GENERIC PRIVILEGE ESCALATION PREVENTION

• US 20140351930A1
• Filed: 03/15/2013
• Published: 11/27/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Hetzler, Jeff, Bu, Zheng, Sun, Bing, Xu, Chong
• Granted Patent: US 9,197,660 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

An apparatus, method, computer readable storage medium are provided in one or more examples and comprise accessing an application, identifying an access token of the application, determining if the access token is a system token, and responsive to the access token failing to be a system token, enabling a runtime module.

Claims

1-25. -25. (canceled)

26. An apparatus for managing an application, comprising:

a protection module, wherein the protection module is configured to;

identify an access token of the application;

determine if the access token is a system token; and

responsive to the access token failing to be a system token, enable a runtime module.

27. The apparatus of claim 26, wherein the protection module is further configured to:

determine whether the application is a protected application and responsive to the application being a protected application, access the application.

28. The apparatus of claim 26, wherein the protection module is further configured to:

responsive to the access token being a system token, disable a runtime module.

29. The apparatus of claim 26, wherein the protection module is further configured to:

monitor a plurality of API locations with a plurality of hooks;

identify an execution of a hook of the plurality of hooks; and

responsive to the execution of the hook, determine whether the runtime module is enabled.

30. The apparatus of claim 29, wherein the protection module is further configured to:

responsive to the runtime module being enabled, protect the application.

31. The apparatus of claim 29, wherein the apparatus further comprises:

the runtime module coupled to the processing element, wherein the runtime module is configured to determine whether the application has the system token; and

responsive to the application having the system token, terminate the application.

32. The apparatus of claim 29, wherein the protection module is further configured to:

responsive to the runtime module being disabled, allow the application to execute.

33. The apparatus of claim 31, wherein the runtime module is further configured to:

responsive to the application failing to have the system token, allow the application to execute.

34. The apparatus of claim 26, further comprising:

a processing element coupled to the protection module; and

a memory element coupled to the processing element.

35. At least one computer readable storage medium that includes code for execution for managing an application, and when executed by a processing element is operable to:

identify an access token of the application;

determine if the access token is a system token; and

responsive to the access token failing to be a system token, enable a runtime module.

36. The at least one computer readable storage medium of claim 35, wherein the code includes further code for execution and when executed by the processing element is operable to:

determine whether the application is a protected application; and

responsive to the application being a protected application, access the application.

37. The at least one computer readable storage medium of claim 35, wherein the code includes further code for execution and when executed by the processing element is operable to:

responsive to the access token being a system token, disable a runtime module.

38. The at least one computer readable storage medium of claim 35, wherein the code further includes code for execution and when executed by the processing element is operable to:

monitor a number of API locations for a plurality of hooks;

identify an execution of a hook of the plurality of hooks; and

responsive to the execution of the hook, determine whether the runtime module is enabled.

39. The at least one computer readable storage medium of claim 38, wherein the code includes further code for execution and when executed by the processing element is operable to:

responsive to the runtime module being enabled, protect the application.

40. The at least one computer readable storage medium of claim 39, wherein the code further includes code for execution and when executed by the processing element is operable to:

determine whether the application has the system token; and

responsive to the application having the system token, terminate the application.

41. The at least one computer readable storage medium of claim 38, wherein the code further includes code for execution and when executed by the processing element is operable to:

responsive to the runtime module being disabled, allow the application to execute.

42. The at least one computer readable storage medium of claim 40, wherein the code further includes code for execution and when executed by the processing element is operable to:

responsive to the application failing to have the system token, allow the application to execute.

43. A method for managing an application, comprising:

identifying an access token of the application;

determining if the access token is a system token; and

responsive to the access token failing to be a system token, enabling a runtime module.

44. The method of claim 43, further comprising:

determining whether the application is a protected application; and

responsive to the application being a protected application, accessing the application.

45. The method of claim 43, further comprising:

responsive to the access token being a system token, disabling a runtime module.

46. The method of claim 43, further comprising:

monitoring a number of API locations for a plurality of hooks;

identifying an execution of a hook of the plurality of hooks; and

responsive to the execution of the hook, determining whether the runtime module is enabled.

47. The method of claim 46, further comprising:

responsive to the runtime module being enabled, protecting the application.

48. The method of claim 47, wherein the protecting the application comprises:

determining whether the application has the system token; and

responsive to the application having the system token, terminating the application.

49. The method of claim 46, further comprising:

responsive to the runtime module being disabled, allowing the application to execute.

50. An apparatus, comprising:

a protection module coupled to a processing element, the processing element coupled to a memory element, wherein the protection module is configured to;

add a plurality of hooks into a plurality of API locations;

monitor the plurality of hooks;

identify an execution of a hook of the plurality of hooks;

determine whether the runtime module is enabled; and

responsive to the runtime module being enabled, protect the application.

51. The apparatus of claim 50, wherein the apparatus further comprises:

the runtime module coupled to the processing element, wherein the runtime module is configured to;

determine whether the application has the system token; and

responsive to the application having the system token, terminate the application.

52. The apparatus of claim 50, wherein the protection module is further configured to:

responsive to the runtime module being disabled, allow the application to execute.