US 11,853,423 B2
Methods and apparatus for interfering with malware using displaced display elements
David K. Ford, Los Gatos, CA (US)
Assigned to SUNSTONE INFORMATION DEFENSE, INC., Jamestown, OH (US)
Appl. No. 16/963,226
Filed by SunStone Information Defense, Inc., Los Gatos, CA (US)
PCT Filed Jan. 22, 2019, PCT No. PCT/US2019/014495
§ 371(c)(1), (2) Date Jul. 18, 2020,
PCT Pub. No. WO2019/144101, PCT Pub. Date Jul. 25, 2019.
Claims priority of provisional application 62/619,690, filed on Jan. 19, 2018.
Prior Publication US 2021/0382994 A1, Dec. 9, 2021
Int. Cl. G06F 21/56 (2013.01); G06F 9/451 (2018.01)
CPC G06F 21/566 (2013.01) [G06F 9/451 (2018.02); G06F 2221/033 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A machine-accessible device having instructions stored thereon that, when executed, cause a machine to at least:
receive application code for displaying an application within an application viewer, the application code including an element for display at a first element location, the element associated with a function that is executed after a pointer selection at the first element location;
determine a first offset vector for the element and a second offset vector for a pointer, the second offset vector having a same magnitude but an opposite direction of the first offset vector;
change the application code such that the function is executed after a pointer selection at a second element location that is the first offset vector away from the first element location;
at least one of i) change a location of a pointer within a pixel area of a pointer file from a first pointer location to a second pointer location that is the second offset vector away from the first pointer location while leaving coordinates of a pointer hot spot unchanged, or ii) hide the pointer from view by modifying the pointer file and create a pointer image for the application that is configured to track movement of the hidden pointer that is the second offset vector away from the first pointer location;
cause the changed application code to be displayed within the application viewer with the element located at the first element location and the function located at the second element location;
cause the pointer or the pointer image to be displayed based on at least one of the changed pointer file or the pointer image;
receive coordinates associated with a pointer selection at the pointer hot spot; and
responsive to determining that the received coordinates correspond to the second element location, transmit an indication of the pointer selection being valid.