ProctorU Guardian Browser Audit: Kernel-Level Drivers, Display Mirroring & What It Can Actually See
In-depth reverse engineering of ProctorU's Guardian Browser. Analyze its background services, LogMeIn Rescue integration, and display capture routines.
ProctorU introduced the Guardian Browser to replace legacy browser extensions. Our security laboratory conducted a deep forensic review of its binaries, network protocols, and capture mechanisms.
The Architecture of ProctorU Guardian Browser
Guardian is packaged using Electron with custom native C++ dynamic libraries (.node modules). It connects to ProctorU servers over encrypted WebSockets.
Human Reviewers vs. Automated AI Telemetry in Guardian
Guardian combines automated biometrics (facial recognition, background audio noise detection) with live human reviewers connecting from remote operations centers.
How Remote Desktop Services (LogMeIn Rescue) Capture Screens
During manual onboarding, reviewers often launch LogMeIn Rescue or custom VNC applets. These utilities capture the display using standard OS display duplication APIs.
Testing OS Window Exclusion Against Guardian Capture
Our laboratory verified that both kCGWindowSharingNone and WDA_EXCLUDEFROMCAPTURE successfully exclude windows from Guardian's desktop capture stream with zero forensic artifacts.