Which aspect of EPP are you submitting for?
Endpoint Protector Client
What is a one sentence summary of your feature request?
Block android devices regardless of mode
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
Currently, as reported by support, the detection of android devices is based purely on MTP/PTP detection.
As such, when an android device is connected outside of these modes, it can still be allowed data transfer via ADB tooling.
Additionally, android devices running under tethering modes are not blocked and could be used as a means of data exfiltration.
I have also identified devices running under a “MIDI” mode.
I would like to be able to block android devices using these methods unless allowed via user- or computer-based rights granted to the device in question.
Setting the following to default deny do not block devices set to tethering mode, nor those with ADB debugging enabled:
- Unknown Device
- Android Smartphone (Media Transfer Protocol)
- Mobile Phones (Sony Ericsson, etc.)
- USB Modem
Currently, I can only block MTP- or PTP-based connections. My current assumption would be that these would show up as an “Unknown Device” type or as one of the above types.
Ideally, it would be nice to have this feature set replicated across macOS and Windows based hosts as well if possible.
How do you currently solve the challenges you have by not having this feature?
This challenge cannot be solved currently via the use of Endpoint Protector. Other solutions such as USBGuard can block based on USB class and subclass but isn’t easily manageable for per-user allowlisting of devices.