Cyber criminals are actively exploiting the vulnerabilities in mobile device managment (MDM) solutions to successfully gain access to networks across government, healthcare and other industries as reported. An alert warning is issued by UK’s National Cyber Security Center (NCSC) to warn the users that multiple actors are exploiting MobileIron Vulnerability (CVW 2020-15505). MobileIron is a provider of MDM which allows system administrator to manage the company mobile devices from the central server.
The interesting story here is the assertion by cybersecurity agencies in the UK (NCSC) and the US (NSA) that nation-state APT groups are actively exploiting these vulnerabilities, five full months after patches were issued. Mobile Device Management servers are by definition reachable from the public internet making them opportune targets. Offering a gateway to potentially compromise every mobile device in the organisation, the attraction to attackers is clear. This highlights not just the importance of patching open vulnerabilities, but also the criticality of having a dedicated mobile security capability that is distinct from device management infrastructure.