Tricks To Bypass Device Control Protection Solutions

Preface

As I wrote in a previous blog post, I had an engagement last year where my task was to exfiltrate data from a workstation on some sort of storage media. The twist in that task was Lumension Sanctuary Device Control, and the version was 4.3.2, but I am not sure how newer version work and this seems to be a more general problem with device control solution, for example with Symantec products.

But what is a device control solution? In short, they audit I/O device use and block the attempts to use unauthorized devices. This includes hardware such as USB, PS/2, FireWire, CD/DVD so basically every I/O port of a computer. In my opinion, these are pretty good things and they offer a better looking solution than de-soldering the I/O ports from the motherboards or hot-gluing them, but on the other hand, they can be bypassed.

Bypass

OK, so what is the problem? Well the way these device control solutions work is that they load a few kernel drivers to monitor the physical ports of the machine. However... when you boot up the protected computer in safe mode, depending on the device control solution software, some of these drivers are not loaded (or if you are lucky, none of those modules will be loaded...) and this opens up the possibility to exfiltrate data.

In theory, if you have admin (SYSTEM maybe?) privileges, you might as well try to unload the kernel drivers. Just do not forget, that these device control solutions also have a watchdog process, that checks the driver and automatically loads it back if it is unloaded, so look for that process and stop or suspend it first.

In my case with the Lumension Sanctuary Device Control, I have found that when I boot the Workstation protected by the device control software in Safe Mode where, software's key logger protection module is not running... so I was still unable to use a USB stick, or a storage media, but I could plug in a keyboard for example...hmmm :)

As some of you probably already figured it out, now it is possible to use a pre-programmed USB HID, for example a Teensy! : ) I know about three different project, that uses this trick like these two mentioned in a Hackaday post, or this one. Unfortunately, the site ob-security.info no longer seems to be available (well, at least it is no longer related to infosec :D ), but you can still find the blog post and the files with the Wayback Machine.

For the hardware part, the wiring of the Teensy and the SD card adaptor is the same as I showed in the post on Making a USB flash drive HW Trojan or in the Binary deployment with VBScript, PowerShell or .Net csc.exe compiler post, so I will not copy it here again.

I have to note here that there are other ways to bypass these device control solutions, like the method what Dr. Phil Polstra did with the USB Impersonator, which is basically looks for an authorized device VID/PID and then  impersonates that devices with the VID/PID.

Mitigation

Most probably, you will not need safe mode for the users, so you can just disable it... I mean, it is not that easy, but luckily there is a great blog post on how to do that. BTW, the first page of the post is for Windows XP, but you are not using XP anymore, aren't you? ;)

Alternatively, as I mentioned at the beginning, you might as well use some physical countermeasure (de-soldering/hot-gluing ports). That shit is ugly, but it kinda works.

Conclusion

Next time you will face a device control solution, try out these tricks, maybe they will work, and if they do, well, that's a lot of fun. :)

But don't get me wrong, these device control solutions and similar countermeasures are a good thing and you should use something like this! I know that they make doing business a bit harder as you are not able to plugin whatever USB stick you want, but if you buy a pile of hardware encrypted flash drives, and only allow  those to be plugged in, you are doing it right ;)

Related articles

1. Pentest Tools Url Fuzzer
2. Hacking Tools Online
3. Hacker Tools 2020
4. Hack App
5. Hacking Tools For Pc
6. Tools 4 Hack
7. Blackhat Hacker Tools
8. Termux Hacking Tools 2019
9. Hacker Tools Online
10. Hacker Tools Linux
11. Growth Hacker Tools
12. Hacking Tools Kit
13. Hacker Tools For Mac
14. Pentest Tools Apk
15. Hack Tools For Windows
16. Pentest Tools Windows
17. Pentest Tools Android
18. Pentest Tools Tcp Port Scanner
19. Growth Hacker Tools
20. Pentest Tools Alternative
21. Pentest Tools For Ubuntu
22. Hacker Tools For Pc
23. Hacker Tools 2020
24. Underground Hacker Sites
25. Hacking Tools Github
26. Hack Tool Apk
27. Pentest Tools Kali Linux
28. Termux Hacking Tools 2019
29. Tools Used For Hacking
30. Blackhat Hacker Tools
31. Hacking Tools For Games
32. Hack Website Online Tool
33. Hacker
34. Pentest Tools Linux
35. Pentest Tools Alternative
36. Hacking Tools And Software
37. Hacker Tools
38. Pentest Tools Free
39. What Is Hacking Tools
40. Hacker Tools Windows
41. Growth Hacker Tools
42. Hacking Tools Mac
43. Physical Pentest Tools
44. Hacking Apps
45. Bluetooth Hacking Tools Kali
46. Github Hacking Tools
47. Hack Tools Mac
48. Best Hacking Tools 2020
49. Hacker Tools List
50. Hacker Tools Apk
51. Hacker Hardware Tools
52. Tools For Hacker
53. Pentest Tools Linux
54. Hacking Tools For Windows 7
55. Hacker Tools 2019
56. Pentest Tools For Android
57. Pentest Tools Online
58. Tools 4 Hack
59. Pentest Tools Windows
60. Pentest Tools Subdomain
61. Hacking Tools For Windows 7
62. Pentest Tools Website
63. Pentest Tools Framework
64. Pentest Tools For Android
65. Hacker Tools
66. Hack Tools Pc
67. Pentest Box Tools Download
68. Nsa Hack Tools
69. Pentest Tools Website
70. Hacking Tools Pc
71. Blackhat Hacker Tools
72. Hacker Tools 2020
73. Pentest Tools Website Vulnerability
74. Pentest Automation Tools
75. Hacking Tools Free Download
76. Tools Used For Hacking
77. Hacker Tools Free
78. Tools 4 Hack
79. What Are Hacking Tools
80. Hack Tools Online
81. Hacking Tools
82. Pentest Tools Kali Linux
83. Game Hacking
84. Hacking Apps
85. Underground Hacker Sites
86. Top Pentest Tools
87. Wifi Hacker Tools For Windows
88. How To Hack
89. Hacker Tools Hardware
90. Hack Website Online Tool
91. Pentest Tools Free
92. Hacking Tools For Mac
93. Best Hacking Tools 2020
94. Tools For Hacker
95. Hacking Tools For Games
96. Pentest Tools Apk
97. Tools Used For Hacking
98. Hack Tools For Games