0

A lot of companies install a UEM agent on employee's laptop to keep track of the health status of the laptop. And they allow the laptop to connect to the internal network if this UEM sends back "Healthy" status back to the server.

If a device is compromised, OS level privilege was obtained by the attacker. How can we prevent the attacker from killing the UEM agent and sending fake "healthy" traffic back to the server?

My ideas:

  1. Traffic can be encrypted with server's public key, but this doesn't matter since attacker can obtain the public key in your machine with OS access.

  2. Use Yubico key (U2f) to authenticate the agent before starting a session with the server. This helps a bit because this prevented session duplication attack, attacker could only do session riding. (private key is not stored on the system) But what if the attacker patch the agent instead of killing it?

  3. Don't trust your UEM status?

  • Why would the attacker kill UEM? What traffic would be encrypted? Ultimately, yes, never trust what a client sends you. The reason why to have a UEM is far greater than as a control against a completely hacked and rooted device. – schroeder Dec 3 '18 at 0:40
  • @schroeder Maybe they can just kill it and use a fake agent to send back "healthy" status back to the server? I just read about SIP in macOS, it might help to protect that process? – Timothy Leung Dec 3 '18 at 6:50
  • But why would a hacker need to do that? – schroeder Dec 3 '18 at 8:22
  • @schroeder to prevent the detection team detecting his exploits? – Timothy Leung Dec 3 '18 at 21:55
0

I have read a few things about that in the past few days.. came up with some ideas.

  1. Ensure you have authentication used on the application. This can prevent someone from killing your agent AND create a fake agent to talk to the server. They will need to authenticate with their fake agent first, if they dun have the credentials, they will not be able to do so. You can also implement 2FA / U2F to increase the strength. This eliminated the possibility of your process being killed and create their own session.

  2. Use TLS for connection, this might sounds lame, but it is an effective solution to prevent MITM attack, so in this case, we can prevent the attacker from changing the traffic.

  3. Get your application signed by Microsoft / apple /google, and leverage their protection mechanism in the operating system to protect your app from being patched in runtime. Please look at system integrity protection in MacOS. This prevents your process from being touched even they gained root access on the device/platform.

By combining all three things, I think the attacker will not be able to modify the app/traffic. Let me know if you have any ideas!

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.