Duo Security uncovers vulnerabilities in Apple's managed device program

The problem has surfaced because Apple only requires device serial numbers to verify users

iPhone X with notch

Duo Security has uncovered a major vulnerability in Apple's Device Enrollment Programme that could affect devices automatically provisioned for business use.

The problem lies in the authentication of devices, potentially allowing hackers to enrol any device in an organisation's MDM (mobile device management) server, gaining access to privileged information. The access is granted because not all organisations have user authentication enabled. Apple's documentation doesn't mention that it's needed and so some firms may assume the MDM does this.

The problem with only using a serial number to add devices to a DEP is that these are often available freely online and they are not considered 'secret' information that needs to be encrypted, so sometimes are inadvertently revealed.

Another problem identified by the researchers revealed that an attacker could find serial numbers of devices using open source intelligence, brute force attacks or social engineering. Because the DEP provides data such as phone numbers and email addresses, a criminal could attack the company's help desk or IT team.

Because Apple doesn't use anything but the devices serial number to identify the user as a necessity, it's quite easy for criminals to break in. If Apple made it a requirement for businesses to also insist upon user authentication as a security method, businesses would be better protected against these attacks.

"Or in configurations where an associated MDM server does not enforce additional authentication, a malicious actor can potentially enrol an arbitrary device into an organization's MDM server," James Barclay senior R&D engineer at Duo Security said.

"The ability to enroll a chosen device to an organization's MDM server can have a significant consequence, subsequently allowing access to the private resources of an organization, or even full VPN access to internal systems."

Featured Resources

Key considerations for implementing secure telework at scale

Identifying the security risks and advanced requirements of a remote workforce

Download now

The State of Salesforce 2020

Your guide to getting the most from Salesforce

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Rethink your cybersecurity strategy for the new world

5 steps to secure the enterprise and be fit for a flexible future

Download now

Recommended

Andrew Daniels joins Druva as CIO and CISO
Cloud

Andrew Daniels joins Druva as CIO and CISO

22 Jul 2020
University of California gets fleeced by hackers for $1.14 million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Australia announces $1.35 billion investment in cyber security
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
CSA and ISSA form cyber security partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

3 Aug 2020
How to use Chromecast without Wi-Fi
Mobile

How to use Chromecast without Wi-Fi

4 Aug 2020
How do I fix the Windows 10 Start Menu if it's frozen?
operating systems

How do I fix the Windows 10 Start Menu if it's frozen?

3 Aug 2020