Apple Fixes Lock Screen Vulnerability with iOS 6.1.3

Your rating: None (2 votes)

Apple has released iOS 6.1.3, fixing a recent lock screen vulnerability.

The update is available via software update. And as usual, http://ios.e-lite.org/ has compiled links for direct download.

Using client certificates in iOS

Jonukas's picture
No votes yet

Hi all,

I'm trying to understand how iOS deals with certificates and I'm wondering if anyone can explain a few things to me. I'm working on a system that would provide users with a personal identification certificate for authentication to various services (email, Wi-Fi, websites, etc.) via a configuration profile. Profile creation isn't a problem, but in testing website authentication, it seems that iOS (or Mobile Safari) requires me to provide the CA certificates that should already be on the device.

Here is the certificate chain that my colleague provides me with when I get the user's cert:

AddTrust External CA Root
 ↳ UTN-USERFirst-Client Authentication and Email
    ↳ InCommon Standard Assurance Client CA
       ↳ User's personal certificate

At first, I added the certificate as a single payload of type com.apple.security.pkcs12 with all the CA certificates in the chain included in the p12 data blob. This didn't seem to work since I'd get a warning from MobileSafari in the console log:

no itentities, but we have a challenge <NSURLAuthenticationChallenge: 0x1ddccd90>

Along with the following dialog in the browser:

This website requires a certificate
The required certificate is not installed.
Dismiss

The server's ssl_error_log reported:

Re-negotiation handshake failed: Not accepted by client!?

So I tried breaking out the certs into individual payloads. According to this article, iOS 5 and 6 has "AddTrust External CA Root" and "UTN-USERFirst-Client Authentication and Email" preinstalled and I shouldn't have to install them again. So I just included "InCommon Standard Assurance Client CA" and the user's cert as two separate payloads (of types com.apple.security.pkcs1 and com.apple.security.pkcs12 respectively), but that didn't work. I was only able to get it to work if I installed the entire cert chain (using com.apple.security.root as the payload type for the root cert).

Why is that? Shouldn't it already know about the two CAs? I can understand adding the "InCommon" CA since it's not preinstalled, but It seems strange that I have to explicitly provide the other CA certs.

FWIW, I've found out that there are at least three versions of "UTN-USERFirst-Client Authentication and Email":

Intermediate CA (expires Saturday, May 30, 2020 6:48:38 AM EDT)
Intermediate CA (expires Sunday, December 31, 2028 6:59:59 PM EDT)
Root CA (expires Tuesday, July 9, 2019 1:36:58 PM EDT)

The root version is the one preinstalled in iOS. When I evaluate the user's cert with the Certificate Assistant in OS X, the cert status is good no matter what chain it uses, but could this multiple CA certs thing be an/the issue?

Two iPad-Focused Executive Lunches in New York City

Your rating: None (2 votes)

My employer and site-sponsor Tekserve is hosting two executive lunches in New York City in March. I hope those of you in NYC can make at least one of them. I'll be there (I'm even speaking at the second one), so make sure you say Hi!

Using Custom Apps in the Enterprise

Wednesday, March 20th • 12:00 – 2:00 p.m.
SD26 Contemporary Italian Cuisine
 • 19 E 26th St. (at Madison Square Park)

Art Chang and Kevin Kim, founders of enterprise app development studio App Orchard, will discuss how custom-built apps can help your enterprise increase profitability, empower workers with real-time data, and drive efficiency.

Seven iPad Deployment Mistakes You Can Avoid

Wednesday, March 27th • 12:00 – 2:00 p.m.
SD26 Contemporary Italian Cuisine
 • 19 E 26th St. (at Madison Square Park)

I'll be presenting an updated version of my talk on iPad Deployment Mistakes. Tekserve has helped clients like Showtime, Ann Taylor, Cablevision, and the Institute of Culinary Education successfully manage the iPad for thousands of employees. And along the way we've made lots and lots of mistakes. We've learned from these mistakes and you can too.

iOS MDM policy workflow

bhsgsh's picture
No votes yet

Can please anybody tell me what the policy workflow for any of the MDM policies is? eg; how does the "allow youtube" policy works (the complete workflow)

Changing an MDM Mid-Stream? Ouch!

Your rating: None (2 votes)

I wanted to pass on an experience we recently had in our school that may be helpful to others.

We made the decision to switch our Students to LightSpeed’s MDM from Casper Suite about a month and a half ago. I am currently down to about 100 devices yet to move. 

There were many reasons we decided to make the move:

  • By using the MDM solution that is from the same company as our filter and LMS we gain loads of integration. The most compelling integration we wanted was the ability for our filter to know the user on each device and store that information so a single sign on was enough. We are now able to filter and monitor each iPads internet traffic by individual user! Very important at a private Christian school.
  • The integration also made the move to global proxy that much easier. 
  • Additionally, when I go to our MDM management console the users are automatically linked to our LMS were I can go and easily message them. 
  • In the future I hope to see, and have heard they are woking on, the ability for a teacher, through our LMS (my big campus) to lock a class of students into an app for a time. (single app mode) The UI would be in the LMS but the actual implementation of the lock can only happen via a supervised device and some kind of MDM. So in this case the teacher would make the request via the LMS that would then send that to the MDM and the MDM would send the profile locking the device into single app mode. Then reverse the process at the teachers request.  PRETTY COOL STUFF that could only happen with and integrated LMS = MDM. 
  • I am aslo very please with the ability of the LS MDM to manage our VPP and Free Apps wirelessly removing the need to use Apple Configurator for App management. We use the personal model in grades 5-8 and the institutional model in grades k-4. In both cases I am able to “suggest” an app wirelessly via the MDM and the end users will be prompted to install. Most importantly in the institutional model it is possible to have them never need to enter the institutional password. It just installs and opens without ever asking them to enter a password at all. VEYR NICE! (I will post more on how this is working, and details on setup later)

The move has been A LOT of work but I am on the home stretch now with only 1st and 2nd grade left.

It has required myself or the end users interaction with every device! That has been the OUCH!!! but it seems to have been worth it.

The LS MDM is less mature that the Casper MDM but it is making strides in the right direction. We have had a number of issues with the LS MDM but the support has been very good (Thanks Kevin). I still highly recommend Casper and we still use it for our adult users. The reasons listed about, along with a few others, however prompted this huge undertaking. I think it has been worth it!! I will give a more definitive answer once it’s DONE!!!  SOON!!

(via ipadmike.com)

Achieve 'Apple' like device lockdown (no stock apps)

Charles.B's picture
No votes yet

I have a rather large question, and so far nobody has been able to provide me with an answer.

I would like to know how to replicate the experience Apple provide shoppers at their stores, by locking down the devices more than usual and having a 'screensaver' that essentially bypasses the lockscreen when tapped.

Normally I would accept the answer "It can't be done" except it has been done, specifically by a company called OTG Experience, who deploy iPads in airport terminals.

OTG PR Video: https://www.youtube.com/watch?v=Vk9ayjA-5mU

In the video (I have another recorded by a colleague at LaGuardia) you can see a screensaver running, the standard springboard, there are no stock iOS apps, no settings icon etc. From what I have heard, this is all done using Configurator, undocumented features and help from Apple.

It's also clear that Tekserve (who's CTO Aaron Freimark created this site) had a hand in this deployment:

http://www.cio.com/article/718687/The_iPad_Kiosk_Landing_at_an_Airport_N...

You can listen to Mr. Freimark talking about the deployment here, and he specifically says that these "Are Not Jailbroken":

http://www.youtube.com/watch?feature=player_detailpage&v=mvEeh6Phl5c#t=320s

Thanks in advance...

VentureBeat: Apple owns enterprise: 5 of the top 5 devices activated last quarter…

T. Reid Lewis's picture
No votes yet

This seems noteworthy.

VentureBeat: Apple owns enterprise: 5 of the top 5 devices activated last quarter…
http://venturebeat.com/2013/02/26/apple-owns-enterprise-5-of-the-top-5-d...

Seventy-seven percent of all new smartphones and tablets activated in the enterprise last quarter were Apple devices, according to a new report from Good Technology.

The most popular device was Apple’s new iPhone 5, with 32 percent of all activations. The top five devices activated also included the iPhone 4S, iPhone 4, iPad 3, and iPad2. Out of the top 10, eight were Apple devices, including the iPad 4, the aged iPad 1, and the equally venerable iPhone 3GS.

Essentially, it’s utter enterprise domination by Apple’s iOS.

See the graphs and read the complete article at http://venturebeat.com/2013/02/26/apple-owns-enterprise-5-of-the-top-5-d...

How to update apps purchased via VPP?

arthurmzee's picture
No votes yet

Hello all!
Is anyone here deploying iOS devices to remote sites with an app purchased via the App Store's Volume Purchasing Program (VPP) for Business? If so, how are you updating the app on the remote iOS devices?
Please let me know.
Thanks in advance,
az

Colorado iOS Admin User Group March Meeting

Your rating: None (1 vote)

The Colorado iOS Admin User Group comes together to discuss the Deployment and Management of iOS devices in Education and Business. Join us for the March 13th meeting to discuss Deployment and Management of iOS devices. This event is hosted at Cherry Hills Christian School.

Our agenda will include:

  • Deployment Models
  • App Deployment Implementations
  • MDM
  • Apple Configurator
  • User Agreements and Compliance

At our last meeting we had over 60 in attendance from all across Colorado, Wyoming, and Nebraska. Space is limited so RSVP now!

Also, we have a sponsorship opportunity for this meeting. If your company is interested please contact me.

To register click this link: Eventbrite - iOS Admin User Group - March

BES 10 iOS and Android app stores?

ZinFab's picture
No votes yet

Hi

I am trying to understand what BES10 offers in the way of app stores for iOS and Android, from their web site I see they have limited MDM functionality however app stores on these platforms is not mentioned.

Anyone have any insight?

Thanks

Apple Fixes Exchange Calendar Bug with iOS 6.1.2

Your rating: None (2 votes)

Apple has released iOS 6.1.2, fixing the recently-acknowledged Exchange calendar bug. The bug manifested if you accepted an exception to a recurring calendar event.

The update is available Via software update. And as usual, http://ios.e-lite.org/ has compiled links for direct download.

Several excellent MacIT presentations for your consumption

Your rating: None (2 votes)

I was lucky enough to participate in the MacIT Conference in late January, and meet several first class iOS administrators. They have very generously agreed to share their presentations on Enterprise iOS, in order to reach a larger audience. Of course PDFs are no substitute for a real conference, so please consider attending next year!

If you have a presentation that I missed, please send me a message and we'll get it published.

MacIT: iOS Deployment Models Across Three Age Levels in Education

Your rating: None (3 votes)

IT803: iOS Deployment Models Across Three Age Levels in Education
Nicholas McSpadden, Client Systems Manager, Schools of the Sacred Heart

This session will discuss the deployments of iPads to a 4th grade, 6th grade, and high school 1:1 program. Each model is slightly different - a cart model, a personalized device model, and a take-home individual device model. I will talk about how we manage & deploy the iPads themselves, as well as working through policies and parents to come up with an effective system. Since we use very different approaches across the three different age levels, this will be a good summary of the various ways of handling an iOS wide-scale deployment.

Presentation PDF: IT803_McSpadden.pdf

MacIT: The Changing Role of IT to Service Provider

Your rating: None (2 votes)

IT882: The Changing Role of IT to Service Provider
Randy Saeks, District Network Manager, Glencoe School District 35

As technology has gotten more affordable, mobile technology has increased and organizations are facing a more dynamic workplace. As such, IT has to embrace these new changes and shift from a provider of hardware and a controlled environment to a provider of services and access to resources. This session will talk about trends and how a shift in management style is required as more Bring-Your-Own-Device scenarios emerge.

Presentation PDF: IT882_Changing-Role-of-IT.pdf

MacIT: Using Apple Configurator with your iOS Deployment Workflow

Your rating: None (2 votes)

IT823: Using Apple Configuratior with Your iOS Deployment Workflow
Randy Saeks, District Network Manager, Glencoe School District 35

This session will look at how you can use Apple Configurator to speed up your iOS device deployment process. Using the tool for restrictions, MDM enrollment, and application management will be discussed. In addition, we will talk about a few use case scenarios and how Configurator fits into the management style.

Presentation PDF: IT823_Apple-Configurator.pdf

Recent Activity