IOS users Scan to Connect to the AppSec California Wireless Network Open the URL in Safari
2
Architectures: - Client Server Model - Email/URL/Application enrollment -One Time Application Profiles typically deployed from
3
Direct USB Connection -iPhone Configuration Utility
4
Post Deployment Exploitation -Wireless Attack
5
Post Deployment Exploitation -Application Attacks Custom Applications
6
Post Deployment Exploitation -So you have credentials... Single Factor VPN (PPTP) - Internet facing authentication
7
Preventions -Start with clean phones, then
Description:
Explore the potential security risks of Mobile Device Management (MDM) in this OWASP AppSec California 2015 conference talk. Delve into the basics of MDM functionality and learn how attackers can exploit Apple's MDM service to gain control over iOS devices. Discover techniques for deploying malicious MDM configurations and leveraging company phones to access internal networks. Gain insights into protecting your business from rogue MDM profiles and understand the implications of various MDM architectures, including client-server models and enrollment methods. Examine post-deployment exploitation techniques, such as wireless attacks and application vulnerabilities. Learn about preventive measures and best practices for securing mobile devices in corporate environments.
Malicious MDM: Exploiting iOS MobileConfigs for Device Control