CSNC-2017-026 Microsoft Intune - Preserved Keychain Entries

#############################################################
#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/research/advisories/
#
#############################################################
#
# Product:  Microsoft Intune [1]
# Vendor:   Microsoft
# CSNC ID:  CSNC-2017-026
# Subject:  Preserved Keychain Entries
# Risk:     Medium
# Effect:   Locally exploitable
# Author:   Stephan Sekula <[email protected]>
# Date:     31.08.2017
#
#############################################################

Introduction:
-------------
Define a mobile management strategy that fits the needs of your organizatio=
n. Apply flexible mobile device and app management controls that let employ=
ees work with the devices and apps they choose while protecting your compan=
y information. [1]

Compass Security discovered a design weakness in Microsoft Intune's iOS Key=
chain management. This allows users to access company data even after the d=
evice has been unenrolled.


Technical Description
---------------------
If a user's device, which is enrolled with their company's MDM, is unenroll=
ed, their Office access tokens are not removed from the iOS Keychain. Furth=
ermore, the respective tokens are not invalidated on the server-side. There=
fore, if the user reinstalls Office to their device after unenrollment, the=
y may again obtain full access to the company's files.


Workaround / Fix:
-----------------
This issue can be fixed by invalidating the user's access token on the serv=
er- and client-side. In addition, the Keychain items could also be encrypte=
d with a key stored in the app's data directory. Since this key is removed =
with the data directory on uninstallation of the app, this renders the Keyc=
hain entry useless.


Timeline:
---------
2017-08-22  Discovery by Stephan Sekula
2017-09-17  Initial vendor notification
2017-09-18  Initial vendor response
2017-10-04  Asking vendor for update
2017-10-04  Vendor replies that engineers are working on reproducing the is=
sue
2017-11-01  Asking vendor for an update
2017-11-02  Vendor replies - They are waiting for a partner team to respond=
 on the case.
2018-01-08  Asking vendor for update - No response
2018-02-12  Asking vendor for update - No response
2018-03-19  Public disclosure


References:
-----------
[1] https://www.microsoft.com/en-us/cloud-platform/microsoft-intune