Detection of compromised unmanaged client end stations using synchronized tokens from enterprise-managed client end stations

Patent metadata

Field	Value
Publication number	US-2016381023-A1
Application number	US-201514750539-A
Country	US
Kind code	A1
Filing date	Jun 25, 2015
Priority date	Jun 25, 2015
Publication date	Dec 29, 2016
Grant date	—

Abstract

Techniques related to detecting compromised unmanaged client end stations using synchronized tokens placed on enterprise-managed client end stations are described. A token distribution module causes token(s) to be placed with user data of a managed client end station in specific locations. The placement locations are selected due to the token(s) likely being synchronized, the token(s) being unlikely to be discovered or used by an authorized user, but likely discovered by an attacker. During a synchronization process, the token(s) are sent to an unmanaged client end station. The token(s) can be detected and/or acquired from the unmanaged client end station by an attacker, and thereafter used in an attempt to access an apparent enterprise resource. A token detection module can detect this use of the token(s) to thereby detect the compromise of the unmanaged client end station, without needing direct access to the unmanaged client end station.

First claim

What is claimed is:

1 . A method for causing a token to be placed on an unmanaged client end station without direct access to the unmanaged client end station, wherein a managed client end station that is managed by an administrator of an enterprise has stored therein existing code and existing user data, wherein the existing code is configured to allow participation in a synchronization process of the existing user data, and wherein the synchronization process causes that existing user data to be synchronized with existing user data on the unmanaged client end station, the method comprising:
causing the token to be stored with the existing user data on the managed client end station such that the token will be synchronized when and if the existing user data is synchronized by the synchronization process, wherein the token appears to be useful for accessing an apparent enterprise resource, wherein the existing user data was chosen because the token's presence with the existing data is unlikely to be discovered and used by an authorized user and because the existing user data is likely to be synchronized, wherein the token and the existing user data were chosen because an attacker is likely to access the token and attempt to use the token to access the apparent enterprise resource; transmitting, by the managed client end station, the token as part of the synchronization process to cause the token to be stored by the unmanaged client end station; detecting a use of the token within network traffic, wherein the token was accessed from the unmanaged user end station; and in response to the detected use of the token, generating an alert.

2 . The method of claim 1 , further comprising:
receiving the token at the unmanaged user end station as a result of the synchronization process; and accessing, by the unmanaged user end station, the token as a result of the unmanaged user end station being compromised.

3 . The method of claim 1 , wherein the token is placed within an email message that is within a deleted email messages folder or marked as deleted within a communications application.

4 . The method of claim 1 , wherein the token is placed within a hidden folder.

5 . The method of claim 1 , wherein the token is placed within a contact object operable for use with a communications application among a plurality of other contact objects.

6 . The method of claim 1 , wherein the token is placed within a note or file stored within a trash object utilized by a cloud storage application.

7 . The method of claim 1 , wherein the token is placed with the existing user data on the managed client end station in an encrypted format, and wherein the detected token is in a decrypted format.

8 . The method of claim 1 , wherein the detecting the use of the token within network traffic comprises:
analyzing a request to access the apparent enterprise resource that includes the token, wherein the apparent enterprise resource is a server application.

9 . The method of claim 1 , wherein the transmitting, by the managed client end station, the token as part of the synchronization process comprises transmitting the token to a third party server end station which transmits the token to the unmanaged client end station.

10 . The method of claim 1 , wherein:
the managed client end station is within an enterprise network when the token is caused to be placed with the existing user data on the managed client end station; and the unmanaged client end station is outside of the enterprise network when the token is transmitted as part of the synchronization process to cause the token to be placed by the unmanaged client end station.

11 . A system for causing a token to be placed on an unmanaged client end station without direct access to the unmanaged client end station, wherein a managed client end station that is managed by an administrator of an enterprise has stored therein existing code and existing user data, wherein the existing code is configured to allow participation in a synchronization process of the existing user data, and wherein the synchronization process causes that existing user data to be synchronized with existing user data on the unmanaged client end station, the system comprising:
a token distribution module that causes the token to be placed with the existing user data on the managed client end station such that the token will be synchronized when and if the existing user data is synchronized by the synchronization process, wherein the token appears to be useful for accessing an apparent enterprise resource, wherein the existing user data was chosen because the token's presence with the existing data is unlikely to be discovered and used by an authorized user and because the existing user data is likely to be synchronized, wherein the token and the existing user data were chosen because an attacker is likely to access the token and attempt to use the token to access the apparent enterprise resource; the managed client end station, which transmits the token as part of the synchronization process to cause the token to be stored by the unmanaged client end station; and a token detection module that:
detects a use of the token within network traffic, wherein the token was accessed from the unmanaged user end station; and
in response to the detected use of the token, generates an alert.

12 . The system of claim 11 , further comprising an unmanaged user end station that:
receives the token as a result of the synchronization process; and accesses the token as a result of the unmanaged user end station being compromised.

13 . The system of claim 11 , wherein the token is placed within an email message that is within a deleted email messages folder or marked as deleted within a communications application.

14 . The system of claim 11 , wherein the token is either:
placed within a contact object operable for use with a communications application among a plurality of other contact objects; or placed within a note or file placed within a trash object utilized by a cloud storage application.

15 . A set of one or more non-transitory computer readable storage media storing instructions which, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform operations for causing a token to be placed on an unmanaged client end station without direct access to the unmanaged client end station, wherein a managed client end station that is managed by an administrator of an enterprise has stored therein existing code and existing user data, wherein the existing code is configured to allow participation in a synchronization process of the existing user data, and wherein the synchronization process causes that existing user data to be synchronized with existing user data on the unmanaged client end station, the operations comprising:
causing a token to be placed with the existing user data on the managed client end station such that the token will be synchronized when and if the existing user data is synchronized by the synchronization process, wherein the token appears to be useful for accessing an apparent enterprise resource, wherein the existing user data was chosen because the token's presence with the existing data is unlikely to be discovered and used by an authorized user and because the existing user data is likely to be synchronized, wherein the token and the existing user data were chosen because an attacker is likely to access the token and attempt to use the token to access the apparent enterprise resource; transmitting, by the managed cli

Assignees

• Imperva Inc

Inventors

• Dulce Sagie
• Shulman Amichai

Classifications

• H04L63/1491

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L67/42

  Electricity · mapped topic