Systems and methods for preventing electronic form data from being electronically transmitted to untrusted domains

Patent metadata

Field	Value
Publication number	US-11003746-B1
Application number	US-201916363936-A
Country	US
Kind code	B1
Filing date	Mar 25, 2019
Priority date	Mar 25, 2019
Publication date	May 11, 2021
Grant date	May 11, 2021

Abstract

A computer-implemented method for preventing electronic form data from being electronically transmitted to untrusted domains may include (i) identifying a web page that includes an electronic form with field for data entry, (ii) detecting that the web page is electronically sending first and second messages that each include data from the field of the electronic form and that are directed to first and second destinations, respectively, (iii) determining that the first destination includes an untrusted destination, and (iv) blocking the web page from electronically sending the data from the field of the electronic form to the untrusted destination by blocking the first message from being electronically sent. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for preventing electronic form data from being electronically transmitted to untrusted domains, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying a web page that comprises an electronic form with a field for data entry, the field for data entry comprising at least one named field from a predetermined list of named fields associated with vulnerable data;
detecting that the web page is electronically sending first and second messages that each comprise data from the field of the form and that are directed to first and second destinations, respectively;
determining that the first destination comprises an untrusted destination; and
blocking the web page from electronically sending the data from the field of the form to the untrusted destination by blocking the first message from being electronically sent.

2. The computer-implemented method of claim 1 , wherein
detecting that the web page is electronically sending the first and second messages comprises detecting that the web page is electronically sending first and second POST requests.

3. The computer-implemented method of claim 1 , wherein
detecting that the web page is electronically sending the first and second messages that each comprise the data from the field of the electronic form and that are directed to the first and second destinations comprises detecting that the web page is electronically sending the first and second messages that are directed to first and second web domains, respectively.

4. The computer-implemented method of claim 1 , wherein
identifying the web page that comprises the electronic form with the field for data entry comprises determining that the web page comprises an e-commerce page.

5. The computer-implemented method of claim 4 , wherein
determining that the web page comprises the e-commerce page comprises detecting at least one string in the web page that matches a predetermined list of strings associated with e-commerce pages.

6. The computer-implemented method of claim 1 , wherein
identifying the web page that comprises the electronic form with the field for data entry comprises identifying, within source code of the web page, at least one string associated with a script that electronically sends electronic form data to malicious destinations.

7. The computer-implemented method of claim 1 , wherein
determining that the first destination comprises the untrusted destination comprises determining that the untrusted destination has a reputation score below a predetermined threshold for trusted reputation.

8. The computer-implemented method of claim 1 , wherein
determining that the first destination comprises the untrusted destination comprises determining that the untrusted destination is not on a whitelist of trusted destinations.

9. The computer-implemented method of claim 1 , wherein
determining that the first destination comprises the untrusted destination comprises determining that the untrusted destination is on a blacklist of untrusted destinations.

10. The computer-implemented method of claim 1 , wherein blocking the web page from electronically sending the data from the field of the electronic form to the untrusted destination by blocking the first message comprises presenting a user with an alert about the untrusted destination.

11. A system for preventing data transmissions to untrusted domains, the system comprising:
an identification module, stored in memory, that identifies a web page that comprises an electronic form with a field for data entry, the field for data entry comprising at least one named field from a predetermined list of named fields associated with vulnerable data;
a detection module, stored in memory, that detects that the web page is electronically sending first and second messages that each comprise data from the field of the electronic form and that are directed to first and second destinations, respectively;
a determination module, stored in memory, that determines that the first destination comprises an untrusted destination;
a blocking module, stored in memory, that blocks the web page from electronically sending the data from the field of the electronic form to the untrusted destination by blocking the first message from being electronically sent; and
at least one physical processor that executes the identification module, the detection module, the determination module, and the blocking module.

12. The system of claim 11 , wherein the detection module detects that the web page is electronically sending the first and second messages by detecting that the web page is electronically sending first and second POST requests.

13. The system of claim 11 , wherein the detection module detects that the web page is electronically sending the first and second messages that each comprise the data from the field of the electronic form and that are directed to the first and second destinations by detecting that the web page is electronically sending the first and second messages that are directed to first and second web domains, respectively.

14. The system of claim 11 , wherein the identification module identifies the web page that comprises the electronic form with the field for data entry by determining that the web page comprises an e-commerce page.

15. The system of claim 14 , wherein the determination module determines that the web page comprises the e-commerce page by detecting at least one string in the web page that matches a predetermined list of strings associated with e-commerce pages.

16. The system of claim 11 , wherein the identification module identifies the web page that comprises the electronic form with the field for data entry comprises identifying, within source code of the web page, at least one string associated with a script that sends electronic form data to malicious destinations.

17. The system of claim 11 , wherein the determination module determines that the first destination comprises the untrusted destination by determining that the untrusted destination has a reputation score below a predetermined threshold for trusted reputation.

18. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
identify a web page that comprises an electronic form with a field for data entry, the field for data entry comprising at least one named field from a predetermined list of named fields associated with vulnerable data;
detect that the web page is electronically sending first and second messages that each comprise data from the field of the electronic form and that are directed to first and second destinations, respectively;
determine that the first destination comprises an untrusted destination; and
block the web page from electronically sending the data from the field of the electronic form to the untrusted destination by blocking the first message from being electronically sent.

Assignees

• Ca Inc

Inventors

• Vashishtha Parveen
• Chandrayan Siddhesh
• Kasiviswanathan Karthikeyan

Classifications

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• G06F21/563

  by source code analysis · CPC title

• G06F21/556

  involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755) · CPC title