Preventing phishing attempts of one-time passwords
A computer system is provided. The computer system includes a memory and at least one processor coupled to the memory and configured to identify a first domain name associated with a website that served a login form to a web browser. The at least one processor is further configured to identify a one-time password (OTP) entry request served from the website in response to transmitting user credentials to the website. The at least one processor is further configured to identify a second domain name associated with an OTP server that provided an OTP. The at least one processor is further configured to perform a security action in response to determining that the first domain name differs from the second domain name. The security action may include blocking a response to the OTP request from the website, providing a warning, and/or obtaining confirmation for the response to the OTP entry request.
1. A computer system to provide protection against phishing of one-time passwords (OTPs), the computer system comprising:
a memory; and
at least one processor coupled to the memory and configured to:
identify a first domain name associated with a website that served a login form for entering user credentials to a web browser;
transmit the entered user credentials to the website;
identify an OTP entry request served from the website in response to transmitting the user credentials to the website;
identify a second domain name associated with an OTP server that provided an OTP corresponding to the user credentials;
determine that the first domain name differs from the second domain name; and
perform a security action in response to the determination.
2. The computer system of claim 1 , wherein the security action comprises blocking a response to the OTP request from the website.
3. The computer system of claim 1 , wherein the security action comprises providing a warning and obtaining confirmation for the response to the OTP entry request from the website.
4. The computer system of claim 1 , wherein the at least one processor is further configured to receive the OTP from the OTP server through a Short Message Service (SMS) text message.
5. The computer system of claim 1 , wherein the computer system is a first client device and the at least one processor is further configured to receive the OTP from a second client device, wherein the OTP is sent to the second client device as an SMS text message from the OTP server.
6. The computer system of claim 1 , wherein the at least one processor is further configured to receive the OTP through an email from the OTP server.
7. The computer system of claim 1 , wherein the at least one processor is further configured to provide credentials entered into the login form to the to the website to trigger the OTP entry request.
8. The computer system of claim 1 , wherein the at least one processor is further configured to analyze Hypertext Markup Language (HTML) input field labels to detect that the website served the login form and the OTP entry request to the web browser.
9. The computer system of claim 1 , wherein the at least one processor is further configured to perform computer vision analysis to detect that the website served the login form and the OTP entry request to the web browser.
10. A non-transitory computer readable medium storing executable sequences of instructions to provide protection against phishing of one-time passwords (OTPs), the sequences of instructions comprising instructions to:
identify a first domain name associated with a website that served a login form for entering user credentials to a web browser;
transmit the entered user credentials to the website;
identify an OTP entry request served from the website in response to transmitting the user credentials to the website;
identify a second domain name associated with an OTP server that provided an OTP corresponding to the user credentials;
determine that the first domain name differs from the second domain name; and
perform a security action in response to the determination.
11. The computer readable medium of claim 10 , wherein the security action comprises blocking a response to the OTP request from the website.
12. The computer readable medium of claim 10 , wherein the security action comprises providing a warning and obtaining confirmation for the response to the OTP entry request from the website.
13. The computer readable medium of claim 10 , wherein the sequences of instructions further include instructions to receive the OTP from the OTP server through a Short Message Service (SMS) text message.
14. The computer readable medium of claim 10 , wherein the computer system is a first client device and the sequences of instructions further include instructions to receive the OTP from a second client device, wherein the OTP is sent to the second client device as an SMS text message from the OTP server.
15. The computer readable medium of claim 10 , wherein the sequences of instructions further include instructions to receive the OTP through an email from the OTP server.
16. The computer readable medium of claim 10 , wherein the sequences of instructions further include instructions to provide credentials entered into the login form to the website to trigger the OTP entry request.
17. The computer readable medium of claim 10 , wherein the sequences of instructions further include instructions to analyze Hypertext Markup Language (HTML) input field labels to detect that the website served the login form and the OTP entry request to the web browser.
18. The computer readable medium of claim 10 , wherein the sequences of instructions further include instructions to perform computer vision analysis to detect that the website served the login form and the OTP entry request to the web browser.
19. A method for protecting against phishing of one-time passwords (OTPs), the method comprising:
identifying, by a computer system, a first domain name associated with a website that served a login form for entering user credentials to a web browser;
transmitting, by the computer system, the entered user credentials to the website;
identifying, by the computer system, an OTP entry request served from the website in response to transmitting the user credentials to the website;
identifying, by the computer system, a second domain name associated with an OTP server that provided an OTP corresponding to the user credentials;
determining, by the computer system, that the first domain name differs from the second domain name; and
performing, by the computer system, a security action in response to the determination.
20. The method of claim 19 , wherein the security action comprises blocking a response to the OTP request from the website and/or providing a warning and obtaining confirmation for the response to the OTP entry request from the website.
21. The method of claim 19 , further comprising receiving the OTP from the OTP server through a Short Message Service (SMS) text message and/or receiving the OTP through an email from the OTP server.
22. The method of claim 19 , wherein the computer system is a first client device, and the method further comprises receiving the OTP from a second client device, wherein the OTP is sent to the second client device as an SMS text message from the OTP server.
23. The method of claim 19 , further comprising analyzing Hypertext Markup Language (HTML) input field labels to detect that the website served the login form and the OTP entry request to the web browser and/or performing computer vision analysis to detect that the website served the login form and the OTP entry request to the web browser.