{"id":29861,"date":"2019-10-31T21:32:23","date_gmt":"2019-10-31T18:32:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/dlp-sistema-devicelock-8-2-dyryavyj-shtaketnik-na-strazhe-vashej-bezopasnosti\/"},"modified":"2019-10-31T21:32:23","modified_gmt":"2019-10-31T18:32:23","slug":"dlp-sistema-devicelock-8-2-dyryavyj-shtaketnik-na-strazhe-vashej-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/dlp-sistema-devicelock-8-2-dyryavyj-shtaketnik-na-strazhe-vashej-bezopasnosti","title":{"rendered":"The DLP System DeviceLock 8.2 \u2014 A Sieve at the Guard of Your Security","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

In October 2017, I attended a promotional seminar for the DLP system DeviceLock, where, in addition to the main functionality of leak protection such as disabling USB ports, contextual email analysis, and clipboard monitoring, administrator protection was also advertised. The model is simple and elegant \u2014 an installer comes to a small company, installs a suite of programs, passwords the BIOS, creates an administrator account for DeviceLock, and leaves the local admin with only rights to manage Windows and other software. Even with malicious intent, this admin wouldn't be able to steal anything. But that's all theory...
\n<\/a><\/noindex>
\n Having spent over 20 years in the field of information protection development, I have firmly convinced that an administrator can do anything, especially with physical access to the computer. Thus, the primary defense against such threats can only be organizational measures like strict reporting and physical protection of computers containing sensitive information. This immediately led to the thought of testing the resilience of the proposed product.<\/p>\n

The attempt to do this right after the seminar failed. Protection against the deletion of the main service, DlService.exe, was implemented head-on, and they even remembered about access rights and choosing the last successful configuration, resulting in it being impossible to crash it like most viruses by denying the system read and execute access. <\/p>\n

To all questions about the protection of the drivers presumably included in the product, the representative from the developing company Smart Line confidently stated that \"everything is at the same level.\"<\/p>\n

The next day, I decided to continue my inquiries and downloaded the trial version. I was immediately surprised by the size of the distribution at almost 2 GB! I am used to system software, which is often classified as information protection tools, being much more compact.<\/p>\n

After installation, I was surprised for the second time \u2014 the size of the aforementioned executable was also quite large at 13 MB. It immediately occurred to me that with such volume, there must be something notable to latch onto. I tried to replace a module using deferred writing \u2014 it was locked. I rummaged through the program's directories, and there were 11 drivers! I poked around the permissions \u2014 they were not locked for modification! Well, fine, let's deny everyone and reboot!<\/p>\n

The effect is simply phenomenal \u2014 all functions disabled, the service did not start. What self-protection are you talking about, just take and copy whatever you want, whether to flash drives or over the network. The first serious drawback of the system has emerged \u2014 the too strong interdependence of components. Yes, the service should communicate with drivers, but why crash if no one responds? In the end, there is one method to bypass the protection.<\/p>\n

Having discovered that this wonder service is so delicate and sensitive, I decided to check its dependencies on third-party libraries. It's even simpler here, there's a long list, just randomly delete the WinSock_II library and observe a similar picture \u2014 the service did not start, the system is open.<\/p>\n

As a result, we have what the presenter described at the seminar, a powerful fence, but it does not enclose the entire protected perimeter due to lack of funds, and in the unclosed section, there's just a thorny bush. In this case, considering the architecture of the software product, which assumes an open environment by default, with numerous diverse plugs, interceptors, traffic analyzers, it is rather a picket fence, and many slats are screwed with self-tapping screws from the outside and can be easily unscrewed. The problems of most similar solutions lie in the fact that with such a huge number of potential gaps, there is always a risk of forgetting something, missing an interconnection, or affecting stability by poorly implementing one of the interceptors. Judging by the fact that the vulnerabilities mentioned in this article are just lying on the surface, the product contains many more, which will take a couple more hours to search for.<\/p>\n

Moreover, the market is full of examples of competent implementation of protection against shutdown, such as domestic antivirus solutions where self-protection is not easily bypassed. As far as I know, they did not hesitate to go through certification with the FSTEC.<\/p>\n

After having several conversations with Smart Line employees, several similar places were found that they had not even heard of. One example is the ArrInitDll mechanism.<\/p>\n

Although it may not be the deepest, it allows avoiding intrusion into the OS kernel in many cases and does not affect its stability. nVidia drivers extensively use this mechanism to fine-tune the graphics adapter for specific games. <\/p>\n

The complete lack of a comprehensive approach to building an automated system based on DL 8.2 raises questions. It is suggested to outline the advantages of the product for the client, check the computational power of the existing PCs, and servers<\/a> (contextual analyzers are quite resource-intensive, and trendy office all-in-ones and nettops based on Atom are not suitable in this case) and simply overlay the product. Meanwhile, terms such as \"access control,\" \"closed programming environment\" did not even come up at the seminar. Regarding encryption, it was mentioned that besides being complex, it would raise questions from regulators, although there are really no issues with it. Questions about certification are dismissed even by FSTEC due to their supposed complexity and lengthiness. As a cybersecurity specialist who has repeatedly participated in similar procedures, I can say that many vulnerabilities, similar to those described in this material, are identified during their implementation, as the specialists in certifying laboratories have serious professional training.<\/p>\n

As a result, the presented DLP system can perform a very limited set of functions that actually ensure information security, generating a significant computational load while creating a feeling of security for the company's management, which is inexperienced in cybersecurity matters.<\/p>\n

It can realistically protect only truly large data from non-privileged users, as an administrator can easily deactivate the protection completely, and for small secrets, even a junior cleaning manager could inconspicuously photograph a screen or memorize a URL or credit card number, peeking over a colleague's shoulder.
\nMoreover, all this holds true only if employees cannot physically access the insides of the PCs or at least the BIOS to activate booting from external media. In that case, even BitLocker may not help, which is hardly used in companies that are just starting to consider information security.<\/p>\n

As trivial as it may sound, the output in a comprehensive approach to information security includes not only software\/hardware solutions but also organizational and technical measures to prevent photography\/videography and unauthorized access by outside \"boys with phenomenal memories.\" One must never rely solely on the miracle product DL 8.2, marketed as a one-step solution to most enterprise security problems.<\/p>\n

Source: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 2017 \u0433\u043e\u0434\u0430 \u0434\u043e\u0432\u0435\u043b\u043e\u0441\u044c \u043f\u043e\u0431\u044b\u0432\u0430\u0442\u044c \u043d\u0430 \u0440\u0435\u043a\u043b\u0430\u043c\u043d\u043e\u043c \u0441\u0435\u043c\u0438\u043d\u0430\u0440\u0435 DLP-\u0441\u0438\u0441\u0442\u0435\u043c\u044b DeviceLock, \u0433\u0434\u0435 \u043f\u043e\u043c\u0438\u043c\u043e \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0433\u043e \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0443\u0442\u0435\u0447\u0435\u043a \u0442\u0438\u043f\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u0438\u044f USB-\u043f\u043e\u0440\u0442\u043e\u0432, \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u043d\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u043e\u0447\u0442\u044b \u0438 \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u0440\u0435\u043a\u043b\u0430\u043c\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430. \u041c\u043e\u0434\u0435\u043b\u044c \u043f\u0440\u043e\u0441\u0442\u0430\u044f \u0438 \u043a\u0440\u0430\u0441\u0438\u0432\u0430\u044f \u2014 \u0432 \u043c\u0430\u043b\u0435\u043d\u044c\u043a\u0443\u044e \u0444\u0438\u0440\u043c\u0443 \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a, \u0441\u0442\u0430\u0432\u0438\u0442 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043f\u0430\u0440\u043e\u043b\u0438\u0442 \u0411\u0418\u041e\u0421, \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0441\u043a\u0443\u044e \u0443\u0447\u0435\u0442\u043a\u0443 DeviceLock, \u0430 \u043c\u0435\u0441\u0442\u043d\u043e\u043c\u0443 \u0430\u0434\u043c\u0438\u043d\u0443 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-29861","post","type-post","status-publish","format-standard","hentry","category-blog"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DLP system DeviceLock 8.2 \u2014 a leaky fence safeguarding your security | ProHoster","description":"In October 2017, I had the opportunity to attend a promotional seminar for the DLP system DeviceLock, where, in addition to its primary functionality for preventing leaks like blocking USB ports and context-based email and clipboard analysis, it was also advertised.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/dlp-sistema-devicelock-8-2-dyryavyj-shtaketnik-na-strazhe-vashej-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DLP-\u0441\u0438\u0441\u0442\u0435\u043c\u0430 DeviceLock 8.2 \u2014 \u0434\u044b\u0440\u044f\u0432\u044b\u0439 \u0448\u0442\u0430\u043a\u0435\u0442\u043d\u0438\u043a \u043d\u0430 \u0441\u0442\u0440\u0430\u0436\u0435 \u0432\u0430\u0448\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u0412 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 2017 \u0433\u043e\u0434\u0430 \u0434\u043e\u0432\u0435\u043b\u043e\u0441\u044c \u043f\u043e\u0431\u044b\u0432\u0430\u0442\u044c \u043d\u0430 \u0440\u0435\u043a\u043b\u0430\u043c\u043d\u043e\u043c \u0441\u0435\u043c\u0438\u043d\u0430\u0440\u0435 DLP-\u0441\u0438\u0441\u0442\u0435\u043c\u044b DeviceLock, \u0433\u0434\u0435 \u043f\u043e\u043c\u0438\u043c\u043e \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0433\u043e \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0443\u0442\u0435\u0447\u0435\u043a \u0442\u0438\u043f\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u0438\u044f USB-\u043f\u043e\u0440\u0442\u043e\u0432, \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u043d\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u043e\u0447\u0442\u044b \u0438 \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u0440\u0435\u043a\u043b\u0430\u043c\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c.","og:url":"https:\/\/prohoster.info\/en\/blog\/dlp-sistema-devicelock-8-2-dyryavyj-shtaketnik-na-strazhe-vashej-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:32:23+00:00","article:modified_time":"2019-10-31T18:32:23+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"29861","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 16:53:14","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:47:35","updated":"2026-02-09 16:53:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/29861","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=29861"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/29861\/revisions"}],"predecessor-version":[{"id":158524,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/29861\/revisions\/158524"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=29861"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=29861"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=29861"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}