Network traffic inspection

1. A method, comprising:

intercepting, by a mobile device application, a first Internet protocol (IP) packet intended for delivery to a legitimate remote computer system, wherein the mobile device application is executing on a mobile device as an operating system extension that uses a virtual private network (VPN) stack of the operating system, wherein the mobile device application is initialized by the operating system, and wherein the mobile device application extends the operating system's functionality;

determining, by the mobile device application, that the intercepted first IP packet is associated with sensitive information;

in response to determining that the intercepted first IP packet is associated with sensitive information, creating a VPN tunnel between the mobile device and the remote computer system; and

securely sending data from the mobile device to the remote computer system using the VPN tunnel.

2. The method of claim 1 wherein the mobile device application is initialized in response to the operating system being initialized.

3. The method of claim 2 , wherein the operating system is initialized based on at least one of a reset and a power-on of the mobile device.

4. The method of claim 1 wherein the mobile device application is configured to determine that the first IP packet is associated with sensitive information based at least in part on an originating application that originated the first IP packet.

5. The method of claim 1 wherein the mobile device application is configured to determine that the first IP packet is associated with sensitive information based at least in part on a destination of the first IP packet.

6. The method of claim 1 wherein the mobile device application is further configured to determine whether a second intercepted IP packet indicates a security threat.

7. The method of claim 6 further comprising preventing the intercepted second packet from being delivered to a destination based on the determination that the second intercepted IP packet indicates a security threat.

8. The method of claim 7 further comprising displaying a message at the mobile device that indicates that the intercepted second IP packet was not sent to the remote computer system due to the security threat.

9. The method of claim 6 wherein the mobile device application is configured to determine that the intercepted second IP packet indicates the security threat at least in part by determining an IP address that is associated with a website that is associated with the security threat.

10. The method of claim 9 wherein the website is included in a list of blacklisted websites.

11. The method of claim 9 wherein a domain name of the website uses at least one character that is different from but also makes the domain name appear similar to a domain name of a popular website.

12. The method of claim 9 wherein the application is configured to determine that the website has not previously been contacted by the mobile device.

13. The method of claim 6 wherein determining that the intercepted second IP packet indicates the security threat included determining that the intercepted second IP packet indicates a deviation from a normal usage pattern of a user.

14. The method of claim 6 , wherein the application is configured to determine that the intercepted second IP packet indicates a security threat at least in part by:

sending the intercepted second IP packet to a second remote computer system configured to make the determination that the intercepted second IP packet indicates the security threat; and

receiving a message from the second remote computer system that indicates that the intercepted second IP packet indicates the security threat.

15. The method of claim 14 wherein the mobile device application is configured to selectively hold the intercepted second IP packet from being delivered to the remote computer system until the message is received from the second remote computer system.

16. The method of claim 14 wherein the application is configured to selectively send the intercepted second IP packet to the second remote computer system based at least in part on processing resources available to the mobile device application.

17. A system comprising:

a processor configured to:

intercept, by a mobile device application, a first Internet protocol (IP) packet intended for delivery to a legitimate remote computer system, wherein the mobile device application is executing on a mobile device as an operating system extension that uses a virtual private network (VPN) stack of the operating system, wherein the mobile device application is initialized by the operating system, and wherein the mobile device application extends the operating system's functionality;

determine, by the mobile device application, that the intercepted first IP packet is associated with sensitive information;

in response to determining that the intercepted first IP packet is associated with sensitive information, create a VPN tunnel between the mobile device and the remote computer system; and

securely send data from the mobile device to the remote computer system using the VPN tunnel; and

a memory coupled to the processor and configured to provide the processor with instructions.

18. The system of claim 17 wherein the mobile device application is initialized in response to the operating system being initialized.

19. The system of claim 18 , wherein the operating system is initialized based on at least one of a reset and a power-on of the mobile device.

20. The system of claim 17 wherein the mobile device application is configured to determine that the first IP packet is associated with sensitive information based at least in part on an originating application that originated the first IP packet.

21. The system of claim 17 wherein the mobile device application is configured to determine that the first IP packet is associated with sensitive information based at least in part on a destination of the first IP packet.

22. The system of claim 17 wherein the mobile device application is further configured to determine whether a second intercepted IP packet indicates a security threat.

23. The system of claim 22 wherein the processor is further configured to prevent the intercepted second packet from being delivered to a destination based on the determination that the second intercepted IP packet indicates a security threat.

24. The system of claim 23 wherein the processor is further configured to display a message at the mobile device that indicates that the intercepted second IP packet was not sent to the remote computer system due to the security threat.

25. The system of claim 17 wherein the mobile device application is configured to determine that the intercepted second IP packet indicates the security threat at least in part by determining an IP address that is associated with a website that is associated with the security threat.

26. The system of claim 25 wherein the website is included in a list of blacklisted websites.

27. The system of claim 25 wherein a domain name of the website uses at least one character that is different from but also makes the domain name appear similar to a domain name of a popular website.

28. The system of claim 25 wherein the mobile device application is configured to determine that the website has not previously been contacted by the mobile device.

29. The system of claim 17 wherein determining that the intercepted second IP packet indicates the security threat included determining that the intercepted second IP packet indicates a deviation from a normal usage pattern of a user.

30. The system of claim 17 , wherein the mobile device application is configured to determine that the intercepted second IP packet indicates a security threat at least in part by:

sending the intercepted second IP packet to a second remote computer system configured to make the determination that the intercepted second IP packet indicates the security threat; and

receiving a message from the second remote computer system that indicates that the intercepted second IP packet indicates the security threat.

31. The system of claim 30 wherein the mobile device application is configured to selectively hold the intercepted second IP packet from being delivered to the remote computer system until the message is received from the second remote computer system.

32. The system of claim 30 wherein the application is configured to selectively send the intercepted second IP packet to the second remote computer system based at least in part on processing resources available to the mobile device application.