Restricting access to application programming interfaces (APIs)
Examples of the present disclosure describe systems and methods for restricting access to application programming interfaces (APIs). For example, when a process calls an API, the API call may be intercepted by a security system for evaluation of its trustfulness before the API is allowed to run. Upon intercepting an API call, the process calling the API may be evaluated to determine if the process is known to the security system, such that known processes that are untrusted may be blocked from calling the API. Further, when the security system cannot identify the process calling the API, the security service may evaluate a call stack associated with the call operation to determine if attributes of the call operation are known to the security system. If the call operation is known to the security system as untrusted, the call operation may be blocked from calling the API.
1. A system comprising:
at least one processor; and
memory storing instructions that, when executed by the at least one processor, causes the system to perform a set of operation, the set of operations comprising:
monitoring at least one application programming interface (API) associated with performing one or more file finding functions;
intercepting a call operation directed to the at least one API, wherein the call operation is associated with a process attempting to perform at least one of the one or more file finding functions;
determining a trust level for the process; wherein determining the trust level for the process comprises:
accessing a process data store to compare one or more attributes of the process to information for a set of known processes to determine whether the process is an unknown process;
accessing a call operation data store to compare one or more attributes of the call operation to information for a set of known call operation attributes to determine whether the call operation is untrusted; and
determining the trust level for the process based at least in part on the determination whether the process is an unknown process and the determination whether the call operation is untrusted;
evaluating the determined trust level to determine whether the process is trusted or untrusted;
based on determining the process is untrusted, presenting a prompt to a user to allow the call operation;
responsive to a user indication to allow the call operation, allowing the call operation; and
based on determining the process is untrusted and absent a user indication to allow the call operation, blocking the call operation directed to the at least one API from performing the at least one of the one or more file finding functions.
2. The system of claim 1 , wherein the set of operations further comprises:
in response to receiving a user indication at the displayed prompt to allow the call operation, adding the process to a set of known processes in a process data store.
3. The system of claim 1 , wherein the set of operations further comprises:
in response to receiving a user indication at the displayed prompt to deny the call operation, terminating the process.
4. The system of claim 1 , wherein the prompt includes information relating to the at least one of the one or more file finding functions of the API.
5. The system of claim 1 , wherein intercepting the call operation comprises analyzing a call stack associated with the process for an operation having a wildcard character.
6. A method of restricting use of an application programming interface (API) associated with performing one or more file finding functions, the method comprising:
receiving a call operation directed to an API associated with performing one or more file finding functions, wherein the call operation is associated with a process;
performing an evaluation of the process based on the call operation, wherein the evaluation comprises at least one of:
comparing one or more attributes of the process to a set of known processes; and
comparing one or more attributes of the call operation to a set of known call operations;
determining, based at least in part on the evaluation, a trust level for the process, wherein determining the trust level for the process comprises:
accessing a process data store to compare one or more attributes of the process to information for a set of known processes to determine whether the process is an unknown process;
accessing a call operation data store to compare one or more attributes of the call operation to information for a set of known call operation attributes to determine whether the call operation is untrusted; and
determining the trust level for the process based at least in part on the determination whether the process is an unknown process and the determination whether the call operation is untrusted;
evaluating the determined trust level to determine whether the process is trusted or untrusted;
based on determining the process is untrusted, presenting a prompt to a user to allow the call operation;
responsive to a user indication to allow the call operation, allowing the call operation; and
based on determining that the process is untrusted and absent a user indication to allow the call operation, blocking the call operation directed to the API from performing at least one of the one or more file finding functions.
7. The method of claim 6 , wherein, in response to allowing the call operation based on a user indication to allow the call operation, the method further comprises at least one action selected from the group consisting of:
allowing the call operation and adding the process to the set of known processes; and
allowing the call operation only once.
8. The method of claim 6 , wherein, in response to blocking the call operation, the method further comprises:
capturing information associated with the process; and
reporting the process back to a security service.
9. The method of claim 6 , wherein the API is associated with a user-mode of the operating system.
10. A method of restricting use of at least one application programming interface (API), the method comprising:
monitoring at least one API associated with performing one or more file finding functions;
intercepting a call operation directed to the at least one API, wherein the call operation is associated with a process attempting to perform at least one of the one or more file finding functions;
determining a trust level for the process, wherein determining the trust level for the process comprises:
accessing a process data store to compare one or more attributes of the process to information for a set of known processes to determine whether the process is an unknown process;
accessing a call operation process data store to compare one or more attributes of the call operation to information for a set of known call operation attributes to determine whether the call operation is untrusted; and
determining the trust level for the process based at least in part on the determination whether the process is an unknown process and the determination whether the call operation is untrusted;
evaluating the determined trust level to determine whether the process is trusted or untrusted;
based on determining the process is untrusted, presenting a prompt to a user to allow the call operation;
responsive to a user indication to allow the call operation, allowing the call operation; and
based on determining the process is untrusted and absent a user indication to allow the call operation, blocking the call operation directed to the at least one API from performing the at least one of the one or more file finding functions.
11. The method of claim 10 , wherein the method further comprises:
in response to receiving a user indication at the displayed prompt to allow the call operation, adding the process to a set of known processes in a process data store.
12. The method of claim 10 , wherein the method further comprises:
in response to receiving a user indication at the displayed prompt to deny the call operation, terminating the process.
13. The method of claim 10 , wherein the prompt includes information relating to the at least one of the one or more file finding functions of the API.
14. The method of claim 10 , wherein intercepting the call operation comprises analyzing a call stack associated with the process for an operation having a wildcard character.