Skip to main content
Information Security

Return to Question

Notice removed Draw attention by Rory Alsop♦
Bounty Ended with RoraΖ's answer chosen by Rory Alsop♦
Notice added Draw attention by Rory Alsop♦
Bounty Started worth 50 reputation by Rory Alsop♦
improved formatting
Source Link
edit approved Dec 14, 2014 at 4:29
user2339252
edit approved Dec 14, 2014 at 4:29
user2339252
  • 9
  • 2

This articleHere is an article that should give a little more context (and see my comment on it, same username, for additional info): http://www.engadget.com/2014/10/08/ios-update-will-block-emulators/.

iOS developers are able to distribute apps outside of the App Store using an Enterprise provisioning profile. This allows apps to be installed even right from Safari without the need for App Store approval, enabling non-developers to test beta builds, companies to distribute internal apps to employees, etc. 

However, both Apple and the enterprise account holder retain the ability to revoke the certificate backing the provisioning profile, which would prevent anymore users from installing the app (in the case of the article linked above, Apple revoked the enterprise profile used to sign the emulator because they considered it abuse of the freedom granted by enterprise distribution)...excluding, of course, the "loophole" used to bypass that check: simply change your system date to any date in the past.

This raises a lot of questions about how the certificate validation is implemented, but I'm most curious about what goes on when the loophole is not being exploited. At what point does the device actually reach out to Apple to make sure the certificate has not been revoked? At the moment the app is installed? If that's the case, is it "soft" (allows install unless revocation is explicitly detected) or "hard" (forbids install unless certificate is absolutely proven still valid)? Or does the device check in with Apple periodically to get an updated blacklist/whitelist of enterprise certificate identities? Or is it something even different?

This article should give a little more context (and see my comment on it, same username, for additional info): http://www.engadget.com/2014/10/08/ios-update-will-block-emulators/

iOS developers are able to distribute apps outside of the App Store using an Enterprise provisioning profile. This allows apps to be installed even right from Safari without the need for App Store approval, enabling non-developers to test beta builds, companies to distribute internal apps to employees, etc. However, both Apple and the enterprise account holder retain the ability to revoke the certificate backing the provisioning profile, which would prevent anymore users from installing the app (in the case of the article linked above, Apple revoked the enterprise profile used to sign the emulator because they considered it abuse of the freedom granted by enterprise distribution)...excluding, of course, the "loophole" used to bypass that check: simply change your system date to any date in the past.

This raises a lot of questions about how the certificate validation is implemented, but I'm most curious about what goes on when the loophole is not being exploited. At what point does the device actually reach out to Apple to make sure the certificate has not been revoked? At the moment the app is installed? If that's the case, is it "soft" (allows install unless revocation is explicitly detected) or "hard" (forbids install unless certificate is absolutely proven still valid)? Or does the device check in with Apple periodically to get an updated blacklist/whitelist of enterprise certificate identities? Or is it something even different?

Here is an article that should give a little more context (and see my comment on it, same username, for additional info).

iOS developers are able to distribute apps outside of the App Store using an Enterprise provisioning profile. This allows apps to be installed even right from Safari without the need for App Store approval, enabling non-developers to test beta builds, companies to distribute internal apps to employees, etc. 

However, both Apple and the enterprise account holder retain the ability to revoke the certificate backing the provisioning profile, which would prevent anymore users from installing the app (in the case of the article linked above, Apple revoked the enterprise profile used to sign the emulator because they considered it abuse of the freedom granted by enterprise distribution)...excluding, of course, the "loophole" used to bypass that check: simply change your system date to any date in the past.

This raises a lot of questions about how the certificate validation is implemented, but I'm most curious about what goes on when the loophole is not being exploited. At what point does the device actually reach out to Apple to make sure the certificate has not been revoked? At the moment the app is installed? If that's the case, is it "soft" (allows install unless revocation is explicitly detected) or "hard" (forbids install unless certificate is absolutely proven still valid)? Or does the device check in with Apple periodically to get an updated blacklist/whitelist of enterprise certificate identities? Or is it something even different?

Tweeted twitter.com/#!/StackSecurity/status/521558188668112896
Source Link
n00neimp0rtant
n00neimp0rtant
  • 223
  • 2
  • 6

When does iOS check validity of enterprise certificates?

This article should give a little more context (and see my comment on it, same username, for additional info): http://www.engadget.com/2014/10/08/ios-update-will-block-emulators/

iOS developers are able to distribute apps outside of the App Store using an Enterprise provisioning profile. This allows apps to be installed even right from Safari without the need for App Store approval, enabling non-developers to test beta builds, companies to distribute internal apps to employees, etc. However, both Apple and the enterprise account holder retain the ability to revoke the certificate backing the provisioning profile, which would prevent anymore users from installing the app (in the case of the article linked above, Apple revoked the enterprise profile used to sign the emulator because they considered it abuse of the freedom granted by enterprise distribution)...excluding, of course, the "loophole" used to bypass that check: simply change your system date to any date in the past.

This raises a lot of questions about how the certificate validation is implemented, but I'm most curious about what goes on when the loophole is not being exploited. At what point does the device actually reach out to Apple to make sure the certificate has not been revoked? At the moment the app is installed? If that's the case, is it "soft" (allows install unless revocation is explicitly detected) or "hard" (forbids install unless certificate is absolutely proven still valid)? Or does the device check in with Apple periodically to get an updated blacklist/whitelist of enterprise certificate identities? Or is it something even different?