Are Malicious Configuration Profiles iOS' Achilles Heel?

The Lacoon Mobile Security Research team has been doing ongoing research into the subject of Malicious iOS Configuration Profiles for quite some time. To share this research, we are interviewing one of the senior security researchers at Lacoon Mobile Security, Dan Koretsky. We asked Dan to give some background data on iOS configuration profiles as well as discuss the potential threats to enterprises. Dan also provides us with methods that enterprises can take to mitigate the threats posed by malicious iOS configuration profiles.

iOS Configuration Profiles are small files that can be installed on all iOS devices. They are essentially instruction and permission lists that can alter many settings, including network configurations and security settings. They’re used by everyone - from cell providers for their releasing their settings to thousands of enterprises for managing devices accessing the corporate network .

Their use is officially approved by Apple and there is nothing innately malicious about any given profile. But, if implemented by threat actors, iOS configuration profiles can enable them to obtain usernames and passwords as well as allow access to secure corporate networks and private communications.