Breaking Business as Usual: Attacking Android Enterprise Solutions

The talk looks at Android Enterprise in bring-your-own-device setups, where an employer manages a separate work profile on a personal phone. It frames the ecosystem around three stakeholders: IT administrators, enterprise mobility management providers, and work app developers. It then examines where the boundary between work and personal data can fail.

Several weaknesses are demonstrated. Personal apps can reach work app data through inter-process communication and shared storage, and both profiles share one certificate store, so a root certificate added for one affects the other. Device logs and connected app settings also cross the divide. The management app can be instrumented at runtime to change its policies, and the speaker showed a way to bypass the work profile lock state and to disable a mandatory app. Several of these issues were reported to Google, whose responses varied.

For administrators, the main takeaways are to whitelist work apps and check compliance regularly, avoid enforcing only a work-profile password, and harden management apps against tampering. Settings such as USB debugging, root detection, and security patch level were not enabled by default across major management products, so they need explicit configuration. The talk ends with a cheat sheet of recommended work profile settings.