3

I'm an iOS developer looking to get more in to iOS Pen-testing. To do so I wish to justify the business value for this. I create iOS apps internally for my company which can only be downloaded by employees using our mobile device management application which ensures, phones aren't jail-broken.

Is there value in pen testing applications which are assumed to be in a jailbreak free environment and are MDM applications bullet proof when preventing the business apps that may be downloaded via them from being used on a jail-broken phone?

3 Answers 3

3

It's all about risk reduction. MDM and testing cover different types of risk. You need to figure out what risks will be covered off by testing that can't be addressed by the MDM. Think: defense in depth.

For instance, is there info leakage? Are user credentials exposed? Is data accessible from the app to storage so that the user can download? MDM might address some of these issues (depending on how it is configured), but what happens when MDM fails? Or if someone configures the MDM differently for themselves or an exec (gosh, I've seen that too many times).

1

I have performed many pen tests of mobile apps, under MDM, and have identified many security risks these apps exposed. The main risk exposed is the storing of sensitive data in the clear at rest. Ok if the device is lost/stolen a pin is required for access (say 1111) but one trick - when you have the the pin - that can be used is through performing a backup of the app and data from the MDM device and then restore this onto a root device

1
  • Your last sentence is very confusing. Can you take another crack at it?
    – schroeder
    Nov 10, 2016 at 7:34
1

An MDM makes a mobile device less-secure. It exposes a greater attack surface, notable via the MDM certificate which allows an additional vector of non-OEM signed code to install and execute.

For iOS devices in particular, the GSM and WiFi network interfaces are not available for a password reset via an MDM if a device is booted from a powered-off state -- however, this is not true if one can configure the device with a physical Ethernet interface (say, over Lightning-to USB and then USB-to Ethernet).

At BlackHat US 2016, there was a presentation by Vincent Tan named Bad For Enterprise: Attacking BYOD Enterprise Mobile Security Solutions -- video here -- https://www.youtube.com/watch?v=eoIlB6hi_08

At RSACon 2014, Michael Shaulov gave a presentation on Practical Attacks Against MDM Solutions -- slide deck here -- http://www.rsaconference.com/writable/presentations/file_upload/mbs-r02-practical-attacks-against-mdm-solutions-v2.pdf

BitGlass also dropped a video on MDMayhem: How MDM Software Exposes Personal Data -- https://youtu.be/7eiFcIMWtwE

2
  • 1
    This is a great list for MDM, but I'm not sure these answer the question about apps in an MDM environment. Is your point that one should not consider MDM as a secure factor and therefore testing of apps is required?
    – schroeder
    Nov 10, 2016 at 7:37
  • MDM apps themselves should be tested first, but, yes -- the overall risk to Board & Officer mobile devices (to include laptops, tablets, smartwatches, IoT) should be considered for both security, ERM, and insurer purposes. Test and verify!
    – atdre
    Nov 10, 2016 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.