Duo Security uncovers vulnerabilities in Apple's managed device program

The problem has surfaced because Apple only requires device serial numbers to verify users

iPhone X with notch

Duo Security has uncovered a major vulnerability in Apple's Device Enrollment Programme that could affect devices automatically provisioned for business use.

The problem lies in the authentication of devices, potentially allowing hackers to enrol any device in an organisation's MDM (mobile device management) server, gaining access to privileged information. The access is granted because not all organisations have user authentication enabled. Apple's documentation doesn't mention that it's needed and so some firms may assume the MDM does this.

The problem with only using a serial number to add devices to a DEP is that these are often available freely online and they are not considered 'secret' information that needs to be encrypted, so sometimes are inadvertently revealed.

Advertisement - Article continues below

Another problem identified by the researchers revealed that an attacker could find serial numbers of devices using open source intelligence, brute force attacks or social engineering. Because the DEP provides data such as phone numbers and email addresses, a criminal could attack the company's help desk or IT team.

Because Apple doesn't use anything but the devices serial number to identify the user as a necessity, it's quite easy for criminals to break in. If Apple made it a requirement for businesses to also insist upon user authentication as a security method, businesses would be better protected against these attacks.

Advertisement - Article continues below

"Or in configurations where an associated MDM server does not enforce additional authentication, a malicious actor can potentially enrol an arbitrary device into an organization's MDM server," James Barclay senior R&D engineer at Duo Security said.

"The ability to enroll a chosen device to an organization's MDM server can have a significant consequence, subsequently allowing access to the private resources of an organization, or even full VPN access to internal systems."

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now



K2View innovates in data management with new encryption patent

28 May 2020
video conferencing

Zoom 5.0 adds 256-bit encryption to address security concerns

23 Apr 2020

WhatsApp flaw leaves users open to 'shoulder surfing' attacks

21 Apr 2020
cyber security

Microsoft AI can detect security flaws with 99% accuracy

20 Apr 2020

Most Popular

Microsoft Windows

Microsoft warns users not to install Windows 10's May update

28 May 2020
Server & storage

Dell EMC PowerEdge R7525 review: An EPYC core density to make Intel weep

26 May 2020
Network & Internet

Intel releases Wi-Fi and Bluetooth driver updates for Windows 10

26 May 2020