An Attacker's Perspective on Jamf Configurations

Presented at Objective by the Sea version 3.0 (2020), March 13, 2020, 3:45 p.m. (50 minutes).

Organisations are increasingly adopting Apple devices for end user workstations, and now face the same device management challenges that others faced 20 years ago with Windows and Active Directory. To counter this, 3rd party device management solutions such as Jamf, have filled the macOS management void. This talk will give an attacker's perspective on the security implications behind adopting Jamf in your hybrid Windows and macOS estate. We will explore in detail our experiences attacking Jamf-managed macOS estates, ranging from undisclosed attack vectors through to common mis-configurations that are consistently observed in the world of Windows Active Directory. We will also be releasing F-Secure's bespoke Jamf exploitation tooling, so that these attack paths can be identified in your own organisations. In addition to the offensive skills needed to exploit these issues, we will also be providing recommendations to mitigate them, giving you the ability to harden both on-premise and SaaS Jamf instances.


Presenters:

  • Luke Roberts - Security Consultant at F-Secure
    Luke is a Security Consultant at F-Secure (previously MWR InfoSecurity). He specialises in performing attack simulations on behalf of F-Secure, and his recent research has focused on the impact that the adoption of macOS has had on organisations' security posture.
  • Calum Hall - Security Researcher at F-Secure
    Calum works in the offensive security team at F-Secure, formerly MWR. Calum's focus over recent years has been towards perimeter based security, with his research now homing in on macOS security. Predominantly he spends his time looking into macOS devices at an organisation wide scale and how common setups can be abused during offensive engagements.

Links:

Similar Presentations: