Phishing protection using cloning detection
Techniques for phishing protection using cloning detection are described herein. The techniques described herein can include a server which hosts a website detecting that a fetcher is a cloning toolkit or an entity known for using a cloning toolkit. The techniques can also include a server which hosts a downloadable application (such as a mobile application) detecting that a fetcher for the application is a cloning toolkit or an entity known for using a cloning toolkit. The detection can be done in several ways, such as by analyzing data logs for patterns associated with cloning toolkits or entities known for using cloning toolkits. The techniques described herein can also include a part of an end user device (such as a part of a mobile device) detecting a clone (such as a clone website or application) that was cloned by a cloning toolkit. Then, upon detection, security actions can be taken.
1. A method comprising:
detecting, by a computing device, cloning of an authentic website into a clone website by a cloning toolkit, by:
comparing characteristics of requests of the authentic web site against one or more models of website access by cloning toolkits; and
determining, from the comparison, a correlation between the characteristics of requests and the one or more models exceeds a similarity threshold;
upon detection of the cloning of the authentic website, altering, by the computing device, at least one part of the authentic website to comprise an indicator that it is a cloned version of the authentic website when the authentic website is cloned into the clone website by the cloning toolkit; and
upon detection of the cloning of the authentic website, altering the authentic website to prevent sending of fields for inputting sensitive information when the authentic website is cloned into the clone website by the cloning toolkit.
2. The method of claim 1 , wherein the comparison of the characteristics of requests comprises comparing elements of the characteristics of requests associated with a login field of the authentic website or a login portion of the authentic website comprising the login field.
3. The method of claim 1 , wherein the comparison of the characteristics of requests comprises comparing domain names requesting access to the authentic website in the characteristics of requests against domain names in the one or more models listed as domain names of known entities using cloning toolkits.
4. The method of claim 1 , further comprising upon detection of the cloning of the authentic website, recording, by the computing device, one or more Internet Protocol (IP) addresses of one or more computing devices associated with the cloning.
5. The method of claim 4 , further comprising upon detection of the cloning of the authentic website, alerting a user of the computing device or an administrator of one or more servers serving the authentic website,
wherein the alerting comprises providing an audio and/or visual indicator of the cloning and the recorded one or more IP addresses of the one or more computing devices associated with the cloning.
6. The method of claim 4 , further comprising upon detection of the cloning of the authentic website, altering information sent by the authentic website or the at least one part of the authentic website to comprise a tracking mechanism that tracks operations of one or more computing devices serving the clone website when the authentic website is cloned into the clone website by the cloning toolkit.
7. The method of claim 4 , further comprising upon detection of the cloning of the authentic website, blocking access to the authentic website by the one or more computing devices associated with the cloning.
8. The method of claim 1 , wherein the one or more models of website access by cloning toolkits comprises one or more models of website access of the authentic website specifically, and wherein the detecting of cloning further comprises:
comparing a number of HTTP requests from a requester immediately after an initial HTTP request for access to the authentic website from the requester, in the characteristics of requests, to a modeled number of HTTP requests from a modeled phisher immediately after a modeled initial HTTP request for access to the authentic website from the modeled phisher, in the one or more models of website access of the authentic website; and
determining, from the comparison of HTTP requests, the correlation exceeds the similarity threshold when the compared number of HTTP requests, in the characteristics of requests, deviates from the compared modeled number of HTTP requests, in the one or more models of website access of the authentic website, below a certain extent.
9. A non-transitory computer-readable storage medium tangibly encoded with computer-executable instructions, that when executed by a processor associated with a computing device, performs a method, the method comprising:
detecting cloning of an authentic website into a clone website by a cloning toolkit, by:
comparing characteristics of requests of the authentic website against one or more models of website access by regular users; and
determining, from the comparison, a correlation between the characteristics of requests and the one or more models exceeds a difference threshold;
upon detection of the cloning of the authentic website, altering at least one part of the authentic website to comprise an indicator that it is a cloned version of the authentic website when the authentic website is cloned into the clone website by the cloning toolkit; and
upon detection of the cloning of the authentic website, altering the at least one part of the authentic website to no longer comprise fields for inputting sensitive information when the authentic website is cloned into the clone website by the cloning toolkit.
10. The non-transitory computer-readable storage medium of claim 9 , wherein the comparison of the characteristics of requests comprises comparing elements of the characteristics of requests associated with a login field of the authentic website or a login portion of the authentic website comprising the login field, and
wherein the detection of cloning further comprises comparing domain names requesting access to the authentic website in the characteristics of requests against a list of domain names of known entities using cloning toolkits.
11. The non-transitory computer-readable storage medium of claim 9 , wherein the method further comprises upon detection of the cloning of the authentic website, recording one or more Internet Protocol (IP) addresses of one or more computing devices associated with the cloning.
12. The non-transitory computer-readable storage medium of claim 11 , wherein the method further comprises upon detection of the cloning of the authentic website, alerting a user of the computing device or an administrator of one or more servers serving the authentic website,
wherein the alerting comprises providing an audio and/or visual indicator of the cloning and the recorded one or more IP addresses of the one or more computing devices associated with the cloning.
13. The non-transitory computer-readable storage medium of claim 11 ,
wherein the method further comprises upon detection of the cloning of the authentic website, altering information sent by the authentic website or the at least one part of the authentic website to comprise a tracking mechanism that tracks operations of one or more computing devices serving the clone website when the authentic website is cloned into the clone website by the cloning toolkit.
14. The non-transitory computer-readable storage medium of claim 11 , wherein the method further comprises upon detection of the cloning of the authentic website, blocking access to the authentic website by the one or more computing devices associated with the cloning.
15. The non-transitory computer-readable storage medium of claim 9 , wherein the one or more models of website access by regular users comprises one or more models of website access of the authentic website specifically, and wherein the detecting of cloning further comprises:
comparing a number of HTTP requests from a requester immediately after an initial HTTP request for access to the authentic website from the requester, in the characteristics of requests, to a modeled number of HTTP requests from a modeled requester immediately after a modeled initial HTTP request for access to the authentic website from the modeled requester, in the one or more models of web site access of the authentic website; and
determining, from the comparison of HTTP requests, the correlation exceeds the difference threshold when the compared number of HTTP requests, in the characteristics of requests, deviates from the compared modeled number of HTTP requests, in the one or more models of website access of the authentic website, above a certain extent.
16. A computing system, comprising:
a processor; and
a non-transitory computer-readable storage medium for tangibly storing thereon program logic for execution by the processor, the program logic comprising:
logic executable to detect a clone website cloned from an authentic website by a cloning toolkit, the logic executable to detect the clone website comprising:
logic executable to retrieve, from a web browser, characteristics of requests of the clone website;
logic executable to compare the characteristics of requests of the clone website against one or more models of website access of clone websites cloned from authentic websites by cloning toolkits; and
logic executable to determine, from the comparison, a correlation between the characteristics of requests and the one or more models exceeds a similarity threshold;
logic executable to, upon detection of the clone website, alert a user of the computing device or an administrator of one or more servers serving the authentic website; and
logic executable to, upon detection of the clone website, alter at least one part of the authentic website to no longer comprise fields for inputting sensitive information when the authentic website is cloned into the clone website by the cloning toolkit.
17. The computing system of claim 16 , wherein the program logic further comprises logic executable to, upon detection of the clone website, record one or more Internet Protocol (IP) addresses of one or more computing devices serving the clone website, and
wherein the logic executable to alert the user comprises logic executable to provide an audio and/or visual indicator of the clone website and the recorded one or more IP addresses of the one or more computing devices serving the clone website.
18. The computing system of claim 16 , wherein the one or more models of website access of clone web sites comprises one or more models of website access of clone websites cloned from the authentic website specifically, and wherein the logic executable to detect the clone website further comprises:
logic executable to compare a number of HTTP requests immediately after an initial HTTP request for access to the clone website, in the characteristics of requests, to a modeled number of HTTP requests immediately after a modeled initial HTTP request for access to a clone website of the clone websites cloned from the authentic web site, in the one or more models of web site access of clone web sites cloned from the authentic website; and
logic executable to determine, from the comparison, the correlation exceeds the similarity threshold when the compared number of HTTP requests, in the characteristics of requests, deviates from the compared modeled number of HTTP requests, in the one or more models of website access of clone websites cloned from the authentic website, below a certain extent.