Detecting suspicious application overlays on a device
Systems and methods detect suspicious application overlays on a device. An overlay detection unit can detect if a first foreground application has been replaced, within a threshold amount of time, by a second foreground application. If the replacement time is below a threshold amount of time, a suspicious overlay detection can be triggered to alert the user to a possible phishing attempt by the second foreground application.
1. A method for detecting a suspicious overlay interface on a device, the method comprising:
determining that a current foreground application has replaced a previous foreground application;
in response to determining that the previous foreground application is a protected application:
determining a replacement time in which the previous foreground application was replaced by the current foreground application; and
in response to determining that the replacement time is below a threshold time, determining that a suspicious overlay is present; and
presenting a user interface providing a first user interface element that upon activation, allows an application presenting the suspicious overlay to proceed, and a second user interface element that protects a user from entering information on the suspicious overlay.
2. The method of claim 1 , wherein the device comprises a smartphone.
3. The method of claim 1 , wherein the step of determining that the current foreground application has replaced the previous foreground application is in response to determining a window state change on the device.
4. The method of claim 1 further comprising determining the threshold time based on the time it would take for a human user to replace the previous foreground application with the current foreground application.
5. The method of claim 1 further comprising setting the threshold time to a time that is less than the time it would take for a human user to replace the previous foreground application with the current foreground application.
6. The method of claim 5 further comprising storing the threshold time.
7. The method of claim 1 further comprising:
obtaining a name or other identifier associated with the current foreground application; and
determining whether the current foreground application is a protected application.
8. The method of claim 7 , wherein in response to determining that the current foreground application is a protected application:
associating a timestamp with the current foreground application; and
saving the name or other identifier associated with the current foreground application to a protected applications state.
9. The method of claim 1 , wherein in response to determining that the replacement time is not below a threshold time:
saving the name or other identifier associated with the current foreground application to a protected applications state.
10. A non-transitory machine-readable medium having instructions stored thereon, the instructions comprising computer executable instructions that when executed, cause one or more processors to:
determine that a current foreground application has replaced a previous foreground application;
in response to determining that the previous foreground application is a protected application:
determine a replacement time in which the previous foreground application was replaced by the current foreground application; and
in response to determining that the replacement time is below a threshold time, determine that a suspicious overlay is present; and
present a user interface providing a first user interface element that upon activation, allows an application presenting the suspicious overlay to proceed, and a second user interface element that protects a user from entering information on the suspicious overlay.
11. The non-transitory machine-readable medium of claim 10 , wherein the step of determining that the current foreground application has replaced the previous foreground application is in response to determining a window state change on the device.
12. The non-transitory machine-readable medium of claim 10 , wherein the computer executable instructions further comprise computer executable instructions to:
set the threshold time to a time that is less than the time it would take for a human user to replace the previous foreground application with the current foreground application.
13. The non-transitory machine-readable medium of claim 10 , wherein the computer executable instructions further comprise computer executable instructions to:
obtain a name or other identifier associated with the current foreground application; and
determine whether the current foreground application is a protected application.
14. The non-transitory machine-readable medium of claim 13 , wherein the computer executable instructions further comprise computer executable instructions to, in response to determining that the current foreground application is a protected application:
associate a timestamp with the current foreground application; and
save the name or other identifier associated with the current foreground application to a protected applications state.
15. The non-transitory machine-readable medium of claim 10 , wherein the computer executable instructions further comprise computer executable instructions to, in response to determining that the replacement time is not below a threshold time:
save the name or other identifier associated with the current foreground application to a protected applications state.
16. An apparatus comprising:
one or more processors; and
a non-transitory machine-readable medium having computer executable instructions stored thereon, that when executed, cause the one or more processors to:
determine that a current foreground application has replaced a previous foreground application;
in response to determining that the previous foreground application is a protected application:
determine a replacement time in which the previous foreground application was replaced by the current foreground application; and
in response to determining that the replacement time is below a threshold time, determine that a suspicious overlay is present; and
present a user interface providing a first user interface element that upon activation, allows an application presenting the suspicious overlay to proceed, and a second user interface element that protects a user from entering information on the suspicious overlay.
17. The apparatus of claim 16 , wherein the computer executable instructions further comprise computer executable instructions to:
set the threshold time to a time that is less than the time it would take for a human user to replace the previous foreground application with the current foreground application.
18. The apparatus of claim 16 , wherein the computer executable instructions further comprise computer executable instructions to:
obtain a name or other identifier associated with the current foreground application; and determine whether the current foreground application is a protected application.
19. The apparatus of claim 18 , wherein the computer executable instructions further comprise computer executable instructions to in response to determining that the current foreground application is a protected application:
associate a timestamp with the current foreground application; and
save the name or other identifier associated with the current foreground application to a protected applications state.
20. The apparatus of claim 16 , wherein the computer executable instructions further comprise computer executable instructions to, in response to determining that the replacement time is not below a threshold time:
save the name or other identifier associated with the current foreground application to a protected applications state.