Mitigating insecure digital storage of sensitive information
View Patent ↗Examples described herein attempt to mitigate risk associated with digitally storing sensitive information (e.g., passwords) in insecure applications and transferring the stored sensitive information to a sensitive information field (e.g., a password field in a login page). A computing device may detect a transfer to a sensitive field. The computing device may determine if a source application for the transfer is an insecure application. If the source application is an insecure application, the computing device may provide a risk mitigation action. The computing device may also transmit to an analytic server telemetry data comprising the identification of the source application, identification of a target application containing the sensitive information field, and a username associated with the computing device. The analytic server may calculate risk score based on the received telemetry data and provide further risk mitigation actions to the computing device.
1. A method comprising:
detecting, by a computing device, a transfer of data from one application to another, the transfer including a field to receive sensitive information, wherein the detecting comprises:
setting a paste listener for a window or a document; and
using the paste listener, detecting that a field within the window or the document has been modified by adding hidden characters, wherein the detecting is based on comparing values of the window or the document between transfer operations;
determining, by the computing device, that the one application of the transfer is insecure; and
in response to the computing device determining that the one application is insecure:
providing, by the computing device, a plurality of actions so as to mitigate use of sensitive information within the one application, wherein the plurality of actions comprise a first action and a subsequent second action, wherein the first action is based in response to determining that a user has performed a first threshold number of transfer of sensitive information, wherein the subsequent second action is based in response to determining that the user has performed a second threshold number of transfer of sensitive information, wherein the second threshold is higher than the first threshold.
2. The method of claim 1 , further comprising:
transmitting, by the computing device to an analytic server, information for the transfer, identifying: a user associated with the computing device, the one application, the another application for the transfer, a type of the field to receive the sensitive information, and type of the computing device; and
receiving, by the computing device from the analytic server, an indication of the action based on the transmitted information.
3. The method of claim 1 , wherein the transfer of data comprises a copy event and a paste event.
4. The method of claim 3 , further comprising:
setting event listeners for detecting one or more events in the computing device, wherein the event listeners comprise at least one of a copy listener, a paste listener, a clipboard listener, a drag and drop listener, or a navigation listener.
5. The method of claim 1 , wherein the detecting the transfer of data further comprises:
identifying the field to receive the sensitive information within a window or a document; and
setting a paste listener for the field to receive the sensitive information.
6. The method of claim 1 , wherein the determining that the one application of the transfer is insecure further comprises:
identifying the one application by retrieving identification of an application that last placed data in a clipboard.
7. The method of claim 1 , wherein the determining that the one application of the transfer is insecure further comprises:
identifying the one application by retrieving domain name of a web application using a browser script.
8. An apparatus comprising:
at least one processor;
memory storing instructions that, when executed by the at least one processor, cause the apparatus to:
detect a transfer of data from one application to another, the transfer including a field to receive sensitive information, wherein to detect the transfer:
set a paste listener for a window or a document; and
using the paste listener, detect that a field within the window or the document has been modified by adding hidden characters, wherein the detection is based on comparing values of the window or the document between transfer operations;
determine that the one application of the transfer is insecure;
in response to the processor determining that the one application is insecure:
provide a plurality of actions so as to mitigate use of sensitive information within the one application, wherein the plurality of actions comprise a first action and a subsequent second action, wherein the first action is based in response to determining that a user has performed a first threshold number of transfer of sensitive information, wherein the subsequent second action is based in response to determining that the user has performed a second threshold number of transfer of sensitive information, wherein the second threshold is higher than the first threshold.
9. The apparatus of claim 8 , wherein the memory further stores instructions that when executed by the at least one processor, cause the apparatus to:
transmit to an analytic server, information identifying:
a user associated with apparatus, the one application, the another application, a type of the field to receive the sensitive information, and type of the apparatus;
receive from the analytic server, an indication of the action based on the transmitted information.
10. The apparatus of claim 8 , wherein the transfer of data comprises a copy event and a paste event.
11. The apparatus of claim 10 , wherein the memory further stores instructions that when executed by the at least one processor, cause the apparatus to:
set event listeners for detecting one or more events in the apparatus, wherein the event listeners comprise at least one of a copy listener, a paste listener, a clipboard listener, a drag and drop listener, or a navigation listener.
12. The apparatus of claim 8 , wherein to detect the transfer of data, the memory further stores instructions that when executed by the at least one processor, cause the apparatus to:
identify the field to receive the sensitive information within a window or a document; and
set a paste listener for the field to receive the sensitive information.
13. The apparatus of claim 8 , wherein to determine that the one application of the transfer is insecure, the memory further stores instructions that when executed by the at least one processor, cause the apparatus to:
identify the one application by retrieving identification of an application that last placed data in a clipboard.
14. The apparatus of claim 8 , wherein to determine that the one application is insecure, the memory further stores instructions that when executed by the at least one processor, cause the apparatus to:
identify the one application by retrieving domain name of a web application using a browser script.
15. A method comprising:
receiving, by an analytic server from a client computing device, data associated with a transfer of sensitive information at the client computing device, the data comprising identification of: a user associated with the client computing device, a source application for the transfer, a target application for the transfer, information type of the sensitive information, and client computing device type, and paste information type; generating, by the analytic server, a risk score associated with the transfer based on the received data;
generating, by the analytic server, plurality of actions based on the generated risk score and the received data; and
transmitting, by the analytic server to the client computing device, the one or more actions, wherein the plurality of actions comprise a first action and a subsequent second action, wherein the transmitting comprises:
transmitting, by the analytic server to the client computing device, the first action in response to determining that the user has performed a first threshold number of transfer of sensitive information; and
transmitting, by the analytic server to the client computing device, the subsequent second action in response to determining that the user has performed a second threshold number of transfer of sensitive information, wherein the second threshold is higher than the first threshold.
16. The method of claim 15 , further comprising:
generating for display, by the analytic server, a dashboard view of a plurality of risk scores for a plurality of users including the risk score for the user.
17. The method of claim 15 , wherein the one or more actions comprise at least one of:
instructions to generate a warning for a user; instructions to lock the user's account; or
instructions to generate a prompt for the user to change login credentials.
18. The method of claim 15 , wherein the information type of the sensitive information is based on heuristic analysis of the target application.