The vulnerability in Apple device enrollment allows hackers to steal passwords
Most large corporations prefer to purchase for smartphones and Apple computers, because I think that they are the most protected compared to available alternatives running the operating systems Android and Windows. Part they are right, but not quite.
Computer security researchers have discovered a vulnerability in one of Apple services, which lets hackers steal passwords from Mac OS and iOS devices.Apple have actively focusing on the corporate segment. In Cupertino have entered into partnerships with IBM, Accenture and Salesforce for building business applications. iPhone, iPad and Mac should be carefully used in the corporate segment.
Discovered a vulnerability in the device enrollment program Apple
Researchers from Duo Security have discovered a problem in the device enrollment program (DEP), which helps manage corporate smartphones and computers. The vulnerability allows hackers to steal passwords from Wi-Fi and apps.
Hacking takes place in several stages: registration in the system DEP with subsequent authentication at the server mobile device management company (MDM). It uses several methods.
Hacking MDM server
One of the easiest ways for hackers using social engineering to find the serial number of the device that is already registered in the system DEP but not yet configured on the server.
Alternatively, hackers can use the search on the forums for MDM products, where employees publish a serial number to receive technical support. Another way is to use a utility to “brute force”, which by the method of cyclic busting endless character combinations will select the required number. After the attackers will then register the device on the MDM server, they can retrieve passwords from applications and Wi-Fi networks, which are used in the company.
This method as explained by Forbes:
“An attacker would have to register your device on the MDM server of the company until such time as you do it employee. The serial number will be accepted only once”
According to researchers from the Duo, it’s not as difficult as it seems. Hackers enough to find a database of serial numbers of Apple devices made in the last 90 days.
“It is likely that there will come across a device that has not yet passed the registration process”
according to security researcher software James Barclay.
The vulnerability should not be cause of rejection of the system DEP or MDM. There are several ways to prevent similar break-ins. Duo encourages companies to use encryption technology on the chip, while Apple could implement a more secure authentication method.
Apple knows about the problem
Duo Security reported this issue to Apple in may this year. In Cupertino has not commented on the situation. James Barclay is confident that the problem will be fixed soon.