Phishing protection using cloning detection
Techniques for phishing protection using cloning detection are described herein. The techniques described herein can include a server which hosts a website detecting that a fetcher is a cloning toolkit or an entity known for using a cloning toolkit. The techniques can also include a server which hosts a downloadable application (such as a mobile application) detecting that a fetcher for the application is a cloning toolkit or an entity known for using a cloning toolkit. The detection can be done in several ways, such as by analyzing data logs for patterns associated with cloning toolkits or entities known for using cloning toolkits. The techniques described herein can also include a part of an end user device (such as a part of a mobile device) detecting a clone (such as a clone website or application) that was cloned by a cloning toolkit. Then, upon detection, security actions can be taken.
1. A method comprising:
detecting, by a computing device, cloning of an authentic website into a clone website by a cloning toolkit, by:
detecting requests for website site access of the authentic website from the cloning toolkit, prior to the cloning toolkit completing cloning of the authentic website;
comparing characteristics of the requests of the authentic website against one or more models of website access by known cloning toolkits, wherein the one or more models of website access by the known cloning toolkits comprises one or more models of website access of the authentic website specifically, the known cloning toolkits comprising one or more cloning toolkits other than the cloning toolkit; and
determining, from the comparison, a correlation between the characteristics of requests and the one or more models exceeds a similarity threshold; and
upon detection of the cloning of the authentic website, altering, by the computing device, at least one part of the authentic website to comprise an indicator that it is a cloned version of the authentic website when the authentic website is cloned into the clone website by the cloning toolkit.
2. The method of claim 1 , wherein the detecting of the cloning of the authentic website further comprises:
comparing a number of requests from a requester immediately after an initial request for access to the authentic website from the requester, in the characteristics of requests, to a modeled number of requests from a modeled phisher immediately after a modeled initial request for access to the authentic website from the modeled phisher, in the one or more models of website access of the authentic website; and
determining, from the comparison of requests, the correlation exceeds the similarity threshold when the compared number of requests, in the characteristics of requests, deviates from the compared modeled number of requests, in the one or more models of website access of the authentic website, below a certain extent.
3. The method of claim 2 , wherein the initial request comprises an initial request for web elements, and wherein the requests immediately after the initial request comprise requests for web elements.
4. The method of claim 1 , wherein the comparison of the characteristics of requests comprises comparing elements of the characteristics of requests associated with a login field of the authentic website or a login portion of the authentic website comprising the login field.
5. The method of claim 1 , wherein the comparison of the characteristics of requests comprises comparing domain names requesting access to the authentic website in the characteristics of requests against domain names in the one or more models listed as domain names of known entities using cloning toolkits.
6. The method of claim 1 , further comprising upon detection of the cloning of the authentic website, recording, by the computing device, one or more Internet Protocol (IP) addresses of one or more computing devices associated with the cloning.
7. The method of claim 6 , further comprising upon detection of the cloning of the authentic website, alerting a user of the computing device or an administrator of one or more servers serving the authentic website,
wherein the alerting comprises providing an audio and/or visual indicator of the cloning and the recorded one or more IP addresses of the one or more computing devices associated with the cloning.
8. The method of claim 6 , further comprising upon detection of the cloning of the authentic website, altering information sent by the authentic website or the at least one part of the authentic website to comprise a tracking mechanism that tracks operations of one or more computing devices serving the clone website when the authentic website is cloned into the clone website by the cloning toolkit.
9. The method of claim 6 , further comprising upon detection of the cloning of the authentic website, blocking access to the authentic website by the one or more computing devices associated with the cloning.
10. A non-transitory computer-readable storage medium tangibly encoded with computer-executable instructions, that when executed by a processor associated with a computing device, performs a method, the method comprising:
detecting cloning of an authentic website into a clone website by a cloning toolkit, by:
detecting requests for website site access of the authentic website from the cloning toolkit, prior to the cloning toolkit completing cloning of the authentic website;
comparing characteristics of the requests of the authentic website against one or more models of website access by known cloning toolkits, wherein the one or more models of website access by the known cloning toolkits comprises one or more models of website access of the authentic website specifically, the known cloning toolkits comprising one or more cloning toolkits other than the cloning toolkit; and
determining, from the comparison, a correlation between the characteristics of requests and the one or more models exceeds a similarity threshold; and
upon detection of the cloning of the authentic website, altering at least one part of the authentic website to comprise an indicator that it is a cloned version of the authentic website when the authentic website is cloned into the clone website by the cloning toolkit.
11. The non-transitory computer-readable storage medium of claim 10 , wherein the detecting of the cloning of the authentic website further comprises:
comparing a number of requests from a requester immediately after an initial request for access to the authentic website from the requester, in the characteristics of requests, to a modeled number of requests from a modeled phisher immediately after a modeled initial request for access to the authentic website from the modeled phisher, in the one or more models of website access of the authentic website; and
determining, from the comparison of requests, the correlation exceeds the similarity threshold when the compared number of requests, in the characteristics of requests, deviates from the compared modeled number of requests, in the one or more models of website access of the authentic website, below a certain extent.
12. The non-transitory computer-readable storage medium of claim 11 , wherein the initial request comprises an initial request for web elements, and wherein the requests immediately after the initial request comprise requests for web elements.
13. The non-transitory computer-readable storage medium of claim 10 , wherein the comparison of the characteristics of requests comprises comparing elements of the characteristics of requests associated with a login field of the authentic website or a login portion of the authentic website comprising the login field.
14. The non-transitory computer-readable storage medium of claim 10 , wherein the comparison of the characteristics of requests comprises comparing domain names requesting access to the authentic website in the characteristics of requests against domain names in the one or more models listed as domain names of known entities using cloning toolkits.
15. The non-transitory computer-readable storage medium of claim 10 , wherein the method further comprises: upon detection of the cloning of the authentic website, recording one or more Internet Protocol (IP) addresses of one or more computing devices associated with the cloning.
16. The non-transitory computer-readable storage medium of claim 15 , wherein the method further comprises: upon detection of the cloning of the authentic website, alerting a user of the computing device or an administrator of one or more servers serving the authentic website,
wherein the alerting comprises providing an audio and/or visual indicator of the cloning and the recorded one or more IP addresses of the one or more computing devices associated with the cloning.
17. The non-transitory computer-readable storage medium of claim 15 , wherein the method further comprises: upon detection of the cloning of the authentic website, altering information sent by the authentic website or the at least one part of the authentic website to comprise a tracking mechanism that tracks operations of one or more computing devices serving the clone website when the authentic website is cloned into the clone website by the cloning toolkit.
18. The non-transitory computer-readable storage medium of claim 15 , wherein the method further comprises: upon detection of the cloning of the authentic website, blocking access to the authentic website by the one or more computing devices associated with the cloning.
19. A computing system, comprising:
a processor; and
a non-transitory computer-readable storage medium for tangibly storing thereon program logic for execution by the processor, the program logic comprising:
logic executable to detect cloning of an authentic website into a clone website by a cloning toolkit, by:
detecting requests for website site access of the authentic website from the cloning toolkit, prior to the cloning toolkit completing cloning of the authentic website;
comparing characteristics of the requests of the authentic website against one or more models of website access by known cloning toolkits, wherein the one or more models of website access by the known cloning toolkits comprises one or more models of website access of the authentic website specifically, the known cloning toolkits comprising one or more cloning toolkits other than the cloning toolkit; and
determining, from the comparison, a correlation between the characteristics of requests and the one or more models exceeds a similarity threshold; and
logic executable to, upon detection of the cloning of the authentic website, alter at least one part of the authentic website to comprise an indicator that it is a cloned version of the authentic website when the authentic website is cloned into the clone website by the cloning toolkit.
20. The computing system of claim 19 , wherein the logic executable to detect cloning of an authentic website, further comprises:
logic executable to compare a number of requests from a requester immediately after an initial request for access to the authentic website from the requester, in the characteristics of requests, to a modeled number of requests from a modeled phisher immediately after a modeled initial request for access to the authentic website from the modeled phisher, in the one or more models of website access of the authentic website; and
logic executable to determine, from the comparison of requests, the correlation exceeds the similarity threshold when the compared number of requests, in the characteristics of requests, deviates from the compared modeled number of requests, in the one or more models of website access of the authentic website, below a certain extent.