Securely and efficiently providing user notifications about security actions
A security agent executing in kernel mode may receive a request from the anti-malware component executing with low privileges in user mode, and, in response, the security agent may perform a security action with respect to a malicious file detected on the computing device. The security agent may then assist the anti-malware component in providing a user notification about the security action by obtaining, on behalf of the anti-malware component, a user token associated with the user session in which the malicious file was detected. The anti-malware component can use the obtained user token to request a pointer to a Component Object Model (COM) interface for outputting the notification in context of the appropriate user session, which allows for securely and efficiently providing the user notification.
1. A method comprising:
performing, by a software security agent executing in kernel mode of a computing device, a security action with respect to a malicious data object or a malicious activity detected on the computing device;
providing, by the software security agent, to one or more user mode components, a token associated with a user session in which the malicious data object or the malicious activity was detected;
receiving, by the one or more user mode components, based at least in part on the token, a pointer to one or more Component Object Model (COM) interfaces; and
outputting, via an output device of the computing device, and using the pointer to the one or more COM interfaces, a notification to indicate that the security action was performed.
2. The method of claim 1 , further comprising, prior to the providing of the token to the one or more user mode components:
determining, by the software security agent, a user account name or identifier (ID);
calling, by the software security agent, an authentication function using the user account name or ID; and
receiving, by the software security agent, the token returned by the authentication function.
3. The method of claim 1 , wherein the notification is output in context of the user session.
4. The method of claim 1 , wherein the outputting comprises calling a method of the one or more COM interfaces.
5. The method of claim 1 , further comprising requesting, by the one or more user mode components, the pointer to the one or more COM interfaces using, by the one or more user mode components, a moniker that specifies a session identifier (ID) of the user session.
6. The method of claim 1 , wherein the malicious data object comprises a malicious file, or wherein the malicious activity is performed based on data contained within a file.
7. The method of claim 1 , wherein the output device comprises at least one of a display or a speaker.
8. A computing device comprising:
an output device;
a processor; and
memory storing computer-executable instructions that, when executed by the processor, cause the processor to:
execute a software security agent in kernel mode of the computing device to:
perform a security action with respect to a malicious data object or a malicious activity detected on the computing device; and
provide a token to one or more user mode components, the token associated with a user session in which the malicious data object or the malicious activity was detected;
execute the one or more user mode components to receive, based at least in part on the token, a pointer to one or more Component Object Model (COM) interfaces; and
output a notification via the output device and using the pointer to the one or more COM interfaces, the notification indicating that the security action was performed.
9. The computing device of claim 8 , wherein the computer-executable instructions, when executed by the processor, further cause the processor to execute the one or more user mode components to request the pointer to the one or more COM interfaces using a moniker that specifies a session identifier (ID) of the user session.
10. The computing device of claim 8 , wherein the computer-executable instructions, when executed by the processor, further cause the processor to execute the software security agent to:
determine a user account name or identifier (ID);
call an authentication function using the user account name or ID; and
receive the token returned by the authentication function.
11. The computing device of claim 8 , wherein the notification is output in context of the user session.
12. The computing device of claim 8 , wherein the malicious data object comprises a malicious file, or wherein the malicious activity is performed based on data contained within a file.
13. The computing device of claim 8 , wherein the output device comprises at least one of a display or a speaker.
14. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by one or more processors of a computing device, cause the computing device to:
execute a software security agent in kernel mode of the computing device to:
perform a security action with respect to a malicious data object or a malicious activity detected on the computing device; and
provide a token to one or more user mode components, the token associated with a user session in which the malicious data object or the malicious activity was detected;
execute the one or more user mode components to receive, based at least in part on the token, a pointer to one or more Component Object Model (COM) interfaces; and
output a notification via an output device of the computing device and using the pointer to the one or more COM interfaces, the notification indicating that the security action was performed.
15. The non-transitory computer-readable medium of claim 14 , wherein the computer-executable instructions, when executed by the one or more processors, further cause the computing device to execute the software security agent to:
determine a user account name or identifier (ID) of a user who is currently logged into the user session; and
obtain the token based at least in part on the user account name or ID.
16. The non-transitory computer-readable medium of claim 14 , wherein the computer-executable instructions, when executed by the one or more processors, further cause the computing device to execute the one or more user mode components to request the pointer to the one or more COM interfaces using a moniker that specifies a session identifier (ID) of the user session.
17. The non-transitory computer-readable medium of claim 14 , wherein outputting the notification comprises calling a method of the one or more COM interfaces.
18. The non-transitory computer-readable medium of claim 14 , wherein the notification is output in context of the user session.
19. The non-transitory computer-readable medium of claim 14 , wherein the computer-executable instructions, when executed by the one or more processors, further cause the computing device to execute the software security agent to:
determine a user account name or identifier (ID);
call an authentication function using the user account name or ID; and
receive the token returned by the authentication function.
20. The non-transitory computer-readable medium of claim 14 , wherein the malicious data object comprises a malicious file, or wherein the malicious activity is performed based on data contained within a file.