Tricks To Bypass Device Control Protection Solutions

Preface

As I wrote in a previous blog post, I had an engagement last year where my task was to exfiltrate data from a workstation on some sort of storage media. The twist in that task was Lumension Sanctuary Device Control, and the version was 4.3.2, but I am not sure how newer version work and this seems to be a more general problem with device control solution, for example with Symantec products.

But what is a device control solution? In short, they audit I/O device use and block the attempts to use unauthorized devices. This includes hardware such as USB, PS/2, FireWire, CD/DVD so basically every I/O port of a computer. In my opinion, these are pretty good things and they offer a better looking solution than de-soldering the I/O ports from the motherboards or hot-gluing them, but on the other hand, they can be bypassed.

Bypass

OK, so what is the problem? Well the way these device control solutions work is that they load a few kernel drivers to monitor the physical ports of the machine. However... when you boot up the protected computer in safe mode, depending on the device control solution software, some of these drivers are not loaded (or if you are lucky, none of those modules will be loaded...) and this opens up the possibility to exfiltrate data.

In theory, if you have admin (SYSTEM maybe?) privileges, you might as well try to unload the kernel drivers. Just do not forget, that these device control solutions also have a watchdog process, that checks the driver and automatically loads it back if it is unloaded, so look for that process and stop or suspend it first.

In my case with the Lumension Sanctuary Device Control, I have found that when I boot the Workstation protected by the device control software in Safe Mode where, software's key logger protection module is not running... so I was still unable to use a USB stick, or a storage media, but I could plug in a keyboard for example...hmmm :)

As some of you probably already figured it out, now it is possible to use a pre-programmed USB HID, for example a Teensy! : ) I know about three different project, that uses this trick like these two mentioned in a Hackaday post, or this one. Unfortunately, the site ob-security.info no longer seems to be available (well, at least it is no longer related to infosec :D ), but you can still find the blog post and the files with the Wayback Machine.

For the hardware part, the wiring of the Teensy and the SD card adaptor is the same as I showed in the post on Making a USB flash drive HW Trojan or in the Binary deployment with VBScript, PowerShell or .Net csc.exe compiler post, so I will not copy it here again.

I have to note here that there are other ways to bypass these device control solutions, like the method what Dr. Phil Polstra did with the USB Impersonator, which is basically looks for an authorized device VID/PID and then  impersonates that devices with the VID/PID.

Mitigation

Most probably, you will not need safe mode for the users, so you can just disable it... I mean, it is not that easy, but luckily there is a great blog post on how to do that. BTW, the first page of the post is for Windows XP, but you are not using XP anymore, aren't you? ;)

Alternatively, as I mentioned at the beginning, you might as well use some physical countermeasure (de-soldering/hot-gluing ports). That shit is ugly, but it kinda works.

Conclusion

Next time you will face a device control solution, try out these tricks, maybe they will work, and if they do, well, that's a lot of fun. :)

But don't get me wrong, these device control solutions and similar countermeasures are a good thing and you should use something like this! I know that they make doing business a bit harder as you are not able to plugin whatever USB stick you want, but if you buy a pile of hardware encrypted flash drives, and only allow  those to be plugged in, you are doing it right ;)

Related word

1. How To Hack
2. Hacker Tools For Mac
3. New Hacker Tools
4. Game Hacking
5. Hack Tools For Pc
6. Pentest Tools Download
7. Hacking Tools Download
8. Pentest Recon Tools
9. Pentest Tools List
10. Pentest Tools For Android
11. Pentest Tools
12. Underground Hacker Sites
13. Install Pentest Tools Ubuntu
14. Pentest Tools Github
15. Hacker Tools For Mac
16. Hack Tools Pc
17. Hack Tool Apk No Root
18. Hack Rom Tools
19. Black Hat Hacker Tools
20. Best Pentesting Tools 2018
21. Usb Pentest Tools
22. Hack Tools 2019
23. Hacker Hardware Tools
24. Pentest Tools Framework
25. Hack Tools Github
26. Hacker Tools Apk Download
27. Hacker Tools Mac
28. Hacks And Tools
29. Pentest Tools
30. Hacker Tools
31. Best Hacking Tools 2019
32. Pentest Tools For Ubuntu
33. Hacker Tools For Windows
34. Pentest Tools Nmap
35. Hacking Tools Windows
36. Computer Hacker
37. Hack Tools For Ubuntu
38. New Hack Tools
39. Hacking Tools Software
40. Game Hacking
41. What Is Hacking Tools
42. Hacker Tools List
43. Hacker Tool Kit
44. Hacking Tools
45. Pentest Tools Online
46. Hacking Tools Windows 10
47. Bluetooth Hacking Tools Kali
48. Hacker Security Tools
49. Hacking Tools Pc
50. Pentest Tools For Android
51. World No 1 Hacker Software
52. Hacking Tools Usb
53. Hack Rom Tools
54. Pentest Tools Framework
55. Game Hacking
56. Pentest Tools Online
57. Hack Tool Apk No Root
58. Pentest Reporting Tools
59. Pentest Tools Framework
60. New Hacker Tools
61. Tools For Hacker
62. Hacking Tools For Pc
63. Hack And Tools
64. Wifi Hacker Tools For Windows
65. Hacking Tools
66. Hack Tools For Pc
67. Top Pentest Tools
68. Usb Pentest Tools
69. Hacking App
70. Pentest Tools Free
71. Black Hat Hacker Tools
72. Best Hacking Tools 2020
73. Hack Tools
74. Pentest Tools Android
75. Tools 4 Hack
76. Hacking Tools Windows 10
77. Pentest Tools Free
78. Hacker Search Tools
79. Hacking Tools And Software
80. Pentest Tools For Windows
81. Pentest Tools List
82. Nsa Hack Tools Download
83. Hacking Tools Windows
84. Hacker Tools Windows
85. Hacker Tools
86. Hack Rom Tools
87. Hacker Techniques Tools And Incident Handling
88. Nsa Hack Tools Download
89. Hack Tool Apk
90. What Are Hacking Tools
91. Pentest Tools Download
92. Tools For Hacker
93. Android Hack Tools Github
94. Hacking Tools For Mac
95. Hacks And Tools
96. Growth Hacker Tools
97. Hacking Tools For Windows 7
98. Hacker Tools Apk Download
99. Hacking Tools And Software
100. Hacking Tools For Windows 7
101. Hacking Apps
102. Hacking Tools Windows 10
103. Hacker Tools Hardware
104. Hacker Tools Hardware
105. Hack Tools Pc