Fighting the recent Apple DEP “vulnerability” with Workspace ONE UEM (AirWatch)

There’s been recently a wave of news along the  “OMG Apple DEP is insecure we are all doomed” line. While there is indeed a few flaws in Apple Device Enrollment Program, I want to show how to fight it with Workspace ONE UEM (AirWatch) in a simple 3-step process

Step 1: Go to your DEP profile in Settings -> Devices -> Apple -> Device Enrollment Program

Step 2: Ensure Authentication is ON

Step 3: You are done. Really, this “vulnerability” is only serious in two cases:

• Using no authentication, implicitly trusting anything that comes from the Internet over DEP
• Staging (specifically using the staging process with the staging user) sensitive information – certificates, etc. Just don’t – have all the sensitive bits assigned to the end-user who has to authenticate.

So, now you are armed with knowledge!

More reading:

• A deeper look at DEP from the very same Duo Security (how many Twitter reposters have actually found it at all? 🙂 )
• An even deeper look into DEP security from BlackHat if you really want to hack someone explore further possibilities
• WS1 UEM DEP Guide with this and other cool features.
• DEP Best Practices from WS1 UEM – Security etc.

Advertisements

Securing work contacts while keeping caller ID 03: iOS with Boxer

I had a week of customer meetings, each (literally!) asking the same question: “How can I prevent WhatsApp from grabbing the corporate contacts on my device?”

In this series of posts we will explore the options of deploying corporate email/contacts/calendars with the goal of maximal work/personal contact separation, while trying to minimally impair the user experience (such as the Caller ID).

Table of contents:

• Introduction and common principles (avoid repeating)
• Android Work Profile
  • Bonus: In-depth on Allow work contacts in personal contacts app
• [This post] Fully containerized iOS with Boxer
  • Bonus: iOS managed contacts with EAS profile (iOS 11.3+)

Securing work contacts while keeping caller ID 02: Android

I had a week of customer meetings, each (literally!) asking the same question: “How can I prevent WhatsApp from grabbing the corporate contacts on my device?”

In this series of posts we will explore the options of deploying corporate email/contacts/calendars with the goal of maximal work/personal contact separation, while trying to minimally impair the user experience (such as the Caller ID).

Table of contents:

• Introduction and common principles (avoid repeating)
• [This post] Android Work Profile
  • Bonus: In-depth on Allow work contacts in personal contacts app
• Fully containerized iOS with Boxer
  • Bonus: iOS managed contacts with EAS profile (iOS 11.3+)

Securing work contacts while keeping caller ID 01: Android vs iOS

I had a week of customer meetings, each (literally!) asking the same question: “How can I prevent WhatsApp from grabbing the corporate contacts on my device?” This happens more often than you think – the infamous GetContact collected over 3.5B contacts in just a few months, all of which were officially available for sale! With GDRP in effect, how much could this cost?

Of course, both iOS and Android offer means to securely lock down enterprise data on BYOD devices. But this comes at a price of usability, the most cited problem being the caller it. We know that in the modern day an unhappy and discomforted user is essentially a backdoor waiting to happen. How can we keep this balance between security and productivity?

In this series of posts we will explore the options of deploying corporate email/contacts/calendars with the goal of maximal work/personal contact separation, while trying to minimally impair the user experience (such as the Caller ID).

We will explore several approaches, their limitations and shortcomings for iOS and Android. This post lays the foundations and provides a TL:DR style summary/comparison of my current findings.

Table of contents:

• [This post] Introduction, common principles, comparison/summary
• Android Work Profile
  • Bonus: In-depth on Allow work contacts in personal contacts app
• Fully containerized iOS with Boxer
  • Bonus: iOS managed contacts with EAS profile (iOS 11.3+)

WorkSpace ONE Intelligence Custom Reports available + Free Trial of other features

Legacy AirWatch reports are being deprecated, and replaced by the next-generation Workspace ONE Intelligence Reporting. The point of this quick post is to provide a bullet-style quick overview and resources for further reading.

TL:DR

1. they are cool, customizable, and free* (=included in all UEM v9.2.3+ license types ,  cloud and on-prem).
2. There are even cooler features (custom dashboards, automation), which are premium, but a free 30-day trial is available.

Does Android P private DNS really contribute to privacy? Or to Enterprise control?

Private DNS is a new feature in Android P, which allows you to globally override the DNS settings (received from your carrier, hotspot provider etc.). This means that the said carrier’s or provider’s DNS servers will not be able to log your browsing habits.

Read more here (Android Police).

Private DNS configuration (c) Android Police

This looks like privacy, but isn’t necessarily so…

iOS Trustjacking protection with EMM

Trustjacking is a new “scary” attack on iOSnew “scary” attack on iOS devices, exploiting user’s lack of understanding or what’s going on. When plugging into an unknown computer or charger user may choose to “trust” it, which allows the remote device quite a degree of access to iPhone/iPad data. Many don’t realize that this trust remains after the device is disconnected and may be exploited, for instance, via Wi-Fi, if Wi-Fi sync is enabled. Many others also think that this trust is necessary for charging.

What is really should read: “Your settings and data will be accessible from this computer even after disconnected. You DON’T need this for charging”

Basically, Apple should have looked at how Android 6+ has a “charge only” USB mode by default, fixed the wording and be done with it.

Protecting from this attack is extremely simple on Supervised (DEP) devices via EMM.

Here’s how it’s done via AirWatch, but any other major EMM will have something similar – this is Apple’s standard OS feature.

iOS Trustjacking protection: it only takes one tick

As a bonus, this will prevent not just the Trustjacking attack, but many other threats and leaks, since it blocks everything.

Wondering, how many had this configured before the Trustjacking news?