20 Mar 2014

The-Invisible-Profile-Patched-in-iOS-7.1

a-
A+
Customize font size:
Share:

hree weeks ago we wrote about the Invisible Profiles issue that we had identified and reported to Apple. We are happy to announce that Apple’s issue of iOS 7.1 last week includes (among other improvements) a patch for this security issue. Once iOS 7.1 is installed, if the user installs a new “invisible malicious profile”, iOS now handles it correctly – meaning that the profile is visible both in the Profiles list, and via MDM querying. However, please note that invisible profiles that were installed on the device prior to the iOS 7.1 upgrade remain invisible to the user.

Following our presentation at RSA USA 14’, we have decided to share some supporting materials about the bug:

 

  1. The RSA presentation deck

  2. Recorded demonstrations of possible attack flows

  3. Technical details

RSA Deck

Invisible Profile Attack Flow

The following movie demonstrates the attack flow and impact of invisible malicious profiles.

MDM Piggybacking Attack Flow

The following movie shows the impact of utilizing malicious profiles to exploit inherent limitations of the iOS MDM protocol, as previously identified by David Schuetz’s great work around MDM security.

Technical Details

By creating a specially crafted configuration profile (setting the PayloadIdentifier key with an overlong value), an attacker might be able to install (through either physical access or social engineering), configuration profiles that, once installed, are invisible on the victim’s device.

Steps to reproduce:

  1. Create a configuration profile with an overlong PayloadIdentifier key value.

  2. Install the profile on a pre 7.1 iOS device.

  3. After installation, go to Settings > Profiles and look for the new profile (you won’t find it).

  4. Verify that the profile was indeed successfully installed by performing a measurable change, such as setting a proxy for a Wi-Fi network, or setting up a VPN on the device.

Result:

  1. The configuration that is embedded in the profile is successfully applied to the system.

  2. When the Profiles list is viewed after the installation is complete, the profile’s existence does not show up.

Impact:

By its nature this bug leads to two main problems:

  1. The victim is probably not aware of – and would have hard time discovering – the existence of invisible profiles already installed on the device.

  2. The victim cannot remove an invisible profile without taking drastic, inconvenient measures such as device reset.

Acknowledgements:

I’d like to thank Apple’s security team for their responsiveness and constant dedication to the security of Apple’s customers.