ENTERPRISE MOBILE PRE-ATT&CK
TECHNIQUES
  1. Home
  2. Techniques
  3. Pre
  4. Obtain Apple iOS enterprise distribution key pair and certificate

Obtain Apple iOS enterprise distribution key pair and certificate

The adversary can obtain an Apple iOS enterprise distribution key pair and certificate and use it to distribute malicious apps directly to Apple iOS devices without the need to publish the apps to the Apple App Store (where the apps could potentially be detected). [1] [2] [3] [4]

ID: T1392

Tactic: Persona Development

Version: 1.0

Detection

Detectable by Common Defenses (Yes/No/Partial): Partial

Explanation: Starting in iOS 9, Apple has changed the user interface when installing apps to better indicate to users the potential implications of installing apps signed by an enterprise distribution key rather than from Apple's App Store and to make it more difficult for users to inadvertently install these apps. Additionally, enterprise management controls are available that can be imposed to prevent installing these apps. Also, enterprise mobility management / mobile device management (EMM/MDM) systems can be used to scan for the presence of undesired apps on enterprise mobile devices.

Difficulty for the Adversary

Easy for the Adversary (Yes/No): No

Explanation: Apple requires a DUNS number, corporate documentation, and $299 to obtain an enterprise distribution certificate. Additionally, Apple revokes certificates if they discover malicious use. However, the enrollment information could be falsified to Apple by an adversary, or an adversary could steal an existing enterprise distribution certificate (and the corresponding private key) from a business that already possesses one.

References

  1. Apple Inc.. (2016). Distributing Apple Developer Enterprise Program Apps. Retrieved April 12, 2017.
  2. Claud Xiao. (2016). Fruit vs Zombies: Defeat Non-jailbroken iOS Malware. Retrieved April 12, 2017.
  1. Claud Xiao. (2014). WIRELURKER: A New Era in iOS and OS X Malware. Retrieved April 12, 2017.
  2. David Richardson. (2015, September 10). Change to sideloading apps in iOS 9 is a security win. Retrieved April 12, 2017.