Gen Digital Inc.

Ca, Inc.

Symantec Corporation

Bahaa Naamneh

David Luz Silva

Iskander Sanchez Rola

Felix Leder

The disclosed computer-implemented method for dynamic data protection may include intercepting a submit request for sensitive data to a destination, inserting dummy data into the intercepted submit request. The method may also include determining whether the destination is a trusted destination and when the destination is determined to be the trusted destination, replacing the dummy data with real data to complete the submit request to the destination, wherein the real data was previously collected isolated from the submit request. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for dynamic formjacking protection

The disclosed computer-implemented method for enforcing strict network connectivity and storage access during online payments may include (i) determining that a webpage in a tab of a browser application executing on the computing device includes a payment page for an e-commerce website, (ii) based on determining that the webpage includes a payment page, providing formjacking attack protection by monitoring network connectivity and storage access by the browser tab, (iii) based on the formjacking attack protection, identifying a potentially malicious attempt to hijack information entered into at least one web form included in the payment page, and (iv) in response to identifying the potentially malicious attempt, preventing the potentially malicious attempt from hijacking the information entered into the at least one web form included in the payment page. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for enforcing strict network connectivity and storage access during online payments

The disclosed computer-implemented method for dynamic formjacking protection may include identifying a sensitive data input field element on a webform loaded in a browser, creating a secure isolated container overlaid on the identified sensitive data input field element, and collecting, via the secure isolated container, real input data intended for the sensitive data input field element. The method may also include inserting dummy data into the sensitive data input field element and intercepting a form submit request from the webform to a destination. The method may further include determining whether the destination is a trusted destination, and when the destination is determined to be the trusted destination, modifying the form submit request to allow the real input data to be sent to the trusted destination. The method may also include sending the form submit request to the destination. Various other methods, systems, and computer-readable media are also disclosed.

The disclosed computer-implemented method for protecting customer payment data against malware attacks on inline frame payment forms may include (i) detecting a payment form in a payment page on an online merchant website (e.g., by monitoring the website for a user entry of payment information during a customer transaction session or by analyzing, in hypertext markup language associated with an inline frame (iframe), a document object model (DOM)) to identify the payment form, (ii) identifying the iframe on the online merchant website, (iii) determining whether the iframe is associated with a trusted domain utilized for processing the payment information to complete the customer transaction session, and (iv) performing a security action that protects against a potential malware attack by preventing completion of the customer transaction upon determining that the iframe is unassociated with the trusted domain. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting customer payment data against malware attacks on inline frame payment forms

A method for identifying suspicious activity on a monitored computing device is described. In one embodiment, the method may include monitoring a local procedure call interface of the monitored computing device, identifying, based at least in part on the monitoring, a remote procedure call (RPC) of a suspicious process, the RPC being transmitted over a local procedure call message of the local procedure call interface, analyzing the RPC of the suspicious process, and performing a security action based at least in part on the analyzing.

Universal tracing of side-channel processes in computing environments

The disclosed computer-implemented method for safely executing unreliable malware may include (i) intercepting a call to an application programming interface (API) in a computing operating system, the API being utilized by malware for disseminating malicious code, (ii) determining an incompatibility between the API call and the computing operating system that prevents successful execution of the API call, (iii) creating a proxy container for receiving the API call, (iv) modifying, utilizing the proxy container, the API call to be compatible with the computing operating system, (v) sending the modified API call from the proxy container to the computing operating system for retrieving the API utilized by the malware, and (vi) performing a security action during a threat analysis of the malware by executing the API to disseminate the malicious code in a sandboxed environment. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for safely executing unreliable malware

The present disclosure relates to executing software within an execution safety container. An example method generally includes detecting that a memory address referenced by a stack pointer has changed from a first memory address to a second memory address. An execution safety container compares the referenced memory address to a memory address range associated with an application, and upon determining that the referenced memory address is not within the memory address range associated with the application, takes one or more actions to avoid occurrences of unhandled exceptions caused by the referenced memory address being outside of a memory address range associated with an application.

Growing community of inventors

Oslo, Norway

Bahaa Naamneh