- So that's one of the things
that we are doing at pen testing.
You actually have to keep in mind,
some of these devices
that you may actually be able to enumerate
whenever you do reconnaissance in the network,
whenever you do your scanning,
and that perhaps are actually vulnerable to something,
they may actually be managed by an MDM.
So try to actually find ways
that you can then bypass or even block,
the communication between the MDM and the mobile device.
So of course, that's easier said than done,
but there may there may be ways
that you can analyze the communication of
that that device is actually allowed to do or not to do.
So you can actually do this
by actually monitoring the device activity,
or perhaps you say, okay,
this device perhaps is actually communicating
that I'm seeing this type of transactions
to some API in the internet
and this MDN is actually allowing that to happen.
So now you actually have a footprint
and an attack surface that you can actually further explore.
So for example, if that API
perhaps is actually doing WeCrypto,
you probably can take advantage of a vulnerability
to hijack that transaction, for example,
or an API abuse vulnerability
that may actually be relevant in that case,
but always keep in mind
that a lot of organizations now are actually using MDM
to actually manage those devices, monitor them,
and also patch them.
So it's getting a little bit harder
to actually do some of the bypasses nowadays,
but definitely it's possible not,
actually not only look at the infrastructure here,
but what the devices actually communicating
outside of the company as well.