Devices, systems and computer-implemented methods for preventing password leakage in phishing attacks

1. A computer-implemented method for preventing leakage of user credentials to phishing websites, comprising:

requesting, by a web browser, a webpage of a website over a computer network;

waiting for the requested webpage and all of the resources of the requested webpage to be loaded in the web browser;

waiting for an event on the loaded webpage;

identifying forms on the loaded webpage having fields associated with user credentials;

adding, to the identified forms, at least one of:

an input event listener to at least one of the identified fields, and a click event listener to at least one button or link belonging to the identified forms;

capturing user credentials input to at least one of the forms using the input event listener and/or the click event listener;

generating hashes of the captured user credentials by applying a key-stretching algorithm using a cryptographic salt to the captured user credentials;

storing the generated hashes in a memory, and

preventing leakage of user credentials to phishing websites by comparing the generated hashes stored in the memory with entries of a list of trusted websites hashed credentials and when the generated hashes match at least one entry of the list of trusted websites hashed credentials, requesting and acting upon input indicative of whether the requested website is trusted or whether the requested website is unknown and/or untrusted, and

responsive to the requested input indicating that the requested website is trusted, adding a domain of a Uniform Resource Locator (URL) of the requested website to a list of trusted websites, and allowing the user credentials to be submitted to the requested website.

2. The computer-implemented method of claim 1 , wherein waiting for the requested webpage to be loaded comprises waiting for a Document Object Model (DOM) tree of the webpage of the website to reach an idle state.

3. The computer-implemented method of claim 1 , wherein waiting for an event further comprises waiting for a DOM event and a DOM mutation.

4. The computer-implemented method of claim 1 , wherein storing comprises storing the generated hashes in a First-In-First Out (FIFO) queue of a predetermined depth.

5. The computer-implemented method of claim 1 further comprising, for each trusted website, storing the generated hashes in a First-In-First Out (FIFO) queue that is associated with the trusted website.

6. The computer-implemented method of claim 1 , further comprising:

updating a stored list of trusted websites hashed credentials upon determining that the domain of a Uniform Resource Locator (URL) of the website to which captured user credentials were input is present in a stored list of trusted websites.

7. The computer-implemented method of claim 1 , further comprising, when the requested input indicates that the website is unknown and/or untrusted: sending the URL of the website to a remote computer server over a computer network, and disallowing submission of the user credentials to the website.

8. The computer-implemented method of claim 1 , further comprising, when the requested input indicates that the website is trusted:

adding the domain of the URL of the website to the stored list of trusted websites,

adding the generated hashes of the captured user credentials to a stored list of trusted websites hashed credentials, and

allowing the user credentials to be submitted to the website.

9. The computer-implemented method of claim 1 , further comprising receiving updates to the list of trusted websites from the remote computer server.

10. The computer-implemented method of claim 1 , wherein preventing leakage of user credentials by phishing websites is performed by a web browser plug-in.

11. A computing device for preventing leakage of user credentials to phishing websites comprising:

at least one hardware processor;

at least one data storage device coupled to the at least one hardware processor;

a network interface coupled to the at least one hardware processor and to a computer network;

a plurality of processes spawned by said at least one hardware processor, the processes including processing logic for:

requesting a webpage of a website over a computer network;

waiting for the requested webpage and all of the resources of the requested webpage to be loaded in the web browser;

waiting for an event on the loaded webpage;

identifying forms on the loaded webpage having fields associated with user credentials;

adding, to the identified forms, at least one of:

an input event listener to at least one of the identified fields, and a click event listener to at least one button or link belonging to the identified forms;

capturing user credentials input to at least one of the forms using the input event listener and/or the click event listener;

generating hashes of the captured user credentials by applying a key-stretching algorithm using a cryptographic salt to the captured user credentials;

storing the generated hashes in a memory, and

preventing leakage of user credentials to phishing websites by comparing the generated hashes stored in the memory with entries of a list of trusted websites hashed credentials and when the generated hashes match at least one entry of the list of trusted websites hashed credentials, requesting and acting upon input indicative of whether the requested website is trusted or whether the requested website is unknown and/or untrusted, and

responsive to the requested input indicating that the requested website is trusted, adding a domain of a Uniform Resource Locator (URL) of the requested website to a list of trusted websites, and allowing the user credentials to be submitted to the requested website.

12. The computing device of claim 11 , wherein the processing logic for waiting for the requested webpage to be loaded comprises processing logic for waiting for a Document Object Model (DOM) tree of the webpage of the website to reach an idle state.

13. The computing device of claim 11 , wherein waiting for an event further comprises waiting for a DOM event and a DOM mutation.

14. The computing device of claim 11 , wherein the processing logic for storing comprises the processing logic for storing the generated hashes in a First-In-First Out (FIFO) queue of a predetermined depth.

15. The computing device of claim 11 , further comprising processing logic, for each trusted website, for storing the generated hashes in a First-In-First Out (FIFO) queue that is associated with the trusted website.

16. The computing device of claim 11 , further comprising processing logic for:

updating a stored list of trusted websites hashed credentials upon determining that the domain of a Uniform Resource Locator (URL) of the website to which captured user credentials were input is present in a stored list of trusted websites.

17. The computing device of claim 11 , further comprising processing logic for, when the requested input indicates that the website is unknown and/or untrusted: sending the URL of the website to a remote computer server over a computer network, and disallowing submission of the user credentials to the website.

18. The computing device of claim 11 , further comprising processing logic for, when the requested input indicates that the website is trusted:

adding the domain of the URL of the website to the stored list of trusted websites,

adding the generated hashes of the captured user credentials to a stored list of trusted websites hashed credentials, and

allowing the user credentials to be submitted to the website.

19. The computing device of claim 11 , further comprising processing logic for receiving updates to the list of trusted websites from the remote computer server.

20. The computing device of claim 11 , wherein the processing logic for preventing leakage of user credentials by phishing websites is configured as a web browser plug-in.