Slashdot Mirror
Apple's Device Enrollment Program Can Leak Sensitive Data About Devices, Owners (betanews.com)
Mark Wilson shares a report from BetaNews: Security researchers have discovered an issue with the Device Enrollment Program used by Apple to allow organizations to manage their MacBooks and iPhones. Duo Security says that using nothing more than a serial number, it is possible to gain access to sensitive data about enrolled devices and their owners. It is even possible to enroll new devices that can then access Wi-Fi passwords, VPN configurations and more. Apple was alerted to the issue way back in May, but has not done anything about it as the company does not regard it as a vulnerability. James Barclay from Duo Security, and Rich Smith from Duo Labs share their findings in a paper entitled MDM Me Maybe: Device Enrollment Program Security. They point out that while there are various easy ways to obtain devices' serial numbers, the researchers have been able to create a simple serial generator that can be used to search for information. In regard to the serial generator, Smith told CNET: "While we aren't releasing the code, I'm not going to pretend to be under the impression that this is something that can't be reproduced. It would not be difficult for someone to replicate the code that we've developed."
Some jerkoff signed up for an apple account with my email address. Apple let them do it without confirming it, too. It was for an iPad, probably stolen if they were activating it with a stolen identity.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Lol HAHA
No they don't.
The "vulnerability" they've exposed is really just an easier way to discover organizations using insecure configurations. Organizations already have the ability to lock this issue down, should they choose to do so.
More or less, some organizations don't require authentication before a device can enroll in the organization, meaning that anyone at all can join their organization. If those organizations then foolishly configured things such that each enrollee is pushed a list of WiFi networks and VPNs belonging to the organization, guess what happens? Anyone at all can join their organization and receive that information, exactly like they configured it to work.
What these researchers discovered was an easier way to identify those organizations. Using a device's serial number, they can now query to find out whether the device is enrolled in an organization, and if it is, whether that organization requires authentication. Randomly generating serial numbers lets them scan through organizations in a rapid fashion. It's really not that much different than using a port scanner: it isn't an attack in and of itself, but it can reveal an avenue for attack.
last Saturday. Did they sign me up for this without telling me? My phone works much better especially my GPS that hasn't worked in almost two years, but they killed my headphone jack so I'm annoyed.
Yeah two major points here:
It can be used to find out which *company* is managing the device. If your company set up an iPad for you and registered into the company's security system that requires anti-virus and such, and the company used Apple's service, that information can be revealed. So "this iPad is managed by Toyota". It does not affect personally owned and managed devices, revealing the fact that a person owns an iPad.
IF the company doesn't require authentication such as a user name and password, it can also reveal some other non-secret information that all employees of the company have. Specifically non-secret information about the name of the VPN server. Just like a https web server has a public certificate which you can view by clicking on the green lock icon in your browser, some VPN servers have a certificate. This is not a secret.
If an attacker wanted to attack your VPN server, having it's name might come in handy, but it's not secret.
Our Apple rep told us that DEP will be *mandatory* if you want to have any meaningful management of devices your company owns. So, all your Apple devices tied back to Apple. Yeah, that's going to go well.
https://tech.slashdot.org/comments.pl?sid=12520486&cid=57184660 - Nazi white supremacist RAY (PUNK ASS) MORRIS caught lying and gets force-fed loads of BBC. RAPE THIS LYING TRAITOR AND HIS NAZI HEROES IN PRISON!