Malicious MDM: Let's Hide This App

This blog post is authored by Warren Mercer and Paul Rascagneres with contributions from Nick Biasini Summary Since our initial discovery of a malicious mobile device management MDM platform that was loading fake applications onto smartphones, we have gained greater insight into the attacker's...

CVE-2018-2449

SAP SRM MDM Catalog versions 3.73, 7.31, 7.32 in SAP NetWeaver 7.3 - import functionality does not perform authentication checks for valid repository user. This is an unauthenticated functionality that you can use on windows machines to do SMB relaying...

CVE-2018-2448

Under certain conditions SAP SRM-MDM CATALOG versions 3.0, 7.01, 7.02 utilities functionality allows an attacker to access information of user existence which would otherwise be restricted...

CVE-2018-2449

SAP SRM MDM Catalog versions 3.73, 7.31, 7.32 in SAP NetWeaver 7.3 - import functionality does not perform authentication checks for valid repository user. This is an unauthenticated functionality that you can use on windows machines to do SMB relaying...

Authentication flaw

SAP SRM MDM Catalog versions 3.73, 7.31, 7.32 in SAP NetWeaver 7.3 - import functionality does not perform authentication checks for valid repository user. This is an unauthenticated functionality that you can use on windows machines to do SMB relaying...

Design/Logic Flaw

Under certain conditions SAP SRM-MDM CATALOG versions 3.0, 7.01, 7.02 utilities functionality allows an attacker to access information of user existence which would otherwise be restricted...

CVE-2018-2449

SAP SRM MDM Catalog versions 3.73, 7.31, 7.32 in SAP NetWeaver 7.3 - import functionality does not perform authentication checks for valid repository user. This is an unauthenticated functionality that you can use on windows machines to do SMB relaying...

CVE-2018-2448

Technical details about CVE-2018-2448 are not publicly available in the provided connected documents. Monitor for updates from SAP and CVE databases.

CVE-2018-2449

SAP SRM MDM Catalog in SAP NetWeaver 7.3 (versions 3.73, 7.31, 7.32) contains an authentication flaw in the import functionality that does not check credentials for a valid repository user. This creates an unauthenticated path that can be used on Windows to perform SMB relaying, effectively bypas...

CVE-2018-2448

Under certain conditions SAP SRM-MDM CATALOG versions 3.0, 7.01, 7.02 utilities functionality allows an attacker to access information of user existence which would otherwise be restricted...

Beers with Talos EP 34: Click Here to Assign New Mobile Device Owner

Beers with Talos BWT Podcast Ep. 34 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast. Ep. 34 show notes: Recorded July 20, 2018 — This week, we touch on several topics, but we spend the lion’s...

iPhone Hacking Campaign Using MDM Software Is Broader Than Previously Known

India-linked highly targeted mobile malware campaign, first unveiled two weeks ago, has been found to be part of a broader campaign targeting multiple platforms, including windows devices and possibly Android as well. As reported in our previous article, earlier this month researchers at Talos...

Error: "Cannot add app " on Android When Trying to Add App from XenMobile App Store

The user gets "Cannot add app " on the Android device when trying to add an app from XenMobile App Store, and MDMERRORUSERDEPROVISIONED gets logged in Debug logs. Other already installed apps work normally. Device has not been purposefully removed, and the device looks normal in XenMobile console...

Advanced Mobile Malware Campaign in India uses Malicious MDM - Part 2

This blog post is authored by Warren Mercer and Paul Rascagneres and Andrew Williams. Summary Since our initial post on malicious mobile device management MDM platforms, we have gathered more information about this actor that we believe shows it is part of a broader campaign targeting multiple...

Security Bulletin: Yarn UI/API Security issue

Summary The Yarn UI/API running on port 8088 is not secured by default. If the host machine or container is configured in a network where port 8088 is open to the internet then, in this mode of operation, anonymous users can submit yarn applications. A yarn application can perform arbitrary tasks...

A highly targeted malware campaign is spying on 13 iPhones in India

By Waqas A dangerous targeted mobile malware campaign has been identified by security researchers, which is believed to have been active since August 2015. Researchers claim that the malware is discovered to be spying on 13 specific iPhones in India, which hints at the fact that this is a highly...

Indian iPhone Spy Campaign Used Fake MDM Platform

Cyberattackers have used a bogus mobile device management MDM system to target a small – but presumably high-value – set of iPhones in India, in a cyberespionage campaign that has some unusual hallmarks. Researchers said Thursday that attackers deployed an open-source MDM – which is typically use...

Hackers Used Malicious MDM Solution to Spy On 'Highly Targeted' iPhone Users

Security researchers have uncovered a "highly targeted" mobile malware campaign that has been operating since August 2015 and found spying on 13 selected iPhones in India. The attackers, who are also believed to be operating from India, were found abusing mobile device management MDM protocol—a...

Advanced Mobile Malware Campaign in India uses Malicious MDM

This blog post is authored by Warren Mercer and Paul Rascagneres and Andrew Williams. Summary Cisco Talos has identified a highly targeted campaign against 13 iPhones which appears to be focused on India. The attacker deployed an open-source mobile device management MDM system to control enrolled...

Security Bulletin: IBM MDM Software report download without authentication affects IBM InfoSphere Master Data Management Collaboration Server

Summary IBM InfoSphere Master Data Management - Collaborative Edition could allow an unauthorized user to download reports without authentication Vulnerability Details CVEID: CVE-2017-1523 DESCRIPTION: IBM InfoSphere Master Data Management - Collaborative Edition could allow an unauthorized user ...