2

I know Apple's implementation of MDM can install apps, change settings on the Mac automatically using profiles. I’m more concerned about things like:

  • monitoring my screen without my consent
  • decrypting TLS traffic
  • send data to the server for censorship or monitoring

Do they provide such functionalities? Is there an official list of capabilities of MDM?

2
  • I’ve made an edit to tidy the requirements. How does sending data to a server invoke censorship? Sending it clearly is a breach of trust and privacy due to monitoring. I’ve added that explicitly to the “risks”
    – bmike
    Apr 20 at 12:12
  • Is this question only theoretical, or are you concerned about an employer- or school- provided computer you need for your work/studies? If the latter, perhaps there is a legal agreement (a "Use Policy" is a common term) for your acceptance of the control your employer/institution has over the device. You can check to see what capabilities are present in a MDM managed Mac by going to System Settings > Privacy & Security > Profiles. Click on a profile to see its settings (or the settings Admins want you to see)
    – IconDaemon
    Apr 20 at 14:26

2 Answers 2

2

Probably/possibly...

As usual the answer would be... it depends.

As the tag info states:

MDM is usually implemented with the use of a third party product that has management features for particular vendors of mobile devices.

So the amount and ability of the surveillance would depend upon:

  • Which third party product (i.e. the brand (Sophos, Jamf, etc.)) is used by
  • Which vendor of the phone and
  • Which enterprise or agency (i.e. your boss) that employs/requires the MDM in the first place

Each brand's suite of tools would have its own unique set of capabilities, that may or may not be activated, depending upon the amount of "security" or access required by that said enterprise or agency.

From the rather generic Wikipedia definition, Mobile device management:

Some of the core functions of MDM include:

  • Ensuring that diverse user equipment is configured to a consistent standard / supported set of applications, functions, or corporate policies
  • Updating equipment, applications, functions, or policies in a scalable manner
  • Ensuring that users use applications in a consistent and supportable manner
  • Ensuring that equipment performs consistently
  • Monitoring and tracking equipment (e.g. location, status, ownership, activity)
  • Being able to efficiently diagnose and troubleshoot equipment remotely

From this scarily interesting (but not necessarily authoritative) article, Never accept an MDM policy on your personal phone:

  • Track your phone (and you) in real-time by using the phone's GPS on Android and some iOS MDMs
  • Read text messages (on Android) by deploying routing text messages through an SMS Gateway
  • See private photos and videos, at least, by intercepting your cloud backups through VPN and organization forced SSL Decryption (both on unsupervised iOS and Android)
  • Check your browsing history, same as above
  • Browse list of Apps Available on your phone such as dating applications on Androids
  • Perform an SSL MITM Attack which exposes your banking details, private conversations, credit card information, medical searches and all of your internet traffic through VPN and organization forced SSL Decryption (both on unsupervised iOS and Android)
  • Stop you from rooting/jailbreaking your personal phone
  • Remotely wipe your personal phone whenever they feel there is a need
  • Remotely lock your personal phone whenever they feel there is a need
  • Restrict or disable backups like iCloud.
  • Force you to stop using some apps

In short, if you are up to something nefarious (or otherwise), do it on your own phone that (you are reasonably sure) doesn't have MDM.

5
  • I think this answer could be better. The question is asking what capabilities could be possible if MDM is enabled. Implicitly, I think it is asking about the worst case, if the third party product enables the worst possible stuff. So saying "it depends on which third party product your company uses" doesn't really answer the question. Do you have a list of capabilities of MDM?
    – D.W.
    Apr 20 at 21:21
  • 1
    Please feel free to write your own answer. The sentiment of the question, IMHO, has been changed, since I answered it (which was "Is it susceptible to MITM" - at least that is how I read it, to which the is "yes, but it depends"). Apr 21 at 1:01
  • 1
    Also, I felt that a comprehensive list of capabilities could turn out to be endless, as it would indeed depend upon the purveyor of the third-party software. The interesting link provided a list (of sorts), and so it seemed appropriate to quote that, as a starting point. I didn't feel that it was appropriate to quote and summarise the entire Wikipedia page though. Nor to scrape MDM suppliers product pages. Apr 21 at 1:10
  • 1
    Thanks for the answer. The description you quoted from tag seems a generic concept of MDM. But I was actually referring to the apple's implementation of it, which is developer.apple.com/documentation/devicemanagement. I was wondering in worst case scenario, will macOS allow these actions or give a third party implementation such privileges and if there're some official references to it.
    – William
    Apr 21 at 3:27
  • @William - you should update your question, with the info from the comment, as it seems rather relevant. I'm probably going to delete this answer. Apr 21 at 3:51
0

Here's an attempt at a short answer:

In general, MDM solutions for the Mac can be configured to allow the employer/institution to install any software with system administrator privileges. Some MDM solution also work by having Apple's built-in protections disabled (to allow them to load in third party system extensions).

In this scenario, it is entirely possible to monitor the screen without consent, to decrypt TLS traffic and to send data to a server for censorship or monitoring.

So yes, it is possible to achieve such things via MDM.

However, do not expect an MDM system to "provide" that functionality in terms of for example having a "Snoop on the screen without consent" button. Rather the administrator of an MDM system can take advantage of generic functionality provided for benign purposes, in order to violate user privacy. Also note that in many places, it would be illegal for the employer/institution to do so.

7
  • Thanks for the answer, could you provide some developer document links for the functionalities you mentioned so I can make sure Apple did have such APIs to allow a third party software to implement such behaviours.
    – William
    May 3 at 9:24
  • Which functionalities do you mean? - Are you talking about "monitoring the screen", "decrypting TLS" and "sending data to a server" - because that is obviously available on macOS (similar to how it is possible on Windows, Linux and other popular desktop operating systems).
    – jksoegaard
    May 3 at 13:26
  • "monitoring the screen without consent", not "monitoring the screen". And I'm pretty sure "decrypting TLS" is not possible unless the SSL library deliberately leak the session key. I'm specifically want to know if apple's MDM API provides such not other softwares (p.s. I know you can record session key using chrome).
    – William
    May 8 at 7:50
  • @William I'm not entirely sure why you have misunderstood this. I'm saying that the screen can be monitored after the installation and setup of common MDM solutions for macOS - without requiring the user to explicitly authorize the monitoring of the screen. If you want to nitpick whether that is "without consent" or not, you are ofcourse free to do so. And no, ofcourse MDM does not magically enable anyone to break encryption that would otherwise be unbreakable. I am ofcourse answering within the context of the question. Common MDM solutions on macOS do make it possible to monitor the [....]
    – jksoegaard
    May 13 at 9:43
  • [...] unecrypted payload of many TLS connections. This is ofcourse not done by MDM magically making the computer capable of breaking all sorts of encryption algorithms. Rather it is done for example by adding the MDM solution's own certificates to the trust store and acting as a "man in the middle". For practical purposes for a home user or office worker, that means that TLS can be "decrypted".
    – jksoegaard
    May 13 at 9:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .