Account vulnerability alerts

[0001] Among other things, this disclosure generally relates to systems and methods for determining the vulnerability of one or more of a user's accounts to hacking or account takeover attempts by other individuals.

[0002] Many online services require a user to enter a username, password, and/or other authentication information, in order for the user to access his account with the given service provider. When a user forgets his password, many services provide password recovery procedures by which the user may answer security questions in order to reset his password and/or to access his account without providing a password. For example, when signing up for an account, a service may have provided the user with a number of security questions that the user was required to answer in order to set up his account. When starting the password recovery procedures, the service may retrieve one or more of the security questions and determine whether an individual that is attempting to access the account is capable of providing answers that match those previously provided at account setup. The security questions may relate to personal information and/or other information regarding the user, such as a pet's name, birthplace, father's middle name, mother's maiden name, favorite sports team and/or many other topics.

[0003] If a hacker or other individual is able to guess or otherwise provide the correct answer to an account's security questions, the hacker may be able to take over the user's account. Often one account, such as an email account, may then provide the hacker with access to many other accounts of the hacking victim, such as accounts that use a compromised email address as a verification method for password recovery procedures.

[0004] This disclosure generally relates to systems and methods for determining the vulnerability of one or more accounts maintained for a user by a variety of services to hacking or account takeover attempts by other individuals. For example, an account analysis system may analyze account security features across a variety of services, an individual's publicly available information, and/or the individual's account settings for a variety of accounts in order to identify potential account takeover vulnerabilities and/or to determine a risk level for a takeover of one or more of the user's accounts. The account analysis system may then generate alerts regarding identified vulnerabilities, and may provide information regarding suggested account changes for remedying the identified vulnerabilities.

[0005] For purposes of this summary, certain aspects, advantages, and novel features of the disclosure are described herein. It is to be understood that not necessarily all such advantages may be achieved in accordance with any particular embodiment. Thus, for example, those skilled in the art will recognize that certain embodiments may achieve one advantage or group of advantages as taught herein without necessarily achieving other advantages as may be taught or suggested herein.

[0015] These and other features will now be described with reference to the drawings summarized above. The drawings and the associated descriptions are provided to illustrate certain embodiments and not to limit the scope of the invention. Throughout the drawings, reference numbers may be re-used to indicate correspondence between referenced elements. In addition, the first digit of each reference number generally indicates the figure in which the element first appears.

[0016] Various embodiments of systems, methods, processes, and data structures will now be described with reference to the drawings. Variations to the systems, methods, processes, and data structures which represent other embodiments will also be described.

Example Computing System

[0017] FIG. 1 is a block diagram showing an embodiment in which account analysis system 100 is in communication with a network 160 and various systems are also in communication with the network 160. The account analysis system 100 may be used to implement systems and methods described herein. For example, the account analysis system 100 may be configured to analyze account information associated with account provider systems 162, 164 and/or 166, and generate alerts regarding account vulnerabilities, as discussed below. In different embodiments, account analysis system 100 may be accessed remotely by the client device 170, the system may be local to the client device 170, and/or a combination of the two. Depending on the embodiment, other systems for providing account takeover risk alerts and assessment, as described herein, may include additional or fewer components than are illustrated in the example of FIG. 1.

[0018] The account analysis system 100 includes, for example, a personal computer that is IBM, Macintosh, or Linux/Unix compatible or a server or workstation. In one embodiment, the account analysis system 100 comprises a server, a laptop computer, a cell phone, a personal digital assistant, a kiosk, or an audio player, for example. In one embodiment, the exemplary account analysis system 100 includes one or more central processing unit (“CPU”) 105, which may each include a conventional or proprietary microprocessor. The account analysis system 100 further includes one or more memory 130, such as random access memory (“RAM”) for temporary storage of information, one or more read only memory (“ROM”) for permanent storage of information, and one or more mass storage devices 120, such as a hard drive, diskette, solid state drive, or optical media storage device. Typically, the modules of the account analysis system 100 are connected to the computer using a standard based bus system. In different embodiments, the standard based bus system could be implemented in Peripheral Component Interconnect (“PCP”), Microchannel, Small Computer System Interface (“SCSI”), Industrial Standard Architecture (“ISA”) and Extended ISA (“EISA”) architectures, for example. In addition, the functionality provided for in the components and modules of account analysis system 100 may be combined into fewer components and modules or further separated into additional components and modules.

[0019] The account analysis system 100 is generally controlled and coordinated by operating system software, such as Windows XP, Windows Vista, Windows 7, Windows Server, Unix, Linux, SunOS, Solaris, or other compatible operating systems. In Macintosh systems, the operating system may be any available operating system, such as MAC OS X. In other embodiments, the account analysis system 100 may be controlled by a proprietary operating system. Conventional operating systems control and schedule computer processes for execution, perform memory management, provide file system, networking, I/O services, and provide a user interface, such as a graphical user interface (“GUI”), among other things.

[0020] The exemplary account analysis system 100 may include one or more commonly available input/output (I/O) devices and interfaces 110, such as a keyboard, mouse, touchpad, and printer. In one embodiment, the I/O devices and interfaces 110 include one or more display devices, such as a monitor, that allows the visual presentation of data to a user. More particularly, a display device provides for the presentation of GUIs, application software data, and multimedia presentations, for example. The account analysis system 100 may also include one or more multimedia devices 140, such as speakers, video cards, graphics accelerators, and microphones, for example.

[0021] In the embodiment of FIG. 1, the I/O devices and interfaces 110 provide a communication interface to various external devices. In the embodiment of FIG. 1, the account analysis system 100 is electronically coupled to a network 160, which comprises one or more of a LAN, WAN, and/or the Internet, for example, via a wired, wireless, or combination of wired and wireless, communication link. The network 160 communicates with various computing devices and/or other electronic devices via wired or wireless communication links.

[0022] According to FIG. 1, information is provided to the account analysis system 100 over the network 160 from one or more data sources, such as account providers 162, 164, 166, and/or data sources that store publicly available data. The data sources may include one or more internal and/or external data sources. In some embodiments, one or more of the databases or data sources may be implemented using a relational database, such as Sybase, Oracle, CodeBase and Microsoft® SQL Server as well as other types of databases such as, for example, a flat file database, an entity-relationship database, an object-oriented database, and/or a record-based database.

[0023] A client device 170 may be connected to the network 160 and used by a user to send and receive information to and from the account analysis system 100, or to and from one or more of account providers 162, 164 and/or 166. The client device 170 may be a desktop computer, a mobile computer, or any other mobile device such as a mobile phone or other similar handheld computing devices. The client device 170 and/or account providers 162, 164 and/or 166 may include the same or similar components to those discussed above with reference to the account analysis system 100.

[0024] In the embodiment of FIG. 1, the account analysis system 100 also includes risk analysis module 150 and alert module 152 that may be stored in the mass storage device 120 as executable software codes that are executed by the CPU 105. These modules may include, by way of example, components, such as software components, object-oriented software components, class components and task components, processes, functions, attributes, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays, and variables.

[0025] In the embodiment shown in FIG. 1, the account analysis system 100 is configured to execute the risk analysis module 150 in order to determine account takeover risk associated with accounts maintained for a user by account providers 162, 164 and/or 166. In the illustrated embodiment, the account analysis system 100 is further configured to execute the alert module 152 in order to generate and deliver electronic alerts or notifications to a user (such as a user of client device 170) regarding potential vulnerabilities determined by the risk analysis module 150. The risk analysis module 150 and/or alert module 152 may, depending on the embodiment, implement any other functionality described elsewhere in this specification.

Example Methods

[0026] FIG. 2 illustrates an illustrative operating environment 200 in which account analysis system 100 determines account takeover vulnerabilities based at least in part on information received from account providers 162, 164 and/or 166. As illustrated, the account analysis system gathers user account data, personal information and/or account security information from social network account provider 162, retail account provider 164 and email account provider 166. Depending on the embodiment, the account data may include profile data of a user's account and other publicly accessible data. The received data may include information regarding the account security questions that each provider utilizes for a specific user's account and/or for the service's accounts generally. The account security information gathered may include information regarding a given user's settings, including privacy settings, a phone number and/or email address that an account holder has authorized to receive password change requests, and/or other settings or preferences.

[0027] In some embodiments, a user may have authorized the account analysis system to gather this information, such as by providing the account analysis system 100 with a username and password (or other credentials) associated with the user's account(s) with one or more of the third-party providers 162, 164 and 166. In some embodiments, the user may provide the account analysis system 100 with access to a universal password service or other service that enables the account analysis system 100 to access various accounts of the user. In some embodiments, the account analysis system 100 may gather publicly accessible information from one or more of the providers 162, 164 and 166 without providing login credentials for the user's account(s).

[0028] Once the account analysis system has received the account data, personal information and/or account security information, the account analysis system 100 may determine account takeover vulnerabilities at least in part by comparing the account data and the account security procedures across the different account providers 162, 164 and 166, and/or information obtained from other private and/or publicly available data sources. The account analysis system 100 may then send an alert to the user computing device 170 regarding any determined vulnerabilities, as discussed below.

[0029] FIG. 3 is a flowchart of an illustrative method implemented by the account analysis system 100 for assessing the risk of one or more of a user's accounts with third-party services (such as accounts maintained by social network account provider 162, retail account provider 164, email account provider 166 and/or another service provider) being hacked or taken over by someone other than the authorized account holder.

[0030] The illustrative method begins at block 302, where the risk analysis module 150 determines account security settings and/or password recovery procedures for services with which the user has an account. The account security settings may be determined, in some embodiments, based at least in part by accessing the users' accounts using login credentials (such as username and password) that were provided to the account analysis system 100 by the user. In other embodiments, the account security questions generally employed by a given service may have been previously stored in one or more data stores accessible to the account analysis system 100, such that the user's specific account settings are not retrieved from the given service. In some embodiments, the security procedures implemented by a given service may be determined based at least in part on crowd-sourced information provided by a number of users of the account analysis system 100. For example, a typical password recovery procedure for a given service and/or for a specific account of a given service may include particular security questions, such as “What is your pet's name?,” that the service would ask the user if the user were to lose his or her password. In other embodiments, information regarding account security questions and/or procedures are determined in other manners.

[0031] At block 304, the risk analysis module 150 identifies publicly accessible data associated with the user and/or the user's accounts. For example, the risk analysis module 150 may perform Internet searches for the user's name and determine what personal information or other information regarding the user is publicly accessible. The risk analysis module 150 may search one or more databases, public records and/or other data sources for information regarding the user. The information searched across a number of data sources may include, for example, the user's name (such as first and last name), an email address of the user, a mailing address, a phone number, the user's username on one or more services, a known pseudonym of the user, and/or other information that may be used to at least partially identify the user. The risk analysis module 150 may alternatively or additionally access the user's accounts on various services and determine what information may be visible to connections of the user on social networks or other services. For example, the risk analysis module 150 may determine that while a certain piece of personal information regarding the user is not publicly accessible, it may be viewed by first-degree or second-degree connections of the user on a given social network service.

[0032] At block 306, the risk analysis module 150 may analyze the determined settings, password recovery procedures and/or identified data to determine potential vulnerabilities to hostile takeover of one or more of the user's accounts. For example, the risk analysis module 150 may determine that the answers to one or more security questions asked in the password recovery procedures of a first service are available from or may be derived from publicly accessible information on a second service (or multiple services). As one example, the risk analysis module 150 may identify that an email service includes “What is your favorite sports team?” as a security question, and that the user's favorite sports team is evident from a social network profile or online photo album of the user maintained by another service. As another example, the risk analysis module 150 may determine that the user has set a given email address as a method by which various services may reset the user's password for the given service, such that if the single email account is compromised, a hacker could take over a number of different accounts of the user. In some embodiments, the risk analysis module 150 may apply one or more rule sets when analyzing the collected account data and/or personal information of the user to determine potential account vulnerabilities. The rules may have been determined and stored, for example, based on feedback from one or more other users regarding hacking attempts, by an operator of the risk analysis module 150 and/or based on an automated analysis of security weaknesses performed by the risk analysis module 150. In some embodiments, the risk analysis module 150 may determine a relative risk level associated with each account and/or vulnerability identified. For example, a risk score may be determined and/or a risk level selected from an available set (such as low or high risk).

[0033] At block 308, the risk analysis module 150 and/or alert module 152 may provide the user with an alert regarding any vulnerabilities determined at block 306, optionally providing one or more suggested account changes for remedying the vulnerabilities. For example, the provided alert may suggest that the user change a password, change security questions, change password recovery procedure options, remove personal information from a profile or other data source, etc. The alert may be provided in a variety of ways, such as via a webpage or other user interface, an SMS message, an email, an application programming interface (“API”), and/or one or more other delivery methods. In some embodiments, the alert module 152 may implement the illustrative method and send the alerts on a periodic basis in association with a monitoring service provided by the account analysis system 100. In some embodiments, the alert may be presented as text, as one or more graphics or images, as a numeric score or level, and/or as a color or shade of color (such as an intense red color for high-level alerts). In some embodiments, the alert module may implement the illustrative method as part of a simulation that enables a user to determine what alerts would be generated if certain changes were made by the user to one or more of the user's account settings, profiles, passwords, security questions, password recovery procedures, and/or other information or settings.

Example User Interfaces

[0034] FIG. 4 is an illustrative user interface 400 that may be generated by the account analysis system 100 in order to present a user with options for setting up an account with the account analysis system 100. As illustrated, the user interface requests that the user enter basic information 402 such as name, location, and email address. In some embodiments, only this basic information or other basic personal information may be required in order for the account analysis system 100 to provide account vulnerability analysis, monitoring and/or alerts.

[0035] The illustrative user interface 400 also includes options for the user to enter information identifying any accounts 404 with third party services that the user would like included the analysis performed by the account analysis system 100. As illustrated, the selected accounts include an account with “SocialSite,” which may be a social networking service, and “LMR Credit Union,” which may be a financial services account. The user may optionally enter the user's username and password for one or more of the accounts in order to provide the account analysis system 100 with improved capability to analyze the account's security settings and other account data. The user may select which of the user's third party accounts are accounts for which the user would like to receive alerts. For example, the user may select option 408 in order to indicate that the user is interested in receiving vulnerability alerts with respect to the user's account with LMR Credit Union. In other embodiments, the user may be presented with further options for indicating the risk levels (such as low risk, medium risk and/or high risk) for which the user would like to receive alerts for a given account. Accounts that are not selected for alerts may still be used by the account analysis system 100, in some embodiments, to determine how personal information accessible through those services may affect the security of other monitored accounts.

[0036] The user may select the add account option 406 in order to provide the account analysis system 100 with information regarding additional accounts maintained for the user by third-party services. Once the user selects submit option 410, the account analysis system 100 may store the provided information in association with the user in one or more data stores, such as mass storage device 120.

[0037] FIG. 5 is an illustrative user interface 500 that may be generated by the account analysis system 100 in order to provide a user with alerts and suggested remedies for potential account vulnerabilities determined by the risk analysis module 150. As illustrated, the user interface 500 includes an alert 502 indicating that someone could change the user's password for the user's account with the “LMR Credit Union” service based in part on the user's profile information on social networking service “SocialSite.” For example, the account analysis system 100 may have determined that the answer to an account security question asked by the LMR Credit Union service during password recovery procedures is listed on the user's profile page for SocialSite. The illustrative user interface 500 includes suggested remedial actions, including an option 504 which the user may select in order to be presented with one or more user interfaces that enable him to change his account settings with LMR Credit Union and an option 506 which the user may select in order to be presented with one or more user interfaces that enable him to edit his profile information and privacy settings with the SocialSite service.

[0038] FIG. 6 is an illustrative user interface 600 that may be generated by the account analysis system 100 that provides an overview of account vulnerabilities for multiple accounts associated with a user. As illustrated, the user interface 600 includes a table 602 with rows corresponding to various services with which the user has an account. For each account, the table 602 indicates the most recent vulnerability alert level (illustrated as a “hackable risk alert level”) determined by the account analysis system 100, such as by using methods similar to those discussed above with reference to FIG. 3. For example, the risk level for the user's email account with the “ABC Email” service is indicated as high.

[0039] The user may select the “view alert information” option 604 in order to view more information regarding the alert for the ABC Email service and information regarding recommended remedial actions to be taken. In some embodiments, user selection of option 604 may additionally or alternatively display a visualization of connections or relationships between the ABC Email account and one or more other accounts, personal information, devices, security questions, passwords and/or other data, such as a graphical representation similar to that discussed below with reference to FIG. 7. As illustrated, table 602 additionally includes an indication of accounts that are linked to other identified accounts. For example, table 602 indicates that the ABC Email account is linked to accounts with Cloud Storage, LMR Credit and two other services. For example, the user may have provided his “ABC Email” email address as the email address to which password reset requests will be sent for the user's account with the Cloud Storage service.

[0040] FIG. 7 is a graphical representation of relationships between various accounts, devices, security question information, passwords and other data. The illustrated connections or links may have been determined by the account analysis system 100 based at least in part on data received from various services, users, websites, and/or other data sources. The connection information may then have been stored in one or more data stores, such as mass storage device 120, in order to be retrieved and analyzed by the risk analysis module 150 and/or the alert module 152 in generating alerts.

[0041] As illustrated in FIG. 7, Account 1 and Account 2 are linked to Device 1, which may have been determined by the account analysis system 100 based on the user's Account 1 and Account 2 (which may be maintained by different services) being configured to send account authentication messages to a user's mobile phone (Device 1). As illustrated, Account 2 may be an email account which the user has indicated as a password recovery email address to which the service provider for Account 3 and the service provider for Account 4 should send emails enabling the user to reset his password for his account with the respective service.

[0042] As further illustrated, the user has used the same password (indicated as Password B) with both Account 3 and Account 4. The answer to one of the user's security questions for Account 1 (indicated as Security Question Answer E) may be the same as or a derivation of the user's password with Account 2 (indicated as Password A). Additionally, the answer to a security question for both the user's Account 4 and Account 5 (indicated as Security Question Answer K) is indicated as being shown in the user's public profile on Service 6. For example, the security question of Account 4 may ask “What is your pet's name?,” and the name of the user's pet may be included in the user's public profile on a social network service. As will be appreciated, a variety of data types, device types, services, account security mechanisms, credential information and/or other data not illustrated in FIG. 7 may be analyzed and stored with linking information, in other embodiments.

[0043] FIG. 8 is an illustrative user interface 800 that may be generated by the account analysis system 100 that provides alert history information and alert settings for a given user. As illustrated, the user interface 800 indicates that an alert 802 was generated and/or delivered to the user at 1:12 pm on March 2nd, which indicated that someone could change the user's password for his LMR Credit Union account based on profile information from the user's SocialSite account. The user interface 800 includes an indication that the user took one of the suggested remedial actions (changing LMR Credit Union account settings) on March 2nd, but has not yet acted on the additional advice to edit the user's profile information on SocialSite. The user's current alert settings for the LMR Credit Union account indicate that the account analysis system 100 should send alerts to the user for any threats that are of at least medium-high risk. The user may select to change these alert settings by selecting option 806. The user interface 800 additionally includes a second alert 804, which indicates that the user is using a backup email address for the user's account with the “RMail” service which has a medium risk alert pending. As indicated, the alert settings for the user's account with RMail are currently configured to send an alert to the user for low, medium or high threats to account security of the user's RMail account.

[0044] FIG. 9 is an illustrative user interface 900 that may be generated by the account analysis system 100 in order for a user to submit a hacking report to the analysis system 100. The analysis system 100 may use information provided by the user to create a rule or to otherwise store information that may be considered by the risk analysis module 150 when determining account vulnerability risks for this user and/or other users. A user may submit such information, for example, after a hacker has taken over an account of the user with one or more third-party services. As illustrated, the user may enter information identifying the account provider of the account that was hacked by selecting option 902. The user may indicate a method used by the hacker to gain access to the account (such as a correctly answered security question, a compromised password, or other method) by selecting from option 904. As illustrated, the user has selected that his account with the SongBuy service was compromised using a correct answer to a security question. The user may enter the security question answered by the hacker in field 906. The user may also indicate via user interface element 908 where the hacker obtained any personal data or other information used in the hacking attempt (such as a second service that the hacker used to find the answer to a security question). In the illustrated example, the hacker may have determined the answer to the user's security question from profile information on a social networking service, SocialSite. Upon completing the form, the user may select submit option 910 in order to submit the entered information to the analysis system 100 to be analyzed and/or for a rule to be generated and stored.

[0045] In general, the word “module,” as used herein, refers to logic embodied in hardware or firmware, or to a collection of software instructions, possibly having entry and exit points, written in a programming language, such as, for example, Java, Lua, C, C++ or C#. A software module may be compiled and linked into an executable program, installed in a dynamic link library, or may be written in an interpreted programming language such as, for example, BASIC, Perl, or Python. It will be appreciated that software modules may be callable from other modules or from themselves, and/or may be invoked in response to detected events or interrupts. Software modules configured for execution on computing devices may be provided on a computer readable medium, such as a compact disc, digital video disc, flash drive, or any other tangible medium. Such software code may be stored, partially or fully, on a memory device of the executing computing device, such as the account analysis system 100, for execution by the computing device. Software instructions may be embedded in firmware, such as an EPROM. It will be further appreciated that hardware modules may be comprised of connected logic units, such as gates and flip-flops, and/or may be comprised of programmable units, such as programmable gate arrays or processors. The modules described herein are preferably implemented as software modules, but may be represented in hardware or firmware. Generally, the modules described herein refer to logical modules that may be combined with other modules or divided into sub-modules despite their physical organization or storage.

[0046] Conditional language used herein, such as, among others, “can,” “could,” “might,” “may,” “e.g.,” and from the like, unless specifically stated otherwise, or otherwise understood within the context as used, is generally intended to convey that certain embodiments include, while other embodiments do not include, certain features, elements and/or states. Thus, such conditional language is not generally intended to imply that features, elements and/or states are in any way required for one or more embodiments or that one or more embodiments necessarily include logic for deciding, with or without author input or prompting, whether these features, elements and/or states are included or are to be performed in any particular embodiment.

[0047] Any process descriptions, elements, or blocks in the flow diagrams described herein and/or depicted in the attached figures should be understood as potentially representing modules, segments, or portions of code which include one or more executable instructions for implementing specific logical functions or steps in the process. Alternate implementations are included within the scope of the embodiments described herein in which elements or functions may be deleted, executed out of order from that shown or discussed, including substantially concurrently or in reverse order, depending on the functionality involved, as would be understood by those skilled in the art.

[0048] All of the methods and processes described above may be embodied in, and partially or fully automated via, software code modules executed by one or more general purpose computers. For example, the methods described herein may be performed by an Information Display Computing Device and/or any other suitable computing device. The methods may be executed on the computing devices in response to execution of software instructions or other executable code read from a tangible computer readable medium. A tangible computer readable medium is a data storage device that can store data that is readable by a computer system. Examples of computer readable mediums include read-only memory, random-access memory, other volatile or non-volatile memory devices, CD-ROMs, magnetic tape, flash drives, and optical data storage devices.

[0049] It should be emphasized that many variations and modifications may be made to the above-described embodiments, the elements of which are to be understood as being among other acceptable examples. All such modifications and variations are intended to be included herein within the scope of this disclosure. The foregoing description details certain embodiments of the invention. It will be appreciated, however, that no matter how detailed the foregoing appears in text, the invention can be practiced in many ways. As is also stated above, it should be noted that the use of particular terminology when describing certain features or aspects of the invention should not be taken to imply that the terminology is being re-defined herein to be restricted to including any specific characteristics of the features or aspects of the invention with which that terminology is associated. The scope of the invention should therefore be construed in accordance with the appended claims and any equivalents thereof.