3

From The Verge (March 2016):

The new attack takes advantage of less rigorous software controls for corporate device users, particularly those who use Mobile Device Management solutions (or MDMs) to get apps delivered to their phones.

Granted this article is from 2016, but does MDM software installed on a smartphone make it more insecure?

1 Answer 1

3

The white paper provided has more details

However, MDMs can also be exposed to Man-in-the-Middle (MitM) attacks. These attacks can allow easy installation of malicious enterprise apps over-the-air, because Apple gives apps installed using MDMs a free pass from heightened security measures.

and then later as they explain how the attack is levereged

Wait for a command to be sent to an iOS device by an MDM: then, using a MitM attack, intercept and replace the command with a request to install a malicious app. The iOS device will fetch from the remote enterprise app server and install it.

The actual white paper doesn't go any further than "use MITM" and I'm very suspicious that this actually works due to the implementation of Apple's MDM protocol.

To understand why I highly doubt this attack actually works as described, you need to understand the crypto which runs the whole process. The gist of it is explained here by Apple:

When the MDM payload is installed, the device initiates communication with the check-in server. The device validates the TLS certificate of the server, then uses the identity specified in its MDM payload as the client authentication certificate for the connection.

The check-in server referenced here is the MDM server. The important part to notice is that they'll need both a trusted certificate for the MDM server's domain and the cryptographic trust identity established between the device and the server during enrollment before they can impersonate and issue commands as the MDM server. Meaning if you wanted to impersonate the MDM server you'd need to hack their MDM server and steal the keys which is no longer an MITM and just a straight up attack.


I'm not sure what Checkpoint's game here is but their threat model is fundamentally broken and verging on a FUD campaign. They made mountains out of molehills (without even verifying that it's possible) because they found that an MDM server can make a device trust an enterprise signing certificate. This is the expected behavior! The point of an MDM server is to fully manage a device and that means it can add certificates to the system trust store and also forcibly proxy network traffic. This isn't a vulnerability, this is the intended behavior. Apple warns you about this when you're installing an MDM.

Checkpoint didn't find a vulnerability. If they cracked the MDM protocol's crypto then we'd have a HUGE problem on our hands and it would be worthy of a vulnerability name. I can fairly confidently say SideStepper is marketing bunk aimed at selling Checkpoint's security products.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.