Slashdot Mirror

← Back to Stories (view on slashdot.org)

MDM Vulnerability In Apple iOS Sandbox Facilitates 'Rogue Apps'

Posted by Soulskill on from the that's-the-one-with-the-lion-right? dept.

An anonymous reader writes: A vulnerability in Apple's iOS sandbox, which could affect personal information as well as configuration settings, has been discovered by Appthority's Enterprise Mobility Threat Team. It affects all mobile device management (MDM) clients, and any mobile applications distributed by an MDM that use the "Managed App Configuration" setting for private data. An attacker could potentially create a rogue app, perhaps masquerading as a productivity tool to increase the chances of it getting installed, and then distribute the attack by means of the iTunes store or "spear fishing" email attacks.

1 of 13 comments (clear)

  1. Has been fixed in iOS 8.4.1 by Mojo66 · · Score: 3, Interesting

    From the article:

    We’ve worked directly with the Apple Security Team since this was discovered leading to the fix rolled in the latest iOS update (8.4.1).

    Although this sandbox violation has been patched by Apple, the patch only protects devices which update to iOS 8.4.1; Appthority has identified that up to 70% of iOS devices are not running the latest version of iOS, even several months after an update is issued.

    A good ./ submitter would have read the complete article and recommended in the summary to upgrade to 8.4.1.