You can enable USB reverse internet tethering through the ADB (Android Debug Bridge) interface to allow Android smartphones to access internet and data from the system. This article provides the procedure to block USB reverse internet tethering with DLP Endpoint.
Create a Device Class for the ADB interface:
- Log on to the ePO console.
- Click Menu, DLP Policy Manager, Definitions.
- Click Device Class, Actions, New Item.
- On the New Device Class Details page, specify values for the following to create a definition:
- Name: Enter ADB Interface Device Class.
- Status: Select Unmanaged.
- Filter Type: Select Upper Filter.
- GUID: Enter 3f966bd9-fa04-4ec5-991c-d326973b5128 in the textbox.
- Click Add and Save the definition
Manage the ADB Interface Device Class:
- Log on to the ePO console.
- Click Menu, Policy, Policy Catalog.
- Select Data Loss Prevention from the Products drop-down list.
- Click Edit next to the DLP Policy used on the endpoint PCs.
- Click Settings, Device Classes. Perform the following actions:
- Select ADB Interface Device Class under Device Class Name.
- Select Managed under Status.
- Select Upper Filter under Filter Type.
- Click Add.
- Click Apply Policy to save the changes.
Block or monitor USB reverse internet tethering:
- Log on to the ePO console.
- Click Menu, DLP Policy Manager.
- Click the Definitions tab, expand Device Control, and click Device Templates.
- Click Action, New Item, Plug and Play Device Template.
- On the New Plug and Play Devices page, specify values for the following:
- Name: Enter ADB Plug and Play Device Definition.
- Bus Type: Set Comparison to Equals and Value to USB.
- Device Class: Set Comparison to Equals and Value to ADB Interface Device Class (Unmanaged).
- Click Save.
- On the DLP Policy Manager page, click Rule Sets and select an applicable rule set.
- Click Device Control tab, Actions, New Rule, Plug and Play Device Rule.
- On the Plug and Play Device Rule page, specify values for the following:
- Rule name: Enter PnP Rule to block reverse Tethering.
- State: Select Enabled.
- End-User: Select Is any User (ALL).
- Plug and Play: Select Is one of (OR) ADB Plug and Play Device Definition.
- Click the Reaction tab and specify values for the following:
- Action: Select No Action.
- User Notification: Click the three dots and choose Default device management user notification [built-in].
- Report Incident: Select the checkbox.
- Click Save. Apply the policy to a DLP client system and test the rule.
- Based on the test results, set the Action (in step 9) to Block reverse tethering.
