted, sending the URL of the website to a remote computer server over a computer network and disallowing submission of the user credentials to the website; and

in response to the requested input indicating that the URL of website is trusted, adding the domain of the URL of the website to the stored list of trusted websites, adding the generated hash of the captured user credentials to the stored list of trusted website credentials and allowing the user credentials to be submitted to the website.

2. The computer-implemented method of claim 1 , wherein generating the hash comprises applying a key-stretching algorithm to the captured user credentials.

3. The computer-implemented method of claim 2 , wherein applying the key-stretching algorithm to the captured user credentials further comprises inputting a cryptographic salt when generating the hash.

4. The computing device of claim 2 , wherein applying the key-stretching algorithm to the captured user credentials further comprises inputting a cryptographic salt when generating the hash.

5. The computer-implemented method of claim 1 wherein, for each website, the stored list of trusted website credentials is configured as a First-In, First-Out (FIFO) queue.

6. The computer-implemented method of claim 1 , wherein the stored list of trusted website credentials further comprises the domain of the website to which the captured credentials were input and a time stamp.

7. The computer-implemented method of claim 1 , wherein capturing the user credentials further comprises:

waiting for a Document Object Model (DOM) tree of the webpage of the website to reach an idle state;

waiting for a DOM event and a DOM mutation;

identifying all forms having fields associated with user credentials;

adding at least one of an input event listener to at least one of the identified fields and a click event listener to at least one button and link belonging to the identified forms; and

capturing user credentials input to one of the forms using at least one of the input event listener and the click event listener.

8. The computer-implemented method of claim 1 , further comprising receiving updates to the list of trusted websites from the remote computer server.

9. The computer-implemented method of claim 1 , wherein the user credentials are input to a browser displaying the webpage of the website and wherein preventing leakage of user credentials by phishing websites is performed by a plug-in to the browser.

10. The computing device of claim 1 wherein, for each website, the stored list of trusted website credentials is configured as a First-In, First-Out (FIFO) register.

11. The computing device of claim 1 , wherein the stored list of trusted website credentials further comprises the domain of the URL of the website to which the captured credentials were input and a time stamp.

12. The computing device of claim 1 , wherein the plurality of processes spawned by the at least one processor for capturing the user credentials further includes processing logic for:

waiting for a Document Object Model (DOM) tree of the webpage of the website to reach an idle state;

waiting for a DOM event and a DOM mutation;

identifying all forms having fields associated with user credentials;

adding at least one of an input event listener to at least one of the identified fields and a click event listener to at least one button and link belonging to the identified forms; and

capturing user credentials input to one of the forms using at least one of the input event listener and the click event listener.

13. The computing device of claim 1 , further comprising processing logic for receiving updates to the list of trusted websites from the remote computer server.

14. The computing device of claim 1 , wherein the plurality of processes spawned by the at least one processor are configured as a plug-in to the browser.

15. A computing device configured for preventing leakage of user credentials to phishing websites comprising:

at least one hardware processor;

at least one data storage device coupled to the at least one hardware processor;

a network interface coupled to the at least one hardware processor and to a computer network;

a plurality of processes spawned by said at least one hardware processor, the processes including processing logic for:

capturing user credentials input to a webpage of a website;

generating a hash of the captured user credentials;

updating a stored list of trusted website credentials with the generated hashed user credentials upon determining that the domain of a Uniform Resource Locator (URL) of the website to which the user credentials were input is present in a stored list of trusted websites;

in response to determining that the domain of the URL of the website to which the user credentials were input is not present in the stored list of trusted websites, determining whether the generated hashed user credentials matches one of a plurality of hashed user credentials in the list of trusted website credentials; and subsequently

when the generated hashed user credentials matches a hashed user credential in the list of trusted website credentials, requesting input indicative of whether the URL of the website is trusted or whether the URL of the website is unknown and/or untrusted;

when the requested input indicates that the URL of the website is unknown and/or untrusted, sending the URL of the website to a remote computer server over a computer network and disallowing submission of the user credentials to the website

in response to the requested input indicating is that the URL of website is trusted, adding the domain of the URL of the website to the stored list of trusted websites, adding the generated hash of the captured user credentials to the stored list of trusted website credentials and allowing the user credentials to be submitted to the website.

16. The computing device of claim 15 , wherein generating the hash comprises applying a key-stretching algorithm to the captured user credentials.