Tricks To Bypass Device Control Protection Solutions

Posted by iNoticiero on viernes, 28 de agosto de 2020 0

Preface

As I wrote in a previous blog post, I had an engagement last year where my task was to exfiltrate data from a workstation on some sort of storage media. The twist in that task was Lumension Sanctuary Device Control, and the version was 4.3.2, but I am not sure how newer version work and this seems to be a more general problem with device control solution, for example with Symantec products.

But what is a device control solution? In short, they audit I/O device use and block the attempts to use unauthorized devices. This includes hardware such as USB, PS/2, FireWire, CD/DVD so basically every I/O port of a computer. In my opinion, these are pretty good things and they offer a better looking solution than de-soldering the I/O ports from the motherboards or hot-gluing them, but on the other hand, they can be bypassed.

Bypass

OK, so what is the problem? Well the way these device control solutions work is that they load a few kernel drivers to monitor the physical ports of the machine. However... when you boot up the protected computer in safe mode, depending on the device control solution software, some of these drivers are not loaded (or if you are lucky, none of those modules will be loaded...) and this opens up the possibility to exfiltrate data.

In theory, if you have admin (SYSTEM maybe?) privileges, you might as well try to unload the kernel drivers. Just do not forget, that these device control solutions also have a watchdog process, that checks the driver and automatically loads it back if it is unloaded, so look for that process and stop or suspend it first.

In my case with the Lumension Sanctuary Device Control, I have found that when I boot the Workstation protected by the device control software in Safe Mode where, software's key logger protection module is not running... so I was still unable to use a USB stick, or a storage media, but I could plug in a keyboard for example...hmmm :)

As some of you probably already figured it out, now it is possible to use a pre-programmed USB HID, for example a Teensy! : ) I know about three different project, that uses this trick like these two mentioned in a Hackaday post, or this one. Unfortunately, the site ob-security.info no longer seems to be available (well, at least it is no longer related to infosec :D ), but you can still find the blog post and the files with the Wayback Machine.

For the hardware part, the wiring of the Teensy and the SD card adaptor is the same as I showed in the post on Making a USB flash drive HW Trojan or in the Binary deployment with VBScript, PowerShell or .Net csc.exe compiler post, so I will not copy it here again.

I have to note here that there are other ways to bypass these device control solutions, like the method what Dr. Phil Polstra did with the USB Impersonator, which is basically looks for an authorized device VID/PID and then  impersonates that devices with the VID/PID.

Mitigation

Most probably, you will not need safe mode for the users, so you can just disable it... I mean, it is not that easy, but luckily there is a great blog post on how to do that. BTW, the first page of the post is for Windows XP, but you are not using XP anymore, aren't you? ;)

Alternatively, as I mentioned at the beginning, you might as well use some physical countermeasure (de-soldering/hot-gluing ports). That shit is ugly, but it kinda works.

Conclusion

Next time you will face a device control solution, try out these tricks, maybe they will work, and if they do, well, that's a lot of fun. :)

But don't get me wrong, these device control solutions and similar countermeasures are a good thing and you should use something like this! I know that they make doing business a bit harder as you are not able to plugin whatever USB stick you want, but if you buy a pile of hardware encrypted flash drives, and only allow  those to be plugged in, you are doing it right ;)

Related news

1. Growth Hacker Tools
2. Pentest Tools Nmap
3. Hacking Tools
4. Hackers Toolbox
5. What Are Hacking Tools
6. Pentest Tools Find Subdomains
7. Hacking Tools Online
8. Github Hacking Tools
9. Best Hacking Tools 2019
10. World No 1 Hacker Software
11. Hacker Tools Software
12. Hack And Tools
13. Pentest Tools List
14. Hacking Tools For Games
15. Pentest Tools Tcp Port Scanner
16. Blackhat Hacker Tools
17. What Is Hacking Tools
18. Hacks And Tools
19. Hacker Tools
20. Pentest Tools Online
21. Pentest Automation Tools
22. Hacking App
23. Github Hacking Tools
24. Pentest Tools Website Vulnerability
25. Hack Tools For Mac
26. Hacker Hardware Tools
27. Hacker Techniques Tools And Incident Handling
28. Hacker Tools Apk Download
29. Pentest Tools Tcp Port Scanner
30. Pentest Recon Tools
31. Hack Tools For Pc
32. Hacking Tools Github
33. Hackers Toolbox
34. Hack Tools Download
35. What Is Hacking Tools
36. Pentest Tools Online
37. Install Pentest Tools Ubuntu
38. Pentest Tools Framework
39. Nsa Hack Tools
40. Hacking Tools
41. Pentest Tools Linux
42. Hacker Tools For Ios
43. Pentest Tools List
44. How To Install Pentest Tools In Ubuntu
45. Pentest Tools Windows
46. Wifi Hacker Tools For Windows
47. Hacker Tools Online
48. Hacking Apps
49. Hack Tools For Pc
50. Top Pentest Tools
51. Pentest Tools Linux
52. Hacker Tools Github
53. Pentest Tools Linux
54. Hacker Tools Apk Download
55. Usb Pentest Tools
56. Pentest Tools List
57. Bluetooth Hacking Tools Kali
58. Android Hack Tools Github
59. Hack Tools Github
60. Hack Tools For Ubuntu
61. Hacking Tools Hardware
62. Hacker Tools Hardware
63. Hack Tool Apk
64. Wifi Hacker Tools For Windows
65. Hacker Security Tools
66. Pentest Tools Nmap
67. Hack Tools
68. Hacker
69. Hacker Techniques Tools And Incident Handling
70. Hacker Tools
71. Hacker Tools Free
72. Hackrf Tools
73. Pentest Tools Github
74. Hacker Tools Online
75. Hack Tools Download
76. Hacking Tools For Windows Free Download
77. Hacker Security Tools
78. Hacker Tools List
79. Pentest Tools For Ubuntu
80. Hack Tools For Ubuntu
81. Hacking Tools For Mac
82. Hacker Tools Linux
83. Pentest Tools For Windows
84. Pentest Tools Tcp Port Scanner
85. Hacker Tools List
86. Hacking Tools 2019
87. Hacks And Tools
88. Hack Tools For Windows
89. Pentest Box Tools Download
90. Hacker Tools Free Download
91. Blackhat Hacker Tools
92. Blackhat Hacker Tools
93. Hacking Tools For Windows 7
94. Android Hack Tools Github
95. Ethical Hacker Tools
96. What Are Hacking Tools
97. Hacker Security Tools
98. Hacker Tools Free Download
99. Hack Website Online Tool
100. Hacking Tools Github
101. Hack Tools For Games
102. Hack Tools
103. Hack Apps
104. Pentest Tools Windows
105. Hack Website Online Tool
106. Nsa Hacker Tools
107. Hacking Tools Mac
108. Hacker
109. Hack Website Online Tool
110. Termux Hacking Tools 2019
111. Pentest Tools Tcp Port Scanner
112. Hacker Tools List
113. Hacking Tools Name
114. Pentest Tools Alternative
115. Hackers Toolbox
116. Hacking Tools And Software
117. Hacking Tools For Windows 7
118. Hack Tools Mac
119. Hacking Tools For Windows
120. Hacking Tools Hardware
121. Hacking Tools 2020
122. Nsa Hack Tools
123. Pentest Tools For Android
124. Pentest Tools Nmap
125. Hacker Tools Github
126. Pentest Tools Port Scanner
127. How To Install Pentest Tools In Ubuntu
128. Hacking Tools For Windows 7
129. Hacking Tools For Windows Free Download
130. Pentest Tools For Ubuntu
131. Hacker Techniques Tools And Incident Handling
132. Nsa Hack Tools
133. Pentest Tools Open Source
134. Hacking Tools Kit
135. Hacking Tools For Windows
136. Android Hack Tools Github
137. Hacker Hardware Tools
138. Hacking Tools Name
139. How To Hack
140. Hacker Tools Linux
141. Pentest Automation Tools
142. Game Hacking
143. Pentest Tools Url Fuzzer
144. Pentest Recon Tools
145. Hack Tools For Pc
146. Hack App
147. Tools Used For Hacking
148. Hack Rom Tools
149. Hacker Tools Hardware
150. Pentest Tools Review
151. Tools For Hacker
152. Pentest Tools Tcp Port Scanner
153. Hacking Tools Hardware
154. Android Hack Tools Github
155. Pentest Tools Subdomain
156. Pentest Tools For Ubuntu
157. Pentest Tools Website Vulnerability
158. Hacker Tools Free Download
159. Best Pentesting Tools 2018
160. Hacking Tools And Software
161. Hacker Tools Mac
162. Pentest Tools Open Source
163. Hacking Tools For Kali Linux
164. Kik Hack Tools
165. Hacker Security Tools
166. Pentest Tools Framework
167. Hacker Tools List
168. Pentest Tools Apk
169. Hacking Tools For Pc
170. Hackers Toolbox
171. Hacking Tools Mac
172. Hacking Tools For Windows
173. Hacking Tools Online
174. Pentest Reporting Tools
175. Pentest Tools Apk
176. Hacker Tool Kit