US 8,429,734 B2Granted

Method for detecting DNS redirects or fraudulent local certificates for SSL sites in pharming/phishing schemes by remote validation and using a credential manager and recorded certificate attributes

AssigneeSymantec Corporation

InventorsPaul Agbabian, William E. Sobel, Bruce McCorkendale

Life of this patent

Estimating the term…

Loading patent…

Abstract

Certificate information associated with a received certificate, such as a Secure Sockets Layer (SSL) certificate is stored in a trusted local cache and/or in one or more remote trusted sources, such as a single remote trusted source and/or a trusted peer network. When a site certificate is received on a host computer system, certificate information associated with the received site certificate is obtained and compared with the stored certificate information to determine whether or not the site certificate indicates malicious activity, such as a malicious DNS redirection or a fraudulent local certificate. When a site certificate is not found indicative of malicious activity, the site certificate is released. Alternatively, when a site certificates is found indicative of malicious activity protective action is taken. In some embodiments, a user's log-in credentials are automatically obtained from a trusted local cache and automatically submitted to a web site.

Claims16

Dependent claims

A computer-implemented method comprising:

executing on a host computer system a credential manager application, wherein the executing includes:
intercepting, by the executing credential manager application on the host computer system, an SSL certificate received on the host computer system,
wherein the SSL certificate is intercepted prior to receipt by a web browser on the host computer system, and
wherein the SSL certificate is returned from a web site in response to communication from the host computer system;
obtaining, on the host computer system by the executing credential manager application, certificate information associated with said SSL certificate,
wherein said certificate information comprises:
a Uniform Resource Locator (URL) associated with a web site providing the SSL certificate;
at least one user credential of a user, wherein the user is a user of the host computer system;
and
at least one certificate attribute of the SSL certificate;
querying a trusted local cache, on the host computer system by the executing credential manager application, for locally stored certificate information corresponding to said SSL certificate,
wherein said locally stored certificate information comprises:
a Uniform Resource Locator (URL) associated with a web site providing the SSL certificate;
at least one user credential of a user, wherein the user is a user of the host computer system;
and
at least one certificate attribute of the SSL certificate;
determining, on the host computer system by the executing credential manager application, whether said locally stored certificate information is present in said trusted local cache;
wherein upon a determination that said locally stored certificate information is present in said trusted local cache, obtaining, on the host computer system by the executing credential manager application, said locally stored certificate information;
performing a first comparison, on the host computer system by the executing credential manager application, said first comparison comparing at least said at least one user credential and said at least one certificate attribute with corresponding information in said locally stored certificate information;
determining, on the host computer system by the executing credential manager application, whether said SSL certificate is verified based upon said first comparison;
wherein upon a determination that said SSL certificate is verified, releasing said SSL certificate;
and
wherein upon a determination that said SSL certificate is not verified, taking protective action on the host computer system as the SSL certificate is indicative of malicious activity and so is indicative of a malicious attack;
and
wherein the protective action includes sending an alert of the malicious activity by the executing credential manager application.

22 more elements

A computer-program product comprising a non-transitory tangible computer readable medium containing computer program code comprising:

a credential manager application, said credential manager application for intercepting, on the host computer system, an SSL certificate received on a host computer system,
wherein the SSL certificate is intercepted prior to receipt by a web browser on the host computer system, and
wherein the SSL certificate is returned from a web site in response to communication from the host computer system;
said credential manager application further for obtaining, on the host computer system, certificate information associated with said SSL certificate,
wherein said certificate information comprises:
a Uniform Resource Locator (URL) associated with a web site providing the SSL certificate;
at least one user credential of a user, wherein the user is a user of the host computer system;
and
at least one certificate attribute of the SSL certificate;
said credential manager application further for querying, on the host computer system, a trusted local cache for locally stored certificate information corresponding to said SSL certificate,
wherein said locally stored certificate information comprises:
a Uniform Resource Locator (URL) associated with a web site providing the SSL certificate;
at least one user credential of a user, wherein the user is a user of the host computer system;
and
at least one certificate attribute of the SSL certificate;
said credential manager application further for determining, on the host computer system, whether said locally stored certificate information is present in said trusted local cache;
wherein upon a determination that said locally stored certificate information is present in said trusted local cache, said credential manager application further for obtaining, on the host computer system, said locally stored certificate information;
said credential manager application further for performing a first comparison on the host computer system, said first comparison comparing at least said at least one user credential and said at least one certificate attribute with corresponding information in said locally stored certificate information;
said credential manager application further for determining, on the host computer system, whether said SSL certificate is verified based upon said first comparison;
wherein upon a determination that said SSL certificate is verified, said credential manager application further for releasing said SSL certificate;
and
wherein upon a determination that said SSL certificate is not verified, said credential manager application further for taking protective action on the host computer system as the SSL certificate is indicative of malicious activity and so is indicative of a malicious attack, wherein the protective action includes sending an alert of the malicious activity by the credential manager application.

19 more elements

Dependencies are inferred from the claim text.