Systems and methods for preventing malicious applications from exploiting application services

Patent metadata

Field	Value
Publication number	US-2019065736-A1
Application number	US-201715688911-A
Country	US
Kind code	A1
Filing date	Aug 29, 2017
Priority date	Aug 29, 2017
Publication date	Feb 28, 2019
Grant date	—

Abstract

The disclosed computer-implemented method for preventing malicious applications from exploiting application services may include (i) identifying an attempt by an application, executing within a sandboxed environment that isolates the application's data and code execution from at least one other application executing within an operating system on the computing device, to launch at least one application service, (ii) determining that the application represents a potential security risk, (iii) prompting a user of the computing device to remediate the potential security risk posed by the application by performing a recommended security action, and (iv) while waiting for the user to perform the recommended security action, securing the computing device by blocking the attempt by the application to launch the application service. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1 . A computer-implemented method for preventing malicious applications from exploiting application services, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying an attempt by an application, executing within a sandboxed environment that isolates the application's data and code execution from at least one other application executing within an operating system on the computing device, to launch at least one application service; determining that the application represents a potential security risk; prompting a user of the computing device to remediate the potential security risk posed by the application by performing a recommended security action; and while waiting for the user to perform the recommended security action, securing the computing device by blocking the attempt by the application to launch the application service.

2 . The computer-implemented method of claim 1 , wherein the operating system sandboxes all applications executing within the operating system by isolating each application's data and code execution from all other applications executing within the operating system.

3 . The computer-implemented method of claim 1 , wherein the sandboxed environment prevents security software executing within the operating system from at least one of:
automatically quarantining the application; and automatically uninstalling the application.

4 . The computer-implemented method of claim 1 , wherein the attempt to launch the application service comprises an attempt to at least one of:
capture sensitive information; transmit sensitive information; access a malicious resource; modify user data; generate a user prompt requesting elevated privileges; and generate an advertisement.

5 . The computer-implemented method of claim 1 , wherein the recommended security action comprises a computing operation that security software installed on the computing device is unable to perform by itself due to the sandboxed environment.

6 . The computer-implemented method of claim 1 , wherein prompting the user to remediate the potential security risk posed by the application comprises prompting the user to at least one of:
terminate the application; and uninstall the application.

7 . The computer-implemented method of claim 1 , wherein blocking the attempt by the application to launch the application service comprises at least one of:
preventing the application from launching the application service; and automatically terminating the application service after the application has launched the application service.

8 . The computer-implemented method of claim 7 , further comprising, if the application service cannot be automatically terminated, prompting the user to manually terminate the application that launched the application service.

9 . The computer-implemented method of claim 8 , wherein prompting the user to manually terminate the application that launched the application service comprises periodically prompting the user to terminate the application until detecting that the user has successfully terminated the application.

10 . A system for preventing malicious applications from exploiting application services, the system comprising:
an identification module, stored in a memory device, that identifies an attempt by an application, executing within a sandboxed environment that isolates the application's data and code execution from at least one other application executing within an operating system on the system, to launch at least one application service; a determination module, stored in the memory device, that determines that the application represents a potential security risk; a notification module, stored in the memory device, that prompts a user of the system to remediate the potential security risk posed by the application by performing a recommended security action; a security module that, while waiting for the user to perform the recommended security action, secures the system by blocking the attempt by the application to launch the application service; and at least one physical processor that executes the identification module, the determination module, the notification module, and the security module.

11 . The system of claim 10 , wherein the operating system sandboxes all applications executing within the operating system by isolating each application's data and code execution from all other applications executing within the operating system.

12 . The system of claim 10 , wherein the sandboxed environment prevents security software executing within the operating system from at least one of:
automatically quarantining the application; and automatically uninstalling the application.

13 . The system of claim 10 , wherein the attempt to launch the application service comprises an attempt to at least one of:
capture sensitive information; transmit sensitive information; access a malicious resource; modify user data; generate a user prompt requesting elevated privileges; and generate an advertisement.

14 . The system of claim 10 , wherein the recommended security action comprises a computing operation that security software installed on the system is unable to perform by itself due to the sandboxed environment.

15 . The system of claim 10 , wherein the notification module prompts the user to remediate the potential security risk posed by the application by prompting the user to at least one of:
terminate the application; and uninstall the application.

16 . The system of claim 10 wherein the security module blocks the attempt by the application to launch the application service by at least one of:
preventing the application from launching the application service; and
automatically terminating the application service after the application has launched the application service.

17 . The system of claim 16 , wherein the notification module prompts the user to manually terminate the application that launched the application service if the security module cannot automatically terminate the application service.

18 . The system of claim 17 , wherein the notification module prompts the user to manually terminate the application that launched the application service by periodically prompting the user to terminate the application until detecting that the user has successfully terminated the application.

19 . A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
identify an attempt by an application, executing within a sandboxed environment that isolates the application's data and code execution from at least one other application executing within an operating system on the computing device, to launch at least one application service; determine that the application represents a potential security risk; prompt a user of the computing device to remediate the potential security risk posed by the application by performing a recommended security action; and while waiting for the user to perform the recommended security action, secure the computing device by blocking the attempt by the application to launch the application service.

20 . The non-transitory computer-readable medium of claim 19 , wherein the sandboxed environment prevents security software executing within the operating system from at leas

Assignees

• Symantec Corp

Inventors

• Dharmadhikari Mayur
• Meel Pankaj
• Joshi Nikhil

Classifications

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title