Apple's Device Enrollment Program Can Leak Sensitive Data About Devices, Owners (betanews.com)

Mark Wilson shares a report from BetaNews: Security researchers have discovered an issue with the Device Enrollment Program used by Apple to allow organizations to manage their MacBooks and iPhones. Duo Security says that using nothing more than a serial number, it is possible to gain access to sensitive data about enrolled devices and their owners. It is even possible to enroll new devices that can then access Wi-Fi passwords, VPN configurations and more. Apple was alerted to the issue way back in May, but has not done anything about it as the company does not regard it as a vulnerability. James Barclay from Duo Security, and Rich Smith from Duo Labs share their findings in a paper entitled MDM Me Maybe: Device Enrollment Program Security. They point out that while there are various easy ways to obtain devices' serial numbers, the researchers have been able to create a simple serial generator that can be used to search for information. In regard to the serial generator, Smith told CNET: "While we aren't releasing the code, I'm not going to pretend to be under the impression that this is something that can't be reproduced. It would not be difficult for someone to replicate the code that we've developed."

Comments

I wish I'd known about this sooner

[drinkypoo]

Some jerkoff signed up for an apple account with my email address. Apple let them do it without confirming it, too. It was for an iPad, probably stolen if they were activating it with a stolen identity.