infrastructure-notes/AFS Forcepoint Neuterage Notes.md

AFS Forcepoint Neuterage.md

Forcepoint is AFS Mac security software.

How to kill Forcepoint on your Mac

05/07/2020

the two levels of forcepoint neuterage level 1 - it's still hooked the kernel, but can't filter anymore... add to /etc/hosts 127.0.0.1 ngep.blackspider.com 127.0.0.1 download.global.blackspider.com not being able to talk to the mgmt servers the filtering engine just stops filtering things next you'll need to boot from recovery console to whack the kext mount your disk, chroot into it in /Library/Application Support/Websense Endpoint/DC rename the kext file there to something like "kextskip" touch ForcepointEndpointDC.kext chflags schg ForcepointEndpointDC.kext do the same thing in /Library/StagedExtensions/Library/Application Support/Websense Endpoint/DC/ exit out of recovery console, unmount your disk reboot

Alternate alias killfp='while [[ 1 ]]; do sudo killall -9 fpdcd; done'