A new iOS Exploit Works only on Devices which are Managed

A new iOS Exploit Works only on Devices which are Managed 

Researchers found out that they can insert a scrote profile in an enterprise-configured iOS device requiring phishing to work. A new method to infect iOS with malware seems unlikely but easily possible except in very particular circumstances.

Researchers on Thursday at the Black Hat Asia 2016 conference summarized how iOS devices enrolled in a business-scale management system can be compromised via phishing without getting traced. A seemingly-genuine message can lead a user to click a link and install a certificate without additional alerts present in non-managed systems, and then be vulnerable to a varied range of attacks. This would only affect people using iOS on enterprise.

This unfortunately is influential for third-party app stores in China, which rely on enterprise certificates to bypass Apple's protections. This is something Apple and enterprise risk-mitigation software companies should constantly monitor and keep track of. Apple restricts installing apps in iOS to those obtained via its App Store, with a couple of footnotes.

The other method is designed for enterprises via the Apple Developer Enterprise Program. Members of this program get a certificate that they can distribute to iOS users connected to a company, which allows software written in-house to be installed outside of the mainstream App Store. This mechanism is now being abused to create unauthorized applications to the app stores specifically in china without users in need of a jail-broken phone to access these unauthorized apps.

Even though dangerous, Chinese consumers are used to not having direct access to the same online sources such as folks outside that the government filters and restricts. Misuse of enterprise accounts has been discovered before in order to confuse consumers into installing unwanted software. Apple however are quickly able to revoke those licenses immediately. An update will be pushed out when the exploits are discovered relying on broken parts of the system codes which will still be working till the update is installed by a user. Apple immediately blocks the misuse upon receiving reports and looking on it thereby preventing any misuse. Researchers at Checkpoint said it had notified of their research back in October 2015 and Apple replied back that it wasn't a product flaw. Apple said that "it was a clear example of phishing attack that attempts to trick the user installing a configuration profile and then installing an app.This is not an iOS vulnerability. We've built safeguards into iOS to help warn users of potentially harmful content like this.We also encourage our customers to download from only a trusted source like the App Store and to pay attention to the warnings that we've put in place before they choose to download and install untrusted content."