<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-mobile-mdm-security-assessment
description: >-
  Assess Mobile Device Management deployments for misconfigurations, policy
  bypass vulnerabilities, enrollment weaknesses, and profile injection risks
  across iOS (Apple MDM) and Android (Android Enterprise) using profile
  analysis, API testing, and device compliance verification.
domain: cybersecurity
subdomain: mobile-security
tags:
  - mdm
  - device-management
  - apple-mdm
  - android-enterprise
  - enrollment
  - compliance
  - profile-analysis
  - intune
  - jamf
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1398", "T1406"]
  owasp-mobile: ["M1", "M6"]
  tools: ["cfgutil", "ideviceinstaller", "adb", "openssl"]
---

# Performing Mobile MDM Security Assessment

## Overview

MDM solutions enforce security policies on managed devices—encryption, passcode
complexity, app restrictions, and remote wipe. Assessment targets enrollment
flows, profile configurations, API authentication, certificate management, and
policy enforcement gaps that allow bypass or unauthorized access.

## Prerequisites

```bash
# iOS tools
brew install libimobiledevice ideviceinstaller
pip install biplist

# Android tools
apt install adb
pip install frida-tools

# Certificate analysis
apt install openssl
```

## Workflow

### Step 1: Enrollment Flow Analysis

```bash
# iOS — capture enrollment profile
# Navigate to enrollment URL, intercept .mobileconfig
curl -o enrollment.mobileconfig https://mdm.corp.com/enroll/profile
openssl smime -verify -in enrollment.mobileconfig -inform DER -noverify

# Examine profile contents
plutil -p enrollment.mobileconfig
# Check: ServerURL, CheckInURL, Topic (APNs), challenge token

# Android Enterprise — inspect managed provisioning
adb shell dumpsys device_policy
adb shell pm list packages -e | grep -i mdm
adb shell settings get secure device_provisioned
```

### Step 2: Configuration Profile Audit

```bash
# iOS — list installed profiles
ideviceprovision list
cfgutil get-profile

# Extract and examine profile payloads
security cms -D -i profile.mobileconfig > profile_decoded.plist
plutil -p profile_decoded.plist

# Critical checks:
# - PayloadType: Configuration / MDM
# - HasRemovalPasscode: should be true
# - IsSupervised: should be true for managed devices
# - VPN configuration: certificate vs shared secret
# - Wi-Fi: WPA-Enterprise vs cleartext password

# Android — inspect device owner policies
adb shell dumpsys device_policy | grep -A5 'admin='
adb shell dumpsys restriction | head -50
```

### Step 3: Policy Enforcement Testing

```bash
# Test passcode policy enforcement
adb shell locksettings set-disabled false
adb shell locksettings set-pin 1234  # should fail if policy requires complex

# Test app installation restrictions
adb install unauthorized_app.apk  # should be blocked

# Test USB debugging policy
adb shell settings get global adb_enabled

# iOS — check supervised restrictions
ideviceinfo -q com.apple.mobile.lockdown | grep -i supervised
ideviceinfo -q com.apple.mobile.restriction

# Check camera/screenshot restrictions
adb shell dumpsys device_policy | grep -i 'camera\|screenshot\|keyguard'
```

### Step 4: Certificate and Authentication Testing

```bash
# Extract MDM client certificates
ideviceprovision dump > provisioning_profiles.txt

# Check certificate validity and chain
openssl x509 -in mdm_cert.pem -text -noout
openssl verify -CAfile ca_chain.pem mdm_cert.pem

# Test APNs push certificate
openssl s_client -connect gateway.push.apple.com:2195 \
  -cert mdm_push.pem -key mdm_push_key.pem

# Check SCEP endpoint security
curl -v https://mdm.corp.com/scep?operation=GetCACert
```

### Step 5: API Security Assessment

```bash
# Enumerate MDM API endpoints
curl -s https://mdm.corp.com/api/v1/ -H "Authorization: Bearer TOKEN"

# Test authentication bypass
curl -s https://mdm.corp.com/api/v1/devices -H "Authorization: Bearer invalid"
curl -s https://mdm.corp.com/api/v1/devices  # no auth header

# Check for IDOR — access other device records
curl -s https://mdm.corp.com/api/v1/devices/OTHER_DEVICE_ID \
  -H "Authorization: Bearer TOKEN"

# Test command injection via device name
curl -X PUT https://mdm.corp.com/api/v1/devices/ID \
  -H "Authorization: Bearer TOKEN" \
  -d '{"device_name": "test$(whoami)"}'
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Profile removal | MDM logs | User removed management profile |
| Compliance drift | MDM console | Device fell out of compliance |
| Enrollment bypass | Enrollment logs | Skipped or forged enrollment |
| Cert expiry | Certificate store | MDM certs near expiration |
| Jailbreak/root | Compliance check | Device integrity compromised |

```yaml
title: Mobile Mdm Security Assessment Detection
id: f67b2429-5a5f-4f26-95e7-6b31d4677c5f
status: experimental
description: Detects suspicious activity related to performing mobile mdm security assessment techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1398
  - attack.t1406
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] Enrollment flow intercepted and analyzed
- [ ] Configuration profiles decoded and audited
- [ ] Policy enforcement tested (passcode, app install, USB)
- [ ] Certificate chain and validity verified
- [ ] API authentication and authorization tested
- [ ] Compliance reporting accuracy validated

## References

- [Apple MDM Protocol Reference](https://developer.apple.com/documentation/devicemanagement)
- [Android Enterprise Security](https://developer.android.com/work/overview)
- [MITRE T1398 — Modify OS Kernel or Boot Partition](https://attack.mitre.org/techniques/T1398/)
- [NIST SP 800-124 — Managing Mobile Devices](https://csrc.nist.gov/pubs/sp/800/124/r2/final)
