WO2016082678A1

WO2016082678A1 - Method and device for monitoring display hijack

Info

Publication number: WO2016082678A1
Application number: PCT/CN2015/094316
Authority: WO
Inventors: 林钧燧
Original assignee: 阿里巴巴集团控股有限公司; 林钧燧
Priority date: 2014-11-24
Filing date: 2015-11-11
Publication date: 2016-06-02
Also published as: CN105701402A; CN105701402B

Abstract

Disclosed are a method and device for monitoring a display hijack. The method comprises: displaying received information sent by a server, and checking the currently displayed information through screen checking technology, so as to judge whether the currently displayed information is the same as the information sent by the server, thereby understanding whether a currently display is hijacked. The method and device of the present application can be widely used for various transaction processes, such as online shopping and transfer transactions, and can effectively monitor the occurrence of a display hijack situation in time, thereby improving the system security.

Description

Method and device for monitoring display hijacking

Technical field

The present application relates to the field of computer technology, and in particular, to a method and apparatus for monitoring display hijacking.

Background technique

With the rapid development of computer technology and Internet technology, more and more people like and get used to the emerging trading methods, such as: mobile payment, online banking transfer and other fast trading methods, while bringing great convenience to people's lives, It has also exposed a large number of information security problems. Some illegal elements use computer technology and Internet technology to attack the user's transaction process without the user's awareness, and the user suffers huge economic benefits.

In the prior art, a common attack method is to display a hijacking type attack. The so-called display hijacking, as the name implies, is that the attacking party misleads the user by modifying the display information to the user, so that the user or other person suffers losses during the business. For example, user A transfers money to user B, and the attacker transfers money to user C during the transaction process. When the system displays the transaction information, the attacker displays the display information displayed by the user through the injection, layer overlay, and the like. To user B, it is not noticeable. At this time, if the user confirms the information and enters the required verification (such as entering a password) to complete the transaction, the user will suffer losses.

From a technical point of view, after a user initiates a transaction request to a server through a terminal or a client, such as an Automated Teller Machine (ATM) or a Point of Sales (POS), it is usually required to complete the final transaction. The user confirms the transaction information at the terminal, and the user can reject the transaction if the information is found to be incorrect, and in this case, the attacker can tamper with the transaction information that needs to be confirmed by the user during the communication process (for example, by means of a man-in-the-middle attack, injection, etc., The transaction confirmation message sent by the server), or tampering with the displayed information when the terminal displays the information (for example, modifying the display information by means of program dynamic injection, layer overlay, etc.) to achieve hijacking display and defrauding the user for confirmation. Undoubtedly, malicious display hijacking will bring great security risks to the Internet system. How to effectively monitor or identify display hijacking is an urgent technical problem.

Summary of the invention

The embodiment of the present application provides a method and apparatus for monitoring display hijacking to solve the problem in the prior art that a user suffers a loss in a transaction due to the hijacking of the displayed information.

A method for monitoring display hijacking provided by an embodiment of the present application includes:

Receive information sent by the server and display it;

Get the information of the current display;

Determining whether the currently displayed information is the same as the received information;

If yes, it is determined that it has not been hijacked by the display;

Otherwise, be sure to be hijacked by the show.

Further, obtaining information currently displayed, specifically including:

Get the text content of the currently displayed information;

Determine whether the information currently displayed is the same as the information received, including:

It is judged whether the text content of the currently displayed information is the same as the text content of the received information.

Further, obtaining information currently displayed, specifically including:

Grab the image of the information currently displayed;

Obtaining text content of the currently displayed information from the information image;

Further, the text content of the currently displayed information is obtained from the information image, and specifically includes:

The text content of the currently displayed information is obtained from the information image by means of graphic transformation.

Further, receiving the information sent by the server and displaying the information includes:

Receiving information and signatures sent by the server;

Verify the signature;

The received information is displayed when the verification is passed.

The application also provides a device for monitoring display hijacking, including:

a receiving module, configured to receive information sent by the server;

a display module for displaying the received information; and

The checking module is configured to check whether the information currently displayed by the display module is the same as the information received by the receiving module.

Further, the inspection module is provided with a text checking unit for acquiring text content in the currently displayed information, and determining whether the text content is identical to the text content of the information received by the receiving module.

Further, the inspection module is provided with an image checking unit for capturing an image in the currently displayed information, and determining whether the text content contained in the image is identical to the text content of the information received by the receiving module.

Further, the image checking unit includes a graphic conversion module for acquiring text content from the currently displayed image.

Further, the receiving module is further configured to receive a signature sent by the server for the sent information.

Further, the device further includes:

a signature module for signing information received by the receiving module; and

A verification module is configured to verify whether the signature is consistent with a signature sent by the server.

The method and device for monitoring display hijacking described in the present application use screen checking to compare the currently displayed information content with the information content sent by the server, thereby judging whether the information has been tampered with during the display process, and can be timely and effectively Monitor the occurrence of hijackings and improve the security of the system.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the present application, and are intended to be a part of this application. In the drawing:

1 is a flow chart of a method for monitoring display hijacking according to the present application;

2 is a structural diagram of an apparatus for monitoring display hijacking according to the present application;

3 is a transaction process for monitoring a method of displaying hijacking using the present application;

4 is a schematic diagram of a method for monitoring display hijacking in a specific transaction application according to the present application.

detailed description

The technical solutions of the present application will be clearly and completely described in the following with reference to the specific embodiments of the present application and the corresponding drawings. It is apparent that the described embodiments are only a part of the embodiments of the present application, and not all of them. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope are the scope of the present application.

As shown in FIG. 1 , the present application provides a method for monitoring display hijacking, including: receiving information displayed by a server and displaying; obtaining current displayed information; determining whether the currently displayed information is the same as the received information; and if so, Make sure that it has not been hijacked by the display; otherwise, be sure to be hijacked by the show. In the preferred embodiment of the present application, the specific process is as follows:

The process of receiving the information sent by the server and displaying it is that the client receives the information from the server. After receiving the information, the client displays the received information through a screen display technology. Due to the display hijacking, the information displayed is different from the information originally received by the client. Therefore, the application adopts the screen inspection technology, that is, by obtaining the information displayed on the current screen, the information is The information received by the client is compared to see if the two are the same, to determine whether the display is hijacked.

Certainly, in order to further prevent the occurrence of the display hijacking and increase the confidentiality of the information, in the preferred embodiment of the present application, the server signs the information sent by the server by using a digital signature manner, and the signature is used by the server. A digest obtained by the algorithm computing the information it sends, and the digest (ie, the signature) is sent from the server to the client along with the information. After receiving the information, the client also needs to verify the signature to prevent the information sent by the server from being tampered with during the transmission process. If the client can verify the signature, the information sent by the server is transmitted to the client. Not in the process Tampering, on the contrary, if the verification fails, it indicates that tampering has occurred. At this time, the next step will not be possible to ensure the security of the whole process.

In addition, based on the above method, the present application further provides a device for monitoring display hijacking. As shown in FIG. 2, the device includes the following modules: a receiving module 101, a display module 102, and an inspection module 103.

The receiving module 101 is configured to receive information sent from a server. Of course, in a preferred embodiment, the information sent by the server is information signed by the server, and includes the sending information and the signature of the information.

The display module 102 is configured to display information received by the receiving module 101.

The checking module 103 is configured to check whether the information currently displayed by the display module 102 is the same as the information received by the receiving module 101, thereby determining whether the information displayed by the display module 102 is authentic and has not been tampered with. The check module 103 is provided with a text check unit 1031 and an image check unit 1032. The text check unit 1031 is configured to acquire text content in the currently displayed information, and determine the text content and the information received by the receiving module. Whether the text content is the same; the image checking unit 1032 is configured to acquire an image in the currently displayed information, and determine whether the text content contained in the image is the same as the text content of the information received by the receiving module, in the preferred embodiment. The image checking unit 1032 is provided with a graphic conversion module for converting the content in the image into text content, and the checking process of the checking module 103 is a periodic loop check; the image checking unit 1032 is also available. Grasping the currently displayed information image, obtaining the attribute of the currently displayed image from the information image, and determining whether the attribute is the same as the attribute of the preset trusted image, the attribute including the resolution of the image, At least one of a format of the image, a source of the image, a size of the image, a location where the image is stored, and a creation time of the image .

Of course, in the preferred embodiment, the device for monitoring display hijacking further includes: a storage module 104, a signature module 105, and a verification module 106.

The storage module 104 is configured to store the received information.

The signing module 105 is configured to sign the information received by the receiving module 101.

The verification module 106 is configured to verify the signature and the service produced by the signature module 105 Whether the signatures issued by the device are consistent;

It can be seen that the monitoring display hijacking device described in the present application can timely display the display hijacking by checking the setting of the module, thereby improving the security of the whole process.

In order to clarify the principle and function of the method for monitoring and displaying hijacking in this application, the following will be described in detail in conjunction with specific application situations. Please refer to FIG. 3 and FIG. 4 together, which is applied to the monitoring and display method of the present application. A flow chart during the transaction process, the transaction process includes the following steps:

S01: The client accepts the user's transaction request and sends the transaction request to the server.

In the embodiment of the present application, the client may be a multi-modal application, and establishes a communication connection with a remote server through a wired or wireless network, where the client includes but is not limited to: a browser, a personal computer (Personal Computer, PC) applications, mobile applications, which can exist in electronic and electrical equipment such as personal computers, mobile phones, and tablet computers.

After starting the client, the user may initiate a transaction request to the client, and the client transmits to the remote server through the network according to the transaction request of the user, where the transaction request includes the identity tag of the user.

S02: The server generates and confirms the transaction confirmation information according to the received request, and sends the signed transaction confirmation information to the client.

After receiving the transaction request, the server automatically identifies the identity tag included in the transaction request, and invokes information related to the identity tag in the background database, and the server creates the transaction request record (initiation time, request content, initiation) The location, identity and other information of the client), and then the server generates corresponding transaction confirmation information according to the transaction request of the user, and calls the signature module to sign the transaction confirmation information, and transmits the signature and the transaction confirmation information together through the network. Client.

The signature module is encrypted by using a digital signature, and the signature may be in multiple manners, including but not limited to: asymmetric signature (ie, public key cryptography), message digest, and digital signature method on public key cryptography. Many, such as RSA signature, DSA (Digital signature Algorithm) signature, Elliptic Curve Digital Signature Algorithm (ECDSA) and so on. Taking the RSA signature as an example, in the embodiment of the present application, the server generates a 128-bit hash value from the generated transaction confirmation information by using a digest algorithm, and then uses the RSA algorithm and itself. The private key encrypts the hash value to produce a digest ciphertext, the server's digital signature; subsequently, the encrypted digital signature is attached to the transaction confirmation message and sent to the client along with the transaction confirmation information. .

Certainly, the signature mode/algorithm of the signature module is different. In addition to the RSA algorithm listed above, the encryption algorithm of this embodiment may further include a Data Encryption Standard (DES) and a Triple Data Encryption Standard (Triple Data). Encryption Standard, 3DES), International Data Encryption Algorithm (IDEA), Secure Hash Algorithm1 (Sha1), Sha256, Sha512, Message Digest Algorithm 5 (MD5), An encryption algorithm such as the Advanced Encryption Standard (AES), of course, may also be an encryption algorithm developed by a server-side developer. This embodiment does not limit this, and may be selected according to a specific application environment. The signature method will not be described here.

S03: The client verifies the signature of the transaction confirmation information.

After receiving the signed transaction confirmation information, the client invokes the built-in verification module to verify the signature of the transaction confirmation information by using the verification module. Here, the RSA signature in step S02 is taken as an example. After receiving the transaction confirmation information and its signature, the terminal uses the same digest algorithm to calculate a 128-bit hash value, and uses the RSA algorithm and the public key to decrypt the digital signature attached to the confirmation information. The column value is the same as the 128-bit hash value generated when the server-side signature is generated, and the client can confirm that the transaction confirmation information is indeed from the server side and has not been tampered with. It can be seen that the way of signing and verifying the signature can greatly reduce the risk of the transaction confirmation information being hijacked and tampered with during transmission to the client.

In addition, the signature verification, information display and confirmation process in the Trusted Execution Environment (TEE) can achieve the best implementation results. It can be seen that the signature verification method in this embodiment is particularly applicable to a mobile terminal. Since a mobile client often faces a large amount of micropayment, the required security protection strength is not high, and therefore, in a trusted execution environment (TEE, Trusted) Implementation in Execution Environment) is suitable for the security needs of most applications, and can be authorized Secure software applications are safer to execute.

S04: The client displays the transaction confirmation information, and periodically checks in the background whether the displayed transaction confirmation information has been tampered with.

After the client signature verification is passed, the transaction confirmation information will be displayed to the user through the display module, and the user can read and verify the transaction confirmation information. During this period, the client displays the displayed transaction through the inspection module built in the background. The confirmation information is periodically checked. The frequency of the inspection can be set according to the application environment. In theory, the higher the inspection frequency, the better, which can prevent the attacker from tampering with the transaction confirmation information during the display process, thus misleading. The user performs a confirmation operation.

The check module operates in the background of the client, and the check mode is mainly a screen check, including but not limited to: displaying a text check, displaying an image check, and the like.

For the display text check mode, the check module checks the text content in the displayed confirmation information. Specifically, the checking module can obtain the text content of the currently displayed information, and compare the text content with the original information (ie, the real transaction confirmation information obtained after the client verifies the signature) to determine whether the two are the same. In order to judge whether the display module accurately and truly displays the transaction confirmation information received by the client, if the information found in the inspection process is inconsistent, indicating that the displayed information has been tampered with, the corresponding measures may be taken to remind The user or the direct termination of the transaction continues.

For the display image inspection mode, the inspection module is mainly used to check the image displayed on the screen of the client to determine whether there is a problem such as layer coverage. Specifically, the inspection module will capture the information image displayed on the current screen and automatically identify the text content in the information image, for example, using an Optical Character Recognition (OCR) graphic transformation module to key the image. The information is converted into text content, and then the text content is compared with the transaction confirmation information received by the client to determine whether the two are consistent, and it can be determined whether the screen has a layer overlay currently.

Of course, the method for displaying the image is not limited to the above-mentioned graphic conversion mode, and other methods may be adopted to identify whether layer overlay occurs, for example, capturing the currently displayed information image, and obtaining the currently displayed image from the information image. The properties of the image and determine whether the properties of the currently displayed image are Whether it is the same as the attribute of the preset trusted image, wherein the attribute includes at least one of a resolution of the image, a format of the image, a source of the image, a size of the image, a location where the image is stored, and a creation time of the image. . Of course, the properties of the preset trusted image can come from the image library approved by the client. That is, according to the attributes of the currently displayed image, it is judged whether the image is from the image library recognized by the client, and if some attributes are found to be mismatched, even if the image is sufficiently false, the checking module still considers that the screen has been Overlaid by unknown images from third parties.

S05: The client receives the operation confirmed by the user and feeds it back to the server.

After the client verifies the transaction confirmation information, the user will perform the confirmation operation, and the client transmits the instruction for confirming the operation to the server through the network transmission. After receiving the confirmation instruction, the server will automatically follow the transaction request initiated by the user automatically. The next step is processed. For example, in the transfer transaction of the banking system, after the bank server receives the instruction to confirm the transfer transaction, it will automatically transfer the transfer amount from the user account to the transfer account according to the request in the transfer request.

S06: The server completes the transaction processing and returns the processing result to the client.

After completing the transaction processing, the server returns the processing result to the client to inform the user whether the initial transaction request is processed or not.

In combination with the above steps S01 to S06, the following description is made by taking online shopping as an example to explain how the present application functions to prevent users from losing once the transaction process is attacked.

During online shopping, the user performs a purchase operation on the client (such as a browser, a mobile app, etc.), and after selecting the desired item (such as a pencil worth 10 yuan), the client will display some basic information of the order for the user to confirm. For example: order number, order time, order amount, seller account information, etc.

Then, after the user confirms that the order is correct, the client clicks the order, and the client transmits the order information back to the server. In the process of returning, the attacker will modify the order information in the background and then transmit it to the server, for example, The price of the modified pencil is 20 yuan, the seller account information is modified, and the modification process is carried out in the background. Although the order amount seen by the user is still 10 yuan, the amount of the transaction order actually received by the server is the modified 20 yuan. (Note: The tampering process here occurs on the user side. When the user's computer or mobile phone is attacked, it will be very easy to happen. Due to the user's dispersal, the risk of being tampered with is often difficult. To be controlled)

Subsequently, the server will issue a transaction confirmation message to the client according to the order request of the amount of 20 yuan, and the user confirms the transaction and pays, and in order to prevent the user from perceiving that the amount of 20 yuan in the transaction confirmation information does not match the original order amount, the attacker usually When the transaction confirmation message arrives at the client, the client is displayed for hijacking, in an attempt to make the user see the false transaction confirmation information with the amount still 10 yuan, and prompt click confirmation.

In this case, the method of the present application will be used to monitor the display hijacking in a timely and effective manner. By checking the information displayed on the screen and comparing it with the information sent by the server, the current display can be found. The amount of 10 yuan viewed by the user does not match the amount of 20 yuan sent by the server, thereby judging that display hijacking has occurred. At this point, the user or system can be alerted to automatically close the transaction. Compared with the way of confirming information through third-party channels (for example, using SMS/telephone or application message push to let users confirm the transaction), the technical solution of the present application is more time-efficient and convenient, without using third-party channels and mobile phones. And other extra tools.

In summary, the present application compares the information currently displayed on the screen with the information sent by the server through the screen inspection technology to determine whether the display hijacking has occurred on the screen, thereby greatly improving the security of the transaction and protecting the interests of the user.

Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, system, or computer program product. Thus, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware. Moreover, the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer, an embedded processor or other programmable data processing device to produce a machine such that The instructions executed by the processor of the machine or other programmable data processing device generate means for implementing the functions specified in one or more blocks of the flow or in a block or blocks of the flowchart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory. Memory is an example of a computer readable medium.

Computer readable media includes both permanent and non-persistent, removable and non-removable media. Information storage can be implemented by any method or technology. The information can be computer readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary storage of computer readable media, such as modulated data signals and carrier waves.

It should also be noted that the terms "including", "comprising" or any other variant thereof are intended to cover non- Exclusive inclusion, such that a process, method, commodity, or device that includes a set of elements includes not only those elements, but also other elements not explicitly listed, or is inherent to such process, method, commodity, or equipment. Elements. An element defined by the phrase "comprising a ..." does not exclude the presence of additional equivalent elements in the process, method, item, or device including the element.

Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, system, or computer program product. Thus, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment in combination of software and hardware. Moreover, the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

The above description is only an embodiment of the present application and is not intended to limit the application. Various changes and modifications can be made to the present application by those skilled in the art. Any modifications, equivalents, improvements, etc. made within the spirit and scope of the present application are intended to be included within the scope of the appended claims.

Claims

A method of monitoring display hijacking, characterized by:

Receive information sent by the server and display it;

Get the information of the current display;

Determining whether the currently displayed information is the same as the received information;

If yes, it is determined that it has not been hijacked by the display;

Otherwise, be sure to be hijacked by the show.
The method of claim 1, wherein the obtaining the currently displayed information comprises:

Get the text content of the currently displayed information;

Determine whether the information currently displayed is the same as the information received, including:

It is judged whether the text content of the currently displayed information is the same as the text content of the received information.
The method of claim 1, wherein the obtaining the currently displayed information comprises:

Grab the image of the information currently displayed;

Obtaining text content of the currently displayed information from the information image;

Determine whether the information currently displayed is the same as the information received, including:

It is judged whether the text content of the currently displayed information is the same as the text content of the received information.
The method of claim 3, wherein the text content of the currently displayed information is obtained from the information image, and specifically includes:

The text content of the currently displayed information is obtained from the information image by means of graphic transformation.
The method of claim 1, wherein the obtaining the currently displayed information comprises:

Grab the image of the information currently displayed;

Obtaining an attribute of the currently displayed image from the information image, wherein the attribute includes a map At least one of a resolution of the image, a format of the image, a source of the image, a size of the image, a location where the image is stored, and a creation time of the image;

Determine whether the information currently displayed is the same as the information received, including:

It is judged whether the attribute of the currently displayed image is the same as the attribute of the preset trusted image.
The method according to any one of claims 1 to 5, wherein receiving the information sent by the server and displaying the information comprises:

Receiving information and signatures sent by the server;

Verify the signature;

The received information is displayed when the verification is passed.
A device for monitoring display hijacking, comprising:

a receiving module, configured to receive information sent by the server;

a display module for displaying the received information; and

The checking module is configured to check whether the information currently displayed by the display module is the same as the information received by the receiving module.
The device according to claim 7, wherein the inspection module is provided with a text checking unit for acquiring text content in the currently displayed information, and determining the text content and the information received by the receiving module. Whether the text content is the same.
The device according to claim 7, wherein the inspection module is provided with an image checking unit for capturing the currently displayed information image, and determining that the text content contained in the image is received by the receiving module. The text content of the message is the same.
The device according to claim 7, wherein the inspection module is provided with an image checking unit for capturing the currently displayed information image, and acquiring the attribute of the currently displayed image from the information image. And determining whether the attribute is the same as the attribute of the preset trusted image, the attribute including at least the resolution of the image, the format of the image, the source of the image, the size of the image, the location where the image is stored, and the creation time of the image. One.