Generic privilege escalation prevention
View Patent ↗An apparatus, method, computer readable storage medium are provided in one or more examples and comprise accessing an application, identifying an access token of the application, determining if the access token is a system token, and responsive to the access token failing to be a system token, enabling a runtime module.
1. At least one non-transitory computer readable storage medium that includes code for execution, that when executed, causes at least one processor to:
identify an execution of a hook of an application programming interface (API), wherein the execution of the hook is caused, at least in part, by an application;
responsive to the execution of the hook, determine whether a runtime module is enabled, wherein the runtime module determines whether a thread of the application made an API call;
responsive to determining that the runtime module is enabled, determine whether the application has a system token; and
terminate at least the thread of the application based on determining that the runtime module is enabled and the application has the system token.
2. The at least one non-transitory computer readable storage medium of claim 1 , wherein the application programming interface (API) is to perform one of examining a user privilege of a current process, loading a dynamic link library (DLL), creating a new process, or injecting to other processes.
3. The at least one non-transitory computer readable storage medium of claim 1 , wherein when executed, the code causes the at least one processor to:
access the application to identify an access token;
determine, prior to the execution of the hook, whether the access token is a system token; and
responsive to a determination that the access token is not a system token, enable the runtime module.
4. The at least one non-transitory computer readable storage medium of claim 3 , wherein the application is accessed during an execution of the application or during a startup of a computing device that includes the at least one processor.
5. The at least one non-transitory computer readable storage medium of claim 1 , wherein the application is a web browser.
6. The at least one non-transitory computer readable storage medium of claim 1 , wherein the hook is one of a plurality of hooks in a plurality of application programming interface (API) locations of corresponding APIs, wherein the plurality of API locations are selected based on a frequency of use of the corresponding APIs by exploits.
7. The at least one non-transitory computer readable storage medium of claim 6 , wherein the plurality of hooks are added to the plurality of API locations before runtime.
8. The at least one non-transitory computer readable storage medium of claim 1 , wherein the thread is identified for termination based on being the thread that called the API.
9. An apparatus, comprising:
a memory element coupled to a processor; and
a protection module including a set of executable instructions stored in the memory element, wherein the executable instructions, when executed by the processor, are to
identify an execution of a hook of an application programming interface (API), wherein the execution of the hook is caused, at least in part, by an application;
responsive to the execution of the hook, determine whether a runtime module is enabled, wherein the runtime module determines whether a thread of the application made an API call;
responsive to determining that the runtime module is enabled, determine whether the application has a system token; and
terminate at least the thread of the application based on determining that the runtime module is enabled and the application has the system token.
10. The apparatus of claim 9 , wherein the application programming interface (API) is to perform one of examining a user privilege of a current process, loading a dynamic link library (DLL), creating a new process, or injecting to other processes.
11. The apparatus of claim 9 , wherein the executable instructions, when executed by the processor, are to:
access the application to identify an access token;
determine, prior to the execution of the hook, whether the access token is a system token; and
responsive to a determination that the access token is not a system token, enable the runtime module.
12. The apparatus of claim 11 , wherein the application is accessed during an execution of the application or during a startup of the apparatus.
13. The apparatus of claim 9 , wherein the hook is one of a plurality of hooks in a plurality of application programming interface (API) locations of corresponding APIs, wherein the plurality of API locations are selected based on a frequency of use of the corresponding APIs by exploits.
14. The apparatus of claim 13 , wherein the plurality of hooks are added to the plurality of API locations before runtime.
15. The apparatus of claim 9 , wherein the thread is identified for termination based on being the thread that called the API.
16. A method, comprising:
identifying an execution of a hook of an application programming interface (API), wherein the execution of the hook is caused, at least in part, by an application;
responsive to the execution of the hook, determining whether a runtime module is enabled, wherein the runtime module determines whether a thread of the application made an API call;
responsive to determining that the runtime module is enabled, determining whether the application has a system token; and
allowing the application to execute based on determining that the runtime module is enabled and the application does not have the system token.
17. The method of claim 16 , further comprising:
accessing the application to identify an access token;
determining, prior to the execution of the hook, whether the access token is a system token; and
responsive to a determination that the access token is not a system token, enabling the runtime module.
18. The method of claim 16 , wherein the application is a web browser.
19. At least one non-transitory computer readable storage medium that includes code for execution, that when executed, causes at least one processor to:
identify an access token of an application;
determine, prior to an execution of a hook of an application programming interface (API), whether the access token is a system token;
responsive to a determination that the access token is the system token, disable a runtime module, wherein the runtime module determines whether a thread of the application made an API call;
identify the execution of the hook of the API, wherein the execution of the hook is caused, at least in part, by the application;
responsive to the execution of the hook, determine whether the runtime module is enabled; and
allow the application to execute based on determining that the runtime module is disabled.
20. The at least one non-transitory computer readable storage medium of claim 19 , wherein the execution of the hook is identified based, at least in part, on receiving a notification that the API was called by the thread of the application.