Mobile Device Mismanagement
summary
Penetration testing of enterprise MDMs finds predictable enrollment tokens (TinyURL‑style), secret tokens leaked in certificate CNs, default admin credentials and SQL/XXE injections that lead to remote code execution on servers. Devices send base64 payloads containing plain‑text domain credentials and WPA keys; servers often accept messages lacking PKCS7 signatures so attackers can impersonate UDIDs, force wipes, DOS or pull profiles. Proof‑of‑concept uses Burp and a Burp extension to resign messages to intercept responses; vulnerabilities are disclosed and some patches are issued but several remain unpatched.
AI-written summary · about
chapters (12)
- 0:00Start
- 0:49Overview
- 1:10Introduction
- 2:51The Mdm Market
- 7:10Penetration Testing
- 10:08Ios Mdm
- 10:57Ios Enforces an Api for Mdm
- 12:09Enrollment Process
- 17:40Routine Communication between the Device and the Server
- 26:59Injection Flaws
- 33:14Firewalling Off the Mdm Server
- 40:07Software Development Lifecycle
related talks
23mMalicious MDM: Fun with iOS MobileConfigs
37mEnterprise Apps: Bypassing the IOS Gatekeeper
40mIntegrating Mobile Devices into your Penetration Testing Program
39mWindows Agentless C2: (Ab)using the MDM Client Stack
01h 01mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
48mMobile Security Attacks: A Glimpse from the Trenches
54mThe Perimeter Has Been Shattered: Attacking and Defending Mobility and IoT on the Enterprise Network
39mBad for Enterprise: Attacking BYOD Enterprise Mobile Security Solutions