Object inspection via operating system share function
A computing apparatus includes a hardware platform having a processor and a memory; an operating system (OS) having a GUI with a user-initiatable share function, and an interface to register a share target for the share function; and instructions encoded within the memory to provide a security agent, the instructions to instruct the processor to: receive from the OS a notification that an object has been shared to the security agent via the share function; responsive to the notification, initiate a security scan or reputation action for the shared object; receive a security or reputation response from the security scan or reputation action; and based at least in part on the security scan or reputation response, display a security or reputation notification via the GUI.
1. A computing apparatus, comprising:
a hardware platform comprising a processor and a memory;
an operating system (OS) comprising a graphical user interface (GUI) with a share function comprising a context menu labeled substantially “Share” or “Send to”, and an interface to register a share target for the share function; and
instructions encoded within the memory to provide a security agent, the instructions to instruct the processor to:
register the security agent as a share target for the share function;
receive from the OS a notification that a user shared an executable object via the share function with the security agent as the share target;
responsive to the notification, initiate a security scan or reputation action for the executable object;
receive a security or reputation response from the security scan or reputation action; and
based at least in part on the security scan or reputation response, display a security or reputation notification via the GUI.
2. The computing apparatus of claim 1 , wherein the OS is a Microsoft Windows OS, a Macintosh OSX, an iOS, an Android OS, a Linux OS, or a UNIX-based OS.
3. The computing apparatus of claim 1 , wherein the share function is a “send to” function.
4. The computing apparatus of claim 1 , wherein the security agent comprises instructions to analyze the executable object locally.
5. The computing apparatus of claim 1 , wherein the security agent comprises instructions to query a cloud service for security or reputation information about the executable object.
6. The computing apparatus of claim 1 , wherein the executable object is an application, website, URL, file, browser extension, browser add-on, contact, email, online media file, or object scannable by a security agent.
7. The computing apparatus of claim 1 , wherein the share function is a built-in share function of the OS.
8. The computing apparatus of claim 1 , wherein the instructions are further to take a remedial action based at least in part on the security or reputation response.
9. The computing apparatus of claim 1 , wherein the security or reputation response includes a reputation for at least one of maliciousness, data security, data privacy, phishing, adware, malware, or utility.
10. One or more tangible, nontransitory computer-readable storage media having stored thereon executable instructions to:
register a security agent as a share target for a share function of an operating system (OS), wherein the share function comprises a context menu item labeled substantially “Share” or “Send to,” and wherein the OS provides a shared object-to-target infrastructure;
receive a notification that an executable object has been shared via the share function;
responsive to the notification, initiate a security or reputation transaction for the executable object;
receive a security or reputation result from the security or reputation transaction; and
display the security or reputation result to an end user via a graphical user interface (GUI) of the OS.
11. The one or more tangible, nontransitory computer-readable media of claim 10 , wherein the share function has a “send to” label.
12. The one or more tangible, nontransitory computer-readable media of claim 10 , wherein the instructions are to query a cloud service for security or reputation information about the executable object.
13. The one or more tangible, nontransitory computer-readable media of claim 10 , wherein the share function is a built-in share function of the OS.
14. The one or more tangible, nontransitory computer-readable media of claim 10 , wherein the instructions are further to take a remedial action based at least in part on the security or reputation response.
15. A computer-implemented method, comprising:
registering a security agent program as a user-selectable share target for a share function of an operating system (OS), wherein the share function comprises a context menu item labeled substantially “Share” or “Send to”;
receiving from the OS a notification that a user shared an executable object via the share function with the security agent program a share target;
responsive to the notification, requesting a reputation for the executable object;
receiving a reputation for the executable object; and
based at least in part on the reputation, notifying an end user of the reputation and/or taking a remedial action.
16. The method of claim 15 , further comprising analyzing the executable object locally.
17. The method of claim 15 , further comprising querying a cloud service for security or reputation information about the executable object.