Lookout, Inc.

Tyler S Croak

Brian James Buck

Smit Davda

Pritesh Kasliwal

Krishna Sathyanarayana

Meenakshi Sundaram Lakshmanan

Jasmit Singh Kochhar

Alan Phillips

Abhishek Madan

Balaji Prasad

Ben Joseph

Fatin Haque

Akshat Jain

Frederick Jay Jones, Jr

Agnit Sarkar

Methods and systems for annotating and assessing content, including QR codes, using a web page investigator to avoid dangerous scans of such content are described herein. A security module executing on a client device may receive a request for web content. A computer vision model may then scan the requested web content to identify and annotate graphical features on the webpage prior to rendering the web content on a display of the client device. The computer vision model may identify a QR code and transmit information encoded within the QR code to a server executing a phishing and content protection (PCP) engine for analysis. When the identified QR code is indicated to be malicious, the client device may render a modified version of the requested web content to discourage the user from scanning the identified QR code.

Automatic assessment of potentially malicious web content via web page investigator

Real-time monitoring and alerting of breached security credentials for server-based endpoints is described herein. In various embodiments, a software component (that intercepts outgoing network traffic from a computing device) or a server-based breach monitoring component may receive a request for endpoint data. Credential data may be included in the request. The endpoint and/or the credential data may be compared to credential data linked to a list of compromised endpoints. An alert may be generated for the client device when both a match is detected with credential data of a breach object on the list of compromised endpoints and the breach time field of the breach object is after a previous credentials change for the endpoint. Access to the endpoint may be blocked and/or a change password mechanism may also be displayed to change the user credentials prior to revisiting the endpoint.

Compromised endpoint credentials interceptor

Events of a calendar are identified and evaluated for confidentiality due to an explicit tag, location, participants, or subject matter. In response, permissions of applications on a device are dynamically reduced. Permissions may include permissions to access sensors such as a microphone and camera. Sensors of other devices such as a voice-processing device or Bluetooth device may be disabled. The risk associated with applications on a device may be evaluated based on permissions, usage, collected data, cloud service provider, location, permissions and usage of other users of the application, and other attributes of the application. The risk may be represented as a risk score used to determine whether to perform a mitigation action.

Calendar-based device security

Methods and systems provide for multi-factor authentication (MFA) of a user to a device or network in which a criteria for maintaining the authentication is based on the presence of the user before a device. After the user is authenticated and provided with access, a continuity criteria (i.e., a measure of the presence of the user before the device) must be fulfilled for that access to be maintained. When it is determined that the continuity requirement is not fulfilled, an aspect of the access is denied. A continuity criteria may be based on the location of a second computing device with respect to a first computing device. And multiple methods of determining continuity may be employed simultaneously, with access being denied when continuity is fulfilled by none of the methods.

User presence for authentication

Systems, methods, and apparatus related to network security. In one approach, various endpoint devices communicate with a network gateway and/or API mode CASB over one or more networks. All communications by the endpoint devices with remote servers and clouds pass through the network gateway (and/or by cloud service access when using an API mode CASB). The gateway and/or CASB gathers metadata from the endpoint devices and/or network devices. The metadata indicates characteristics of the communications by the endpoint devices on the networks and/or processes running on the endpoint devices. The gateway and/or CASB identifies security risks using at least the metadata, and in response dynamically performs remediation actions for one or more of the networks in real-time to limit or block propagation of a cyber attack associated with one or more of the identified security risks.

Real-time mitigative security architecture

Growing community of inventors

Columbia, MD, United States of America

Tyler S Croak