What are the implications?
What this implies in practice is that when admins engage with the authentication process, they should achieve this using non-federated Apple Account sign-in with Apple’s two‑factor authentication (typically via a trusted device or trusted phone number using SMS/voice). That’s weird; it means the important thing accounts that manage protection for sometimes hundreds of devices are still only protected by a six-digit SMS code sent to a specified phone number. We all know that SMS authentication is dangerous, with three well-known attack paths:
- SIM swapping, where an assailant contacts your cellular company posing as you and convinces them to transfer your phone number to a SIM of their control. Once that takes place, all of your SMS codes go to them.
- Phishing, reminiscent of a fake login page that acts normally but intercepts your SMS code when you enter it, capturing and immediately using it to attack your actual account.
- Interception, by which sophisticated, often nation-state-adjacent attackers exploit the known vulnerabilities of SMS to intercept messages in transit.
While it’s true most small and mid-size businesses probably don’t must worry about that third attack possibility, and the second will be mitigated against by being careful never to make use of a link provided in an email to access key accounts, the primary exploit sits throughout the reach of determined attackers.
A hole within the bucket
The implications of a successful attack will be serious. Equipped with a compromised ABM account, an attacker could reassign enrolled devices to an MDM server they control, wipe devices, or push malicious apps/profiles or configurations at your devices. Those outcomes are, let’s consider, sub-optimal.
I’m certain Apple has considered this. It has, in spite of everything, introduced a variety of security protections for all its devices, including managed devices. But on this case, it’s left things slightly exposed. That weakness is made more critical because Apple’s system permits only a small variety of administrators for every ABM setup, no matter company size.