Systems and methods for protection against theft of user credentials
A computer system is provided. The computer system includes a memory and at least one processor coupled to the memory and configured to protect against theft of user credentials. The at least one processor is further configured to recognize a uniform resource locator (URL) to which a web browser is navigating, as a URL for which protection is to be provided. The recognition is based on an absence of the URL from a history of visited URLs for which a password has been entered. The at least one processor is further configured to extract a character sequence of selected length that is entered into a field of a website associated with the recognized URL; compare an encryption of the character sequence to entries in a list of encrypted partial passwords of the same selected length; and perform a security action in response to a match resulting from the comparison.
1. A computer system comprising:
a memory; and
at least one processor coupled to the memory and configured to:
recognize a uniform resource locator (URL) to which a web browser is navigating as a URL for which protection is to be provided, the recognition based on an absence of the URL from a history of visited URLs for which a password has been entered;
extract a sequence of characters entered into a website associated with the URL, the extraction performed in response to the recognition;
monitor a rate at which the sequence of characters is entered;
compare an encryption of the extracted sequence of characters to one or more entries in a list of encrypted partial passwords, wherein a character length of the encryption of the extracted sequence of characters is chosen to match a character length of the encrypted partial passwords, wherein the character length of the encrypted partial passwords is less than a full password length;
perform a security action in response to a match resulting from the comparison; and
in response to the monitored rate exceeding a threshold keystroke rate, disable the security action and provide a warning that a malicious agent may be hosted on the computer system.
2. The computer system of claim 1 , wherein the list of encrypted partial passwords is generated by detection of passwords provided to visited websites over a selected period of time and encrypting the detected passwords.
3. The computer system of claim 1 , wherein the list of encrypted partial passwords is generated by obtaining a list of passwords from a web browser database of saved passwords and encrypting the passwords in the obtained list of passwords.
4. The computer system of claim 1 , wherein the recognition is further based on a match of the URL to an entry in a list of suspect URLs, the list of suspect URLs generated by a URL reputation manager.
5. The computer system of claim 1 , wherein the at least one processor is further configured to suppress the security action if an input field of the website is associated with a label that indicates a password entry is requested.
6. The computer system of claim 1 , wherein the at least one processor is further configured to provide the security action if an input field of the website is associated with a label that does not indicate a password entry is requested.
7. A method for protection of user credentials comprising:
recognizing, by a computer system, a uniform resource locator (URL) to which a web browser is navigating, as a URL for which protection is to be provided, the recognition based on an absence of the URL from a history of visited URLs for which a password has been entered;
extracting, by the computer system, a sequence of characters entered into a website associated with the URL, the extraction performed in response to the recognition;
monitoring, by the computer system, a rate at which the sequence of characters is entered;
comparing, by the computer system, an encryption of the extracted sequence of characters to one or more entries in a list of encrypted partial passwords, wherein a character length of the encryption of the extracted sequence of characters is chosen to match a character length of the encrypted partial passwords, wherein the character length of the encrypted partial passwords is less than a full password length;
performing, by the computer system, a security action in response to a match resulting from the comparison; and
in response to the monitored rate exceeding a threshold keystroke rate, disable the security action and provide a warning that a malicious agent may be hosted on the computer system.
8. The method of claim 7 , wherein the list of encrypted partial passwords is generated by detection of passwords provided to visited websites over a selected period of time and encrypting the detected passwords.
9. The method of claim 7 , wherein the list of encrypted partial passwords is generated by obtaining a list of passwords from a web browser database of saved passwords and encrypting the passwords in the obtained list of passwords.
10. The method of claim 7 , wherein the recognition is further based on a match of the URL to an entry in a list of suspect URLs, the list of suspect URLs generated by a URL reputation manager.
11. The method of claim 7 , further comprising suppressing the security action if an input field of the website is associated with a label that indicates a password entry is requested.
12. The method of claim 7 , further comprising providing the security action if an input field of the website is associated with a label that does not indicate a password entry is requested.
13. A non-transitory computer readable medium storing executable sequences of instructions to provide protection of user credentials, the sequences of instructions comprising instructions to:
recognize a uniform resource locator (URL) to which a web browser is navigating as a URL for which protection is to be provided, the recognition based on an absence of the URL from a history of visited URLs for which a password has been entered;
extract a sequence of characters entered into a website associated with the URL, the extraction performed in response to the recognition;
compare an encryption of the extracted sequence of characters to one or more entries in a list of encrypted partial passwords, wherein a character length of the encryption of the extracted sequence of characters is chosen to match a character length of the encrypted partial passwords, wherein the character length of the encrypted partial passwords is less than a full password length;
perform a security action in response to a match resulting from the comparison; and
monitor a rate at which the sequence of characters is entered and, in response to the monitored rate exceeding a threshold keystroke rate, disable the security action and provide a warning that a malicious agent may be hosted on the computer system.
14. The computer readable medium of claim 13 , wherein the list of encrypted partial passwords is generated by detection of passwords provided to visited websites over a selected period of time and encrypting the detected passwords.
15. The computer readable medium of claim 13 , wherein the list of encrypted partial passwords is generated by obtaining a list of passwords from a web browser database of saved passwords and encrypting the passwords in the obtained list of passwords.
16. The computer readable medium of claim 13 , wherein the recognition is further based on a match of the URL to an entry in a list of suspect URLs, the list of suspect URLs generated by a URL reputation manager.
17. The computer readable medium of claim 13 , wherein the sequences of instructions further include instructions to detect an operation to paste a character string and use the character string as the extracted sequence of characters.
18. The computer readable medium of claim 13 , wherein the sequences of instructions further include instructions to suppress the security action if an input field of the website is associated with a label that indicates a password entry is requested.
19. The computer readable medium of claim 13 , wherein the sequences of instructions further include instructions to provide the security action if an input field of the website is associated with a label that does not indicate a password entry is requested.