Control of External Devices on macOS

PoC of restricting an access to cloud drives. Uses Endpoint Security framework and currently supports iCloud and (partially) Dropbox. Its functionality is described in thesis.pdf (Chapter 8).

Features

• Shows way of restricting work with iCloud
• Shows way of restricting work with Dropbox
• In combination with blocking all USB storage drives

Dependencies

• SIP disabled
  • csrutil disable

The application was tested on the following platforms:

• macOS:
  • 10.15.4 Catalina

Build

git clone https://github.com/jzlka/blocker.git
cd blocker/blocker/blockerd
make && cd ../ && ./sign.sh && cd blockerd

or

git clone https://github.com/jzlka/blocker.git
cd blocker/blocker/
#xcbuild TODO

Final binary (blockerd) is located in the folder with source files (in case of build using Makekile).

Makefile parameters

* make              - build the tool
* make test         - run basic tests (**TODO**)
* make clean        - clean compiled binary, object files and *.dSYM files

Program arguments

blockerd [-v[<level>]] [<cloud_provider> <block_level>] [-h]

Argument	Description
-h, --help	Show help message and exit.
-v, --verbosity	Select verbosity level 0(disabled), 1(error), 2(warning), 3(info), 4(verbose). If no value is specified 3 is used by default.
Supported cloud providers:
-d, --dropbox	Control of Dropbox's shared folders.
-i, --icloud	Control of iCloud's shared folders.
Block levels:
none	Nothing is blocked.
ronly	Only content non-modifying operations are allowed, and background processes needed for cloud synchronization.
full	All file operations are blocked except background processes needed for cloud synchronization.

Author

Jozef Zuzelka

More information

• ZUZELKA, Jozef. Control of External Devices on macOS to Prevent Data Leaks. Brno, 2020. Master’s thesis. Brno University of Technology, Faculty of Information Technology. Supervisor Ing. Jan Pluskal (thesis.pdf)