Tricks To Bypass Device Control Protection Solutions

Preface

As I wrote in a previous blog post, I had an engagement last year where my task was to exfiltrate data from a workstation on some sort of storage media. The twist in that task was Lumension Sanctuary Device Control, and the version was 4.3.2, but I am not sure how newer version work and this seems to be a more general problem with device control solution, for example with Symantec products.

But what is a device control solution? In short, they audit I/O device use and block the attempts to use unauthorized devices. This includes hardware such as USB, PS/2, FireWire, CD/DVD so basically every I/O port of a computer. In my opinion, these are pretty good things and they offer a better looking solution than de-soldering the I/O ports from the motherboards or hot-gluing them, but on the other hand, they can be bypassed.

Bypass

OK, so what is the problem? Well the way these device control solutions work is that they load a few kernel drivers to monitor the physical ports of the machine. However... when you boot up the protected computer in safe mode, depending on the device control solution software, some of these drivers are not loaded (or if you are lucky, none of those modules will be loaded...) and this opens up the possibility to exfiltrate data.

In theory, if you have admin (SYSTEM maybe?) privileges, you might as well try to unload the kernel drivers. Just do not forget, that these device control solutions also have a watchdog process, that checks the driver and automatically loads it back if it is unloaded, so look for that process and stop or suspend it first.

In my case with the Lumension Sanctuary Device Control, I have found that when I boot the Workstation protected by the device control software in Safe Mode where, software's key logger protection module is not running... so I was still unable to use a USB stick, or a storage media, but I could plug in a keyboard for example...hmmm :)

As some of you probably already figured it out, now it is possible to use a pre-programmed USB HID, for example a Teensy! : ) I know about three different project, that uses this trick like these two mentioned in a Hackaday post, or this one. Unfortunately, the site ob-security.info no longer seems to be available (well, at least it is no longer related to infosec :D ), but you can still find the blog post and the files with the Wayback Machine.

For the hardware part, the wiring of the Teensy and the SD card adaptor is the same as I showed in the post on Making a USB flash drive HW Trojan or in the Binary deployment with VBScript, PowerShell or .Net csc.exe compiler post, so I will not copy it here again.

I have to note here that there are other ways to bypass these device control solutions, like the method what Dr. Phil Polstra did with the USB Impersonator, which is basically looks for an authorized device VID/PID and then  impersonates that devices with the VID/PID.

Mitigation

Most probably, you will not need safe mode for the users, so you can just disable it... I mean, it is not that easy, but luckily there is a great blog post on how to do that. BTW, the first page of the post is for Windows XP, but you are not using XP anymore, aren't you? ;)

Alternatively, as I mentioned at the beginning, you might as well use some physical countermeasure (de-soldering/hot-gluing ports). That shit is ugly, but it kinda works.

Conclusion

Next time you will face a device control solution, try out these tricks, maybe they will work, and if they do, well, that's a lot of fun. :)

But don't get me wrong, these device control solutions and similar countermeasures are a good thing and you should use something like this! I know that they make doing business a bit harder as you are not able to plugin whatever USB stick you want, but if you buy a pile of hardware encrypted flash drives, and only allow  those to be plugged in, you are doing it right ;)

More information

1. Hack Tools Online
2. Hackrf Tools
3. Nsa Hack Tools
4. Pentest Tools Android
5. Top Pentest Tools
6. Hack Tools Download
7. What Are Hacking Tools
8. Hacking Tools For Kali Linux
9. Github Hacking Tools
10. Pentest Tools Review
11. Pentest Tools Tcp Port Scanner
12. Hack Tool Apk
13. Hackrf Tools
14. Hacking Tools Hardware
15. Android Hack Tools Github
16. Hacker Tools For Pc
17. Pentest Tools Website Vulnerability
18. Pentest Tools Review
19. How To Hack
20. Tools For Hacker
21. Pentest Tools Find Subdomains
22. Hack Tools For Mac
23. Hacker Tools Online
24. Hack Tools For Pc
25. Bluetooth Hacking Tools Kali
26. Pentest Tools Linux
27. Hacker Tool Kit
28. Game Hacking
29. Hack Tools Mac
30. Pentest Tools Review
31. Computer Hacker
32. Tools Used For Hacking
33. Hacking Tools For Windows
34. Wifi Hacker Tools For Windows
35. Hacker Tools 2020
36. How To Make Hacking Tools
37. How To Make Hacking Tools
38. Hacker Tools Free Download
39. Hacking Tools For Windows 7
40. Pentest Tools Nmap
41. Hack Tools Online
42. Pentest Tools For Android
43. Hack App
44. Pentest Box Tools Download
45. Hack Tools 2019
46. Pentest Tools
47. What Is Hacking Tools
48. Physical Pentest Tools
49. Pentest Tools Free
50. Ethical Hacker Tools
51. Underground Hacker Sites
52. Pentest Tools Nmap
53. Hack Website Online Tool
54. Hacker Search Tools
55. Pentest Tools Website Vulnerability
56. Hacking Tools Online
57. Hacker
58. Nsa Hack Tools
59. Hacking Tools And Software
60. Hacker Tools For Mac
61. Pentest Tools For Ubuntu
62. Hacker Tools Github
63. Tools 4 Hack
64. Hack Tools For Mac
65. Hacker Tools Free Download
66. Pentest Tools For Android
67. Pentest Tools Nmap
68. Hack Website Online Tool
69. Hacking Tools Online
70. Hackrf Tools
71. Hacker Tools For Windows
72. Android Hack Tools Github
73. Pentest Tools Apk
74. Computer Hacker
75. Hack Tools For Mac
76. Hacking Tools Windows
77. Hacking Tools For Windows
78. Tools For Hacker
79. Hacker Tools Windows
80. Hack Website Online Tool
81. Hacker Tools
82. Hacking Tools Name
83. Pentest Tools Apk
84. Hacker Tools Free Download
85. Best Hacking Tools 2019
86. Hacking Tools
87. Hacker Tools 2020
88. Hack Tools Mac
89. Pentest Tools Framework
90. Hacking Tools Mac
91. Pentest Box Tools Download
92. Hacking Tools 2019
93. Pentest Recon Tools
94. Hacking Tools Download
95. Hacker Tools Mac
96. Hacking Tools And Software
97. Hacking Tools Name
98. Hacker
99. Hacker
100. Pentest Tools Apk
101. Hack Tools
102. Hacker Tool Kit
103. Nsa Hacker Tools
104. Pentest Tools Apk
105. Pentest Tools Tcp Port Scanner
106. Hack Tools Download
107. Beginner Hacker Tools
108. Hacker Tools For Pc
109. Hack Tools Online
110. Hacking Tools And Software
111. Hacker Tools 2020
112. Hackrf Tools
113. Hack Rom Tools
114. Termux Hacking Tools 2019