Unsubscribe - Re: CSNC-2017-026 Microsoft Intune - Preserved Keychain Entries

Unsubscribe=20

Thanks, Gary
Sent from my iPhone

> On Mar 20, 2018, at 3:03 AM, Advisories <[email protected]>=
 wrote:
>=20
> #############################################################
> #
> # COMPASS SECURITY ADVISORY
> # https://www.compass-security.com/research/advisories/
> #
> #############################################################
> #
> # Product:  Microsoft Intune [1]
> # Vendor:   Microsoft
> # CSNC ID:  CSNC-2017-026
> # Subject:  Preserved Keychain Entries
> # Risk:     Medium
> # Effect:   Locally exploitable
> # Author:   Stephan Sekula <[email protected]>
> # Date:     31.08.2017
> #
> #############################################################
>=20
> Introduction:
> -------------
> Define a mobile management strategy that fits the needs of your organizat=
ion. Apply flexible mobile device and app management controls that let empl=
oyees work with the devices and apps they choose while protecting your comp=
any information. [1]
>=20
> Compass Security discovered a design weakness in Microsoft Intune's iOS K=
eychain management. This allows users to access company data even after the=
 device has been unenrolled.
>=20
>=20
> Technical Description
> ---------------------
> If a user's device, which is enrolled with their company's MDM, is unenro=
lled, their Office access tokens are not removed from the iOS Keychain. Fur=
thermore, the respective tokens are not invalidated on the server-side. The=
refore, if the user reinstalls Office to their device after unenrollment, t=
hey may again obtain full access to the company's files.
>=20
>=20
> Workaround / Fix:
> -----------------
> This issue can be fixed by invalidating the user's access token on the se=
rver- and client-side. In addition, the Keychain items could also be encryp=
ted with a key stored in the app's data directory. Since this key is remove=
d with the data directory on uninstallation of the app, this renders the Ke=
ychain entry useless.
>=20
>=20
> Timeline:
> ---------
> 2017-08-22  Discovery by Stephan Sekula
> 2017-09-17  Initial vendor notification
> 2017-09-18  Initial vendor response
> 2017-10-04  Asking vendor for update
> 2017-10-04  Vendor replies that engineers are working on reproducing the =
issue
> 2017-11-01  Asking vendor for an update
> 2017-11-02  Vendor replies - They are waiting for a partner team to respo=
nd on the case.
> 2018-01-08  Asking vendor for update - No response
> 2018-02-12  Asking vendor for update - No response
> 2018-03-19  Public disclosure
>=20
>=20
> References:
> -----------
> [1] https://www.microsoft.com/en-us/cloud-platform/microsoft-intune