Anti-Tamper Protection

Overview

BlueSentinel uses a 4-layer anti-tamper system to ensure the agent cannot be stopped, killed, or removed by endpoint users.

Layer 1: Dual Watchdog Processes

Two independent watchdog processes run alongside the main agent:

• Watchdog A monitors the main agent process
• Watchdog B monitors both the main agent and Watchdog A
• If any process dies, the others restart it within seconds

The watchdog heartbeat interval is 5 seconds.

Layer 2: Self-Healing

If agent files are deleted or corrupted:

• The watchdog detects file integrity changes
• Fresh agent files are downloaded from the central server
• The agent is reinstalled and restarted automatically

Layer 3: File Locking

Critical agent files are locked at the OS level:

• Users cannot delete, rename, or modify agent files while the process is running
• Configuration files are protected from tampering
• Policy files are validated against checksums

Layer 4: OS Service Protection

The agent is registered as a protected OS-level service:

• Windows: Windows Service with Automatic startup and failure recovery (restart on all failures)
• macOS: LaunchDaemon with KeepAlive = true and RunAtLoad = true

Users cannot stop the service through normal means (Task Manager, Activity Monitor, etc.).

Anti-Tamper Loop

A dedicated thread runs every 10 seconds calling check_and_repair_all():

1. Verify USB blocking is still active at OS level
2. Verify firewall rules are still in place
3. Verify system proxy settings point to the browser guard
4. Verify AirDrop/Bluetooth sharing is still disabled
5. Verify encryption is still enabled

If any setting has been reversed (e.g., user re-enabled USB via Device Manager), it is immediately reapplied and a tamper_detected alert is sent to the server with CRITICAL severity.

Tamper Detection Alerts

When tampering is detected, the alert includes:

• Which setting was reversed
• What was changed
• When it was detected
• The corrective action taken