The European Commission was hacked through its MDM
Attackers used Ivanti mobile management zero-days against EU and Dutch government bodies. The server that manages your phones is a crown jewel.
The European Commission said it detected an intrusion on 30 January in the systems that manage staff mobile devices, and contained it within nine hours. Dutch government bodies confirmed similar breaches. The way in: two critical zero-day bugs in Ivanti Endpoint Manager Mobile, which Ivanti warned about on 29 January, already under attack.
Mobile device management servers sit on the internet, know every employee’s phone, and can push apps and settings to all of them. That makes them one of the most valuable servers you own.
If you run Ivanti EPMM, apply Ivanti’s fixes and follow its guidance on checking for compromise. For any MDM:
- Patch it as fast as your VPN and firewall. It belongs in the same group.
- Put the admin console behind a VPN or access proxy, not on the open internet.
- Limit and log admin accounts, and require phishing-resistant MFA.
- Ask what an attacker could push to every phone from it, and plan for that.