Lookout, Inc.

Other

Daniel Lee Evans

Kevin Patrick Mahaffey

Timothy Micheal Wyatt

David Luke Richardson

James David Burgess

David Golombek

Anthony McKay Lineberry

Kyle Barton

Ariel Salomon

Brian James Buck

Timothy Strazzere

John Gunther Hering

William Neil Robinson

Bruce Christopher Wootton

Jonathan Grubb

Matthew John Joseph LaMantia

Emil Barker Ong

Yogesh Swami

Timothy Michael Wyatt

Jonathan Pantera Grubb

Kavin Patrick Mahaffey

Software applications to be installed on user devices are monitored. Authenticity of the applications is evaluated using trust factors. In some cases, the trust factors relate to security associated with a network being accessed by a user device. In response to the evaluation, an action is performed such as configuring or disabling execution of one or more components of an application.

Evaluating authenticity of applications based on assessing user device context for increased security

Methods and systems are provided for conditionally granting access to service levels based on a determined security state of the device requesting access. A software component, upon receiving a request for access to a provider having a plurality of service levels, determines the current security state of the requesting device. The software component compares that security state to a policy associated with the provider. The software component then allows the requesting device access to the provider services where the device's current security state meets or exceeds the security state required for the service.

Methods and systems for conditionally granting access to services based on the security state of the device requesting access

Methods and systems are provided for sharing information and improving the functioning of devices by blocking potentially harmful communications. In the methods and systems disclosed, a security component on an electronic device may receive a policy. The security component may also receive, from a local device proxy on the electronic device, information pertaining to a communication. The security component may compare the information pertaining to the communication to the policy. The comparison may result in a determination that the communication is potentially harmful. The security component may then instruct the local device proxy to block the communication from proceeding past the local device proxy.

Methods and systems for blocking potentially harmful communications to improve the functioning of an electronic device

Software applications to be installed on user devices are monitored. Authenticity of the applications is evaluated using a plurality of inputs to provide a result. The plurality of inputs may include trust factors. The trust factors may be used to generate a security evaluation. In response to the result, an action is performed such as providing a notification to a developer of a fraudulent version of an application or providing a security assessment for an application.

Monitoring for fraudulent or harmful behavior in applications being installed on user devices

Authenticity of a new application being installed on a mobile device is evaluated to provide a result. The evaluation uses a plurality of inputs. In response to the result, an action is performed (e.g., on the mobile device itself and/or a server performing or assisting with the evaluation). For example, the evaluating may be done for an application that a user of the mobile device desires to install from an application marketplace. In another example, the action is sending of a notification to the mobile device, and the notification includes an assessment of authenticity of the new application.

Assessing application authenticity and performing an action in response to an evaluation result

Software applications previously or currently being installed on a plurality of user devices are monitored. In one embodiment, a first set of the installed applications that is signed with a signing identifier of a developer are identified. A report is then sent to the developer that includes an identification of the first set. In another embodiment, the authenticity of a first application is evaluated including determining, based on a respective signing identifier for each of a plurality of applications, that the applications are similar to the first application. A notification is sent to the developer that identifies applications having a signing identifier that is different from the signing identifier of the developer.

Monitoring installed applications on user devices

A server receives from a mobile communication device information about a data object (e.g., application) on the device when the device cannot assess the data object. The server uses the information along with other information stored at the server to assess the data object. Based on the assessment, the device may be permitted to access the data object or the device may not be permitted to access the data object. The other information stored at the server can include data objects known to be bad, data objects known to be good, or both.

System and method for assessing data objects on mobile communications devices

Methods are provided for determining an enterprise risk level, for sharing security risk information between enterprises by identifying a security response by a first enterprise and then sharing the security response to a second enterprise when a relationship database profile for the first collection indicates the security response may be shared. Methods are also provided for determining whether to allow a request from an originating device where the request may have been initiated by a remote device.

Methods and systems for sharing risk responses between collections of mobile communications devices

Methods and systems are provided for sharing security risk information between collections of computing devices, such as mobile communications devices, to improve the functioning of devices associated with the collections. The methods and systems disclosed may share security risk information by identifying a security risk response by a first collection and then providing the security risk response to a second collection when a relationship database profile for the first collection indicates the security response may be shared with the second collection. Methods and systems are also provided for determining whether to allow a request from an originating device where the request may have been initiated by a remote device.

Methods and systems for sharing risk responses to improve the functioning of mobile communications devices

Disclosed herein is a system and method for efficiently gathering information about applications for mobile communications devices (e.g., smartphones, netbooks, and tablets) and using that information to produce assessments of the applications. To gather information, a server may send a request for application data to a mobile communications device. In response, the server may receive some but not all of the first-requested application data. The server may then a second request for application data to a second mobile communications device that also has access to the application. The server may receive application data from the second mobile communications device, and store the received first- and second-requested application data. The server then uses the stored application data to assess the application.

System and method for assessing an application based on data from multiple devices

A server receives from a mobile communication device application data identifying an application accessible by the mobile communication device. The server uses at least some of the application data to assess the application. The application data can include, for example, behavioral data, metadata, parts of the application, information indicating the application is installed on the mobile communication device, or combinations of these.

Assessing an application based on application data associated with the application

System and method for preventing malware on a mobile communication device

A system and method for preventing malware, spyware and other undesirable applications from affecting mobile communication devices uses a server to assist in identifying and removing undesirable applications. When scanning an application, a device transmits information about the application to a server for analysis. The server receives the information, produces a characterization assessment and can also provide a characterization re-assessment for the application, or data object, and transmits the assessment to the device. By performing analysis on a server, the invention allows a device to reduce the battery and performance cost of protecting against undesirable applications. The server transmits notifications to devices that have installed applications that are discovered to be undesirable. The server can accumulate this data and then perform a characterization re-assessment of a data object it has previously assessed to provide an assessment based upon one of trust, distribution and ratings information.

System and method for server-coupled application re-analysis to obtain trust, distribution and ratings assessment

A system and method prevent malware, spyware and other undesirable applications from affecting mobile communication devices, which use a server to assist in identifying and removing undesirable applications. When scanning an application, a device transmits information about the application to a server for analysis. The server receives the information, produces a characterization assessment and can also provide a characterization re-assessment for the application, or data object, and transmits the assessment to the device. Performing analysis on a server reduces the battery and performance cost of protection. The server transmits notifications to devices that have installed applications that are discovered to be undesirable. The server receives data about applications from many devices, using the combined data to minimize false positives and provide comprehensive protection against known and unknown threats. The server can accumulate this data and then perform a characterization re-assessment of a data object it has previously assessed.

System and method for server-coupled application re-analysis to obtain characterization assessment

To prevent malware, spyware and other undesirable applications from affecting mobile communication devices (e.g., smartphones, netbooks, and tablets), a device uses a server to assist in identifying and removing undesirable applications. When scanning an application, a device transmits information about the application to a server for analysis. The server receives the information, produces a categorization assessment and can provide a categorization re-assessment, and transmits the assessment to the device. By performing analysis on a server, a device can reduce its battery and performance cost of protecting against undesirable applications. The server transmits notifications to devices that have installed applications that are discovered to be undesirable. The server receives data about applications from many devices, using the combined data to minimize false positives and provide comprehensive protection against known and unknown threats. The server can accumulate this data and perform a categorization re-assessment of a data object previously assessed.

Growing community of inventors

San Francisco, CA, United States of America

Daniel Lee Evans