Black Box Version 1.0 Bedienungsanleitung PDF herunterladen (Seite 22)

Man in the Middle

• Use standard MITM techniques

–Wi-Fi trickery, forge SSL cert, etc.

• Or, since you have physical access to device:

–Get onto device

–Add entries to /etc/hosts

–Install your own certificate

Duplicate MDM Profile

• Gain access to device filesystem

–Use DFU / tethered boot magic

• Retrieve copy of MDM profile “stub”

–In /var/mobile/Library/ConfigurationProfiles

• Extract original MDM profile from stub

–It’s in there, base-64 encoded

• Might be able to get from the legit server

There are many ways to get into the middle of the MDM conversation. If

the MDM server uses HTTPS (and it should), then some SSL trickery

may be required, either to exploit weaknesses in certiﬁcate validation, or

to somehow get a forged (but apparently signed) cert, or to place a

rogue CA cert onto the device.

The tricky bit is that the proﬁle being re-installed must match *exactly*

with what the device already has. This is made much easier by the fact

that a copy of the proﬁle is stored on the device, and can be easily

retrieved.

Alternatively, if every single device in an organization uses the same

proﬁle to install MDM (using SCEP services instead of bundling a device

identity cert), then it might be possible to simply acquire a copy from

another device. (This could make the “Evil Lackey” variant described

later much easier to accomplish.)

1 2 ... 17 18 19 20 21 22 23 24 25 26 27 ... 30 31

Keine Kommentare

Black Box Version 1.0 Bedienungsanleitung Seite 22