Systems and methods for dynamic formjacking protection

Patent metadata

Field	Value
Publication number	US-11947692-B1
Application number	US-202117644684-A
Country	US
Kind code	B1
Filing date	Dec 16, 2021
Priority date	Dec 16, 2021
Publication date	Apr 2, 2024
Grant date	Apr 2, 2024

Abstract

The disclosed computer-implemented method for dynamic formjacking protection may include identifying a sensitive data input field element on a webform loaded in a browser, creating a secure isolated container overlaid on the identified sensitive data input field element, and collecting, via the secure isolated container, real input data intended for the sensitive data input field element. The method may also include inserting dummy data into the sensitive data input field element and intercepting a form submit request from the webform to a destination. The method may further include determining whether the destination is a trusted destination, and when the destination is determined to be the trusted destination, modifying the form submit request to allow the real input data to be sent to the trusted destination. The method may also include sending the form submit request to the destination. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for dynamic formjacking protection, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying a sensitive data input field element on a webform loaded in a browser;
creating a secure isolated container overlaid on the identified sensitive data input field element;
collecting, via the secure isolated container, real input data intended for the sensitive data input field element;
inserting dummy data into the sensitive data input field element in response to collecting the real input data;
intercepting a form submit request from the webform to a destination, wherein the form submit request is prevented by the secure isolated container from including the real input data;
determining whether the destination is a trusted destination;
when the destination is determined to be the trusted destination, modifying the form submit request to allow the real input data to be sent to the trusted destination; and
sending the form submit request to the destination.

2. The method of claim 1 , wherein identifying the sensitive data input field element is based on an element attribute of the sensitive data input field element that is indicative of sensitive data.

3. The method of claim 1 , wherein the secure isolated container comprises an inline frame including an input field.

4. The method of claim 1 , wherein the secure isolated container is associated with a secure domain.

5. The method of claim 1 , wherein the secure isolated container is subject to one or more security mechanisms.

6. The method of claim 5 , wherein the one or more security mechanisms prevents a non-included script from accessing the secure isolated container.

7. The method of claim 5 , wherein the one or more security mechanisms includes a same-origin policy that prevents elements having a different origin than an origin of the secure isolated container from interacting with the secure isolated container.

8. The method of claim 1 , wherein determining whether the destination is a trusted destination is based on a whitelist.

9. The method of claim 1 , further comprising:
determining that the destination is not the trusted destination; and
performing a security action.

10. The method of claim 9 , wherein performing the security action comprises:
sending the form submit request with the dummy data to the destination; and
analyzing a behavior from the destination in response to sending the form submit request.

11. The method of claim 1 , wherein modifying the form submit request further comprises:
identifying the dummy data in the form submit request; and
replacing the dummy data in the form submit request with the real input data.

12. The method of claim 1 , wherein:
modifying the form submit request further comprises initiating a second form submit request using the real input data to replace the form submit request; and
sending the form submit request further comprises sending the second form submit request to the trusted destination.

13. A system for dynamic formjacking protection, the system comprising:
an identification module, stored in memory, configured to identify a sensitive data input field element on a webform loaded in a browser;
a container module, stored in memory, configured to create a secure isolated container overlaid on the identified sensitive data input field element;
a collection module, stored in memory, configured to collect, via the secure isolated container, real input data intended for the sensitive data input field element;
a dummy module, stored in memory, configured to insert dummy data into the sensitive data input field element in response to collecting the real input data;
a security module, stored in memory, configured to intercept a form submit request from the webform to a destination, wherein the form submit request is prevented by the secure isolated container from including the real input data, determine whether the destination is a trusted destination, and when the destination is determined to be the trusted destination, modifying the form submit request to allow the real input data to be sent to the trusted destination;
a submit module, stored in memory, configured to send the form submit request to the destination; and
at least one physical processor that executes the identification module, the container module, the collection module, the dummy module, the security module, and the submit module.

14. The system of claim 13 , wherein identifying the sensitive data input field element is based on an element attribute of the sensitive data input field element that is indicative of sensitive data.

15. The system of claim 13 , wherein the secure isolated container comprises an inline frame including an input field and the secure isolated container is associated with a secure domain.

16. The system of claim 13 , wherein the secure isolated container is subject to one or more security mechanisms, the one or more security mechanisms prevents a non-included script from accessing the secure isolated container, and the one or more security mechanisms includes a same-origin policy that prevents elements having a different origin than an origin of the secure isolated container from interacting with the secure isolated container.

17. The system of claim 13 , wherein the security module is further configured to:
determine that the destination is not the trusted destination;
send, in response to determining that the destination is not the trusted destination, the form submit request with the dummy data to the destination; and
analyze a behavior from the destination in response to sending the form submit request.

18. The system of claim 13 , wherein modifying the form submit request further comprises:
identifying the dummy data in the form submit request; and
replacing the dummy data in the form submit request with the real input data.

19. The system of claim 13 , wherein:
modifying the form submit request further comprises initiating a second form submit request using the real input data to replace the form submit request; and
sending the form submit request further comprises sending the second form submit request to the trusted destination.

20. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
identify a sensitive data input field element on a webform loaded in a browser;
create a secure isolated container overlaid on the identified sensitive data input field element;
collect, via the secure isolated container, real input data intended for the sensitive data input field element;
insert dummy data into the sensitive data input field element in response to collecting the real input data;
intercept a form submit request from the webform to a destination, wherein the form submit request is prevented by the secure isolated container from including the real input data;
determine whether the destination is a trusted destination;
when the destination is determined to be the trusted destination, modifying the form submit request to allow the real input data to be sent to the trusted destination; and
send the form submit request to the destination.

Assignees

• Gen Digital Inc

Inventors

• Sanchez Rola Iskander
• Silva David Luz
• Naamneh Bahaa

Classifications

• G06F21/6209 Primary

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title

• G06F21/6245 Primary

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title