macOS MDM/DEP Enrollment Security Research

A security research skill for understanding and testing vulnerabilities in macOS Mobile Device Management (MDM) and Device Enrollment Program (DEP) enrollment processes.

⚠️ Legal and Ethical Notice

This skill is for authorized security research and penetration testing only.

• Only use on systems you own or have explicit written authorization to test
• Unauthorized access to MDM systems may violate computer crime laws
• This research should be conducted in controlled, isolated environments
• Always obtain proper authorization before testing any organization's MDM infrastructure

Overview

This skill covers research into macOS MDM/DEP enrollment vulnerabilities, specifically the ability to retrieve enrollment profiles for arbitrary serial numbers through binary instrumentation. The research is based on Duo Labs' MDM research.

Key Concepts

Device Enrollment Program (DEP): Apple's program that allows organizations to automatically enroll devices into their MDM solution.

Mobile Device Management (MDM): Systems that manage and configure mobile devices, installing certificates, applications, WiFi passwords, VPN configurations, and other sensitive data.

The Vulnerability: Only a serial number belonging to an organization is needed to enroll a device. If the enrollment process isn't properly protected, attackers could potentially retrieve sensitive organizational data.

Core Components

System Binaries Involved

mdmclient

profiles

cloudconfigurationd

DEP Check-in Process

1. cloudconfigurationd

   sends encrypted, signed JSON payload to

   iprofiles.apple.com/macProfile

2. Payload includes device serial number and action "RequestProfileConfiguration"
3. Uses "Absinthe" encryption scheme (complex, internally documented)
4. Utilizes

   CPFetchActivationRecord

   and

   CPGetActivationRecord

   from Configuration Profiles framework

5. CPFetchActivationRecord

   coordinates with

   cloudconfigurationd

   through XPC

Research Methodologies

Method 1: Proxying DEP Requests

Approach: Intercept and modify DEP requests using tools like Charles Proxy.

Limitations:

• Payload encryption prevents modification without decryption key
• SSL/TLS security measures complicate interception

• MCCloudConfigAcceptAnyHTTPSCertificate

  can bypass certificate validation but not payload encryption

When to use: Initial reconnaissance, understanding the request/response flow.

Method 2: Binary Instrumentation (Recommended)

Approach: Use LLDB to attach to

cloudconfigurationd

Requirements:

• System Integrity Protection (SIP) must be disabled
• LLDB debugger access
• Understanding of macOS system processes

Process:

1. Attach LLDB to

   cloudconfigurationd

   process
2. Locate where the system serial number is fetched
3. Inject arbitrary serial number into memory before payload encryption
4. Trigger DEP check-in to retrieve profile

Advantages:

• Avoids entitlement and code signing complexities
• More reliable than proxy-based approaches
• Can be automated with Python LLDB API

Potential Impacts

Information Disclosure

By providing a DEP-registered serial number, sensitive organizational information can be retrieved:

• Certificates: Organization's code signing and authentication certificates
• Applications: List of managed applications and their configurations
• WiFi Passwords: Network credentials for organizational networks
• VPN Configurations: Remote access setup and credentials
• Configuration Profiles: Device management policies and restrictions

Attack Surface

This vulnerability represents a dangerous entry point if:

• Serial numbers are leaked or can be enumerated
• MDM enrollment isn't properly protected
• Organizations don't monitor for unauthorized enrollment attempts

Using the Automation Script

The

lldb-instrumentation.py

Prerequisites

# Install LLDB (usually included with Xcode Command Line Tools)
xcode-select --install

# Disable SIP (requires reboot)
# Reboot into Recovery Mode (Cmd+R)
# Terminal > csrutil disable
# Reboot

Running the Script

python scripts/lldb-instrumentation.py --serial-number <TARGET_SERIAL> --output <OUTPUT_FILE>

Script Capabilities

• Automatically attaches to

  cloudconfigurationd

• Locates serial number in memory
• Injects arbitrary serial number
• Triggers DEP check-in
• Captures and saves the retrieved profile

Security Recommendations

For Organizations

1. Monitor Enrollment Logs: Watch for unexpected enrollment attempts
2. Protect Serial Numbers: Treat serial numbers as sensitive information
3. Implement Additional Authentication: Don't rely solely on serial number verification
4. Regular Security Audits: Test your MDM enrollment process regularly
5. Use Apple Business Manager: Properly configure device ownership and enrollment

For Security Researchers

1. Obtain Authorization: Always get written permission before testing
2. Use Isolated Environments: Test in controlled lab settings
3. Document Findings: Keep detailed records of your research
4. Responsible Disclosure: Report vulnerabilities to affected organizations
5. Stay Updated: MDM security evolves; keep research current

References

• Duo Labs MDM Research
• Apple Configuration Profile Reference
• Apple DEP Documentation

Related Research Areas

• MDM profile analysis and extraction
• macOS system binary reverse engineering
• DEP API communication protocols
• Mobile device security assessment
• Enterprise device management vulnerabilities

Troubleshooting

Common Issues

LLDB cannot attach to process:

• Verify SIP is disabled:

  csrutil status

• Ensure you have appropriate permissions
• Check if

  cloudconfigurationd

  is running:

  ps aux | grep cloudconfigurationd

Serial number injection fails:

• Verify the target serial number format (10 characters, alphanumeric)
• Check memory addresses are correct for your macOS version
• Ensure the process hasn't been updated since your research

No profile returned:

• Confirm the serial number is actually registered in DEP
• Check network connectivity to Apple's servers
• Verify the MDM server is responding correctly

Version Compatibility

mdmclient

profiles

cloudconfigurationd

Next Steps

After understanding the vulnerability:

1. Set up a test environment with your own MDM and devices
2. Run the automation script to verify the technique works
3. Analyze retrieved profiles to understand what data is exposed
4. Document your findings for your organization's security team
5. Implement mitigations based on your research

Remember: This skill is for authorized security research only. Always operate within legal and ethical boundaries.