Skip to main content

​
Operating system support

​
Network requirements

The control agent does not listen on any port for traffic initiated external to the localhost, thus does not increase potential attack vectors. However, as outbound connections are made, any egress filtering performed by antivirus software, firewalls, routers, etc. would need to be opened.

The IDMNotification component of the idemeum desktop client delivers push notifications to end-user workstations. It connects to Google’s Firebase Cloud Messaging infrastructure using the same registration and delivery flow an Android device uses: a set of HTTPS calls to register the device, followed by a single long-lived TLS connection that stays open to receive messages as they arrive.

​
Notes on notifications

All six destinations are outbound-initiated from the workstation. No inbound firewall rule is required — this governs which side opens the connection, not which side sends data on it. Once the workstation opens the socket to mtalk.google.com, Google’s servers push notifications back down that same connection; no new inbound connection to the workstation is ever created. The connection to mtalk.google.com is long-lived by design — it is expected to sit idle between notifications rather than open and close per message. Firewalls or proxies that aggressively time out idle TCP/TLS sessions should exempt this destination.

​
DLLs and executables

Idemeum control agent is installed in the following location on Windows - C:\Program Files\Idemeum Inc\Idemeum Desktop Client. There are a number of executables and DLLs that idemeum control agent is using. All DLLs and executables are signed with idemeum certificate (signer IDEMEUM INC). Also some of the required DLLs are placed in the System32 folder. Those DLLs are also signed.