Systems and methods for identifying a malicious user interface

1. A computer-implemented method for identifying a malicious user interface, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

detecting, at the computing device, a launch of a user interface (UI);

gathering characteristics of the UI including a UI image, wherein the UI Image is displayed on a video display device coupled to the computing device;

identifying, by the computing device, the UI is not permissible by automatically comparing the UI image displayed on the video display device to a whitelist including permissible UI images; and

performing, when the UI image is not permissible, a security action.

2. The computer-implemented method of claim 1 , wherein the characteristics further comprise a trust rating of a process that launched the UI, a language of the UI, and an authentication identifier; wherein the identifying further comprises comparing the trust rating of the process that launched the UI, the language of the UI, and the authentication identifier to the whitelist to identify a mismatch; and further comprising:

performing the security action when there is a mismatch.

3. The computer-implemented method of claim 1 , wherein the characteristics further comprise a language of the UI and further comprising:

gathering operating system (OS) characteristics including an OS language;

comparing the OS language to the language of the UI to identify a mismatch; and

performing the security action when there is a mismatch.

4. The computer-implemented method of claim 1 , wherein the characteristics further comprise text displayed by the UI and an identification of a process that launched the UI, and further comprising:

comparing the text displayed by the UI to the identification of the process that launched the UI to identify a mismatch; and

performing the security action when there is a mismatch.

5. The computer-implemented method of claim 1 , further comprising:

identifying the UI is a child window of a parent window;

identifying a process that launched the child window;

identifying a process that launched the parent window;

comparing the process that launched the child window to the process that launched the parent window to identify a mismatch; and

performing the security action when there is a mismatch.

6. The computer-implemented method of claim 1 , wherein the security action comprises preventing data entry into the UI and displaying a warning on the video display device.

7. The computer-implemented method of claim 1 , wherein the security action comprises displaying, on the video display device, a pop-up box indicating that the UI is potentially malicious.

8. A system for identifying a malicious user interface, the system comprising:

a detecting module, stored in a memory, that detects a launch of a user interface (UI);

a gathering module, stored in the memory, that gathers characteristics of the UI including a UI image, wherein the UI Image is displayed on a video display device;

an identifying module, stored in the memory, that identifies the UI is not permissible by automatically comparing the UI image displayed on the video display device to a whitelist including permissible UI images;

a performing module, stored in the memory, that performs a security action when the UI image is not permissible; and

at least one physical processor that executes the detecting module, the gathering module, the identifying module, and the performing module.

9. The system of claim 8 , wherein the characteristics further comprise a trust rating of a process that launched the UI, a language of the UI, and an authentication identifier; wherein the identifying further comprises comparing the trust rating of the process that launched the UI, the language of the UI, and the authentication identifier to the whitelist to identify a mismatch; and further comprising:

a second performing module, stored in the memory, that performs the security action when there is a mismatch.

10. The system of claim 8 , wherein the characteristics further comprise a language of the UI and further comprising:

a second gathering module, stored in the memory, that gathers operating system (OS) characteristics including an OS language;

a comparing module, stored in the memory, that compares the OS language to the language of the UI to identify a mismatch; and

a second performing module, stored in the memory, that performs the security action when there is a mismatch.

11. The system of claim 8 , wherein the characteristics further comprise text displayed by the UI and an identification of a process that launched the UI, and further comprising:

a comparing module, stored in the memory, that compares the text displayed by the UI to the identification of the process that launched the UI to identify a mismatch; and

a second performing module, stored in the memory, that performs the security action when there is a mismatch.

12. The system of claim 8 , further comprising:

a first identifying module, stored in the memory, that identifies the UI is a child window of a parent window;

a second identifying module, stored in the memory, that identifies a process that launched the child window;

a third identifying module, stored in the memory, that identifies a process that launched the parent window;

a comparing module, stored in the memory, that compares the process that launched the child window to the process that launched the parent window to identify a mismatch; and

a second performing module, stored in the memory, that performs the security action when there is a mismatch.

13. The system of claim 8 , wherein the security action comprises preventing data entry into the UI and displaying a warning on the video display device.

14. The system of claim 8 , wherein the security action comprises displaying, on the video display device, a pop-up box indicating that the UI is potentially malicious.

15. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

detect, at the computing device, a launch of a user interface (UI);

gather characteristics of the UI including a UI image, wherein the UI Image is displayed on a video display device coupled to the computing device;

identify, by the computing device, the UI is not permissible by automatically comparing the UI image displayed on the video display device to a whitelist including permissible UI images; and

perform, when the UI image is not permissible, a security action.

16. The non-transitory computer-readable medium of claim 15 , wherein the characteristics further comprise a trust rating of a process that launched the UI, a language of the UI, and an authentication identifier; wherein the identifying further comprises comparing the trust rating of the process that launched the UI, the language of the UI, and the authentication identifier to the whitelist to identify a mismatch; and further comprising one or more computer-executable instructions that, when executed by the at least one processor of the computing device, cause the computing device to:

perform the security action when there is a mismatch.

17. The non-transitory computer-readable medium of claim 15 , wherein the characteristics further comprise a language of the UI and further comprising one or more computer-executable instructions that, when executed by the at least one processor of the computing device, cause the computing device to:

gather operating system (OS) characteristics including an OS language;

compare the OS language to the language of the UI to identify a mismatch; and

perform the security action when there is a mismatch.

18. The non-transitory computer-readable medium of claim 15 , wherein the characteristics further comprise text displayed by the UI and an identification of a process that launched the UI, and further comprising one or more computer-executable instructions that, when executed by the at least one processor of the computing device, cause the computing device to:

compare the text displayed by the UI to the identification of the process that launched the UI to identify a mismatch; and

perform the security action when there is a mismatch.

19. The non-transitory computer-readable medium of claim 15 , further comprising one or more computer-executable instructions that, when executed by the at least one processor of the computing device, cause the computing device to:

identify the UI is a child window of a parent window;

identify a process that launched the child window;

identify a process that launched the parent window;

compare the process that launched the child window to the process that launched the parent window to identify a mismatch; and

perform the security action when there is a mismatch.

20. The non-transitory computer-readable medium of claim 15 , wherein the security action comprises preventing data entry into the UI and displaying a warning on the video display device.

21. The computer-implemented method of claim 1 , wherein the UI image is a video image displayed by the UI.