https://duo.com/labs/research/mdm-me-maybe https://i.blackhat.com/us-18/Thu-August-9/us-18-Endahl-A-Dee...
Could per-app VPNs be used without DEP? If so, could they be used with MicroMDM, native iOS IPSEC client and an open-source VPN server, or is a 3rd-party VPN client like Cisco required for per-app VPN?
DEP is not required for the VPN profile configs, that can be applied with just MDM (or even manually). The VPN payloads are documented here https://developer.apple.com/enterprise/documentation/Configu...
Duo very nicely gave multiple shout outs in their post. Including to zalmoxes (above), as well as my co-presenter and I. Sadly the traditional vendors in the space don’t have a track record of caring about security engineering. I’m glad that Duo’s latest research emphasizes the importance of authenticating the device enrollment process in particular. We touched on this in our whitepaper^, but it wasn’t a primary focus of our research and we didn’t tie it back to the shortcomings of DEP’s lack of verification around device identity. Extremely happy to see more focus on this stuff.
^See the vendor security checklist section of our whitepaper. Specifically, the bit about using an HMAC within the SCEP payload.
Full transparency: I’m cofounder/CSO of a security focused product in the MDM space (fleetsmith.com).
Negativity aside, I applaud the effort. The MDM space is messy and crowded with bloated products. I hope these guys can at the very least pop the bubble a bit.
I think Apple is happy with the current state of MDM servers--several good 3rd-party options, both self-hosted and cloud.
I'm not sure it would be worthwhile setting up for personal use -- the policies it lets you set aren't doing anything other than ensuring you're following best practices (like setting a screen lock) so you don't gain anything over just doing that, and the direct management tools aren't any finer-grained than you can get from Google's Find My Device.
I'm not sure you're able to set up a linked "for work" profile without MDM; that might be a benefit if you want compartmentalisation.
That said, it might be more straightforward to just use another user on your device
If you have a lot of devices (think 10+) I guess it could be useful to keep them aligned. It could also be useful as training on how to centrally manage devices.
But I would not recommend using a MDM unless you have a specific reason. Personal devices that you have physical control over are easy to manage locally on the device. Adding a MDM also adds another attack vector, if the MDM is compromised all your devices are at risk.
I don't own anything apple, so I'm unlikely to ever run this MDM, but, if a good Android one came to my attention.. maybe? I'm geeky enough to enjoy doing it, even if it comes with no real benefits to me.
I think the major benefit is that this way you control the MDM, and you don't risk that a MDM gets installed on your phone unexpectedly, sort of like a rootkit.
> Your Apple ID is already associated with a Team Agent enrolled in this program
The nice part is I can use the same profile on a Mac too.
MDM is a very “enterprisey” market for Apple specifically, historically they’ve been more than happy to let others fight for the few dollars it typically brings in relative to their giant consumer/hardware businesses. Even Tim Cook has made the argument that letting businesses like IBM handle the enterprise cruft helps keep Apple’s focus on just making great consumer products.
> https://www.recode.net/2014/7/15/11628872/apple-and-ibm-ceos...
If the device was purchased on or after March 1st 2011 you can do the following:
1. Work with your reseller if they participate in DEP to get the devices enrolled retroactively. Sometimes you have to put the nails on the reseller (they can pretty bad about this. Looking at you Verizon) but it absolutely can be done.
2. If your devices are eligible and were a direct purchase from Apple you should contact Apples enterprise support and they can start the process of double checking eligibility and getting those devices enrolled accordingly. This is pretty straightforward.
3. You can enroll eligible devices via Apple Configurator 2 into DEP using the process described here:
https://help.apple.com/configurator/mac/#/cad99bc2a859
Using Apple Configuratior 2 will allow you to bypass any reseller to enroll into DEP so it’s your best move if you are having issues getting people to do it fast enough. Any eligible device can be enrolled this way
Here’s a relevant help link with phone numbers more On eligibility and enrolling etc
https://support.apple.com/en-us/HT204142#manual
I see this misinformation so much so please help share it if you can
https://support.jamfnow.com/hc/en-us/articles/360000004483-U...
So you need to provide a DEP-authorized account number to the salesperson in an Apple store? Is this possible when buying online from apple.com?
Any idea why Apple does not provide a service to test whether a device serial number is DEP-managed? It would deter attempts to resell DEP-managed devices.
Any idea why Apple does not provide a service to test whether a device serial number is DEP-managed?
Because once you know the serial number of a DEP device you can enroll into the MDM. There is virtually no security. See https://duo.com/labs/research/mdm-me-maybe
> an attacker that obtains such a serial number ... will be able to enroll a device of their own as if it were owned by the organization, as long as it's not currently enrolled in the MDM server.
So, the rule is at-most-once enrollment.
And further down:
> some organizations elect not to require user authentication as part of MDM enrollment.
IOW, if you are not enabling authentication, you have only yourself to blame.
Commercial MDM providers only whitelist a handful of VPN client apps for per-app VPN profiles. Why are those needed when there is already a native iOS VPN client for IPSEC?
That's all commercial vendors do, push these XML files to your device.