3CX DLL-Sideloading attack: What you need to know

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 7 subscribers
  • Views 1772 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Mobile - VPP - Custom Apps

Peter Berger

Hi Together,

first of all some Basic Information:

MDM-Server: Server-Version: 9.7.3 [ Migration to Central ongoing... ;-) ]

AppleBusinessManager: about 50 Apps from the App-Store - NOW NEW 1 App in the "Custom Apps"

Apple-VPP & Sophos Mobile VPP integration = working with the Apps from the App-Store

Used Devices: iPads ( different Models ) & iPhones ( different Models ) - all with IOS / iPadOS 15.x.x to 16.x.x

Problem: The Custom App can NOT be deployed to the iPads & iPhones

Problem-Infos: After "APP-Apps import" => i get the App to my App List in the Sophos iOS & iPadOS List - so first of all i thought "great it works"....



  • First Import of the custom App - I changed the Link Information & Name & App-ID to "xxx" and "yyy" ;-)


    1. = Link to the app - as seen the RED mark is the name of the app
    2. = I get the App Name as in the Apple Business Manager
    3. = I get the Apple-ID
    4. = "There are no VPP-Licenses for this App available"
  • After i try to "Get Informationen" via the blue Button "Informationen abrufen" ( 5. ) ==> i get the following error message and some of the already loaded information disappear ( 2. ) & ( 3.) :

    Error: = "Getting the App via the Link failed"

  • The Problem is the Link ( 1. ) ==> if i try to open it on an Windows Browser it's just loding and nothing happening -- on iOS / iPadOS => i get the error "you are not allowed to download the app"

    ==> I talked to the App creator => he said "the apple-ID mentioned in our VPP system is the one he allowed to get the apps".....

Solution tries:

  • Delete VPP Cache
  • Renew the whole VPP Token


This thread was automatically locked due to age.
  • 0

    Hi Peter,

    Thank you for putting together such a detailed post! 

    As this does not appear to be working correctly from the Sophos Mobile side, could you check if the settings in Apple Business Manager can be changed to ensure Custom Apps are permitted?
    - Purchase Custom App licenses 

    If you are able to get this to show up in ABM correctly, I suggest clearing the VPP cache once more to see if Sophos Mobile can pull down the updated information. 

    Kushal Lakhan
    Global Community Support Engineer
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0 in reply to Qoosh

    Hi Kushal,

    thanks for the fast answer - but i am sorry to tell you that "clearing the VPP cache once more" did not solve the Problem.

    The Custom App got - hopefully with correct settings - successfully imported in our Apple Business Manager.

    For now the App has 0 License cost => normally i just "purchase" 1000 licenses, so i never have to "rebuy". In this case i have the 3000 licenses because the App Developer wanted to see in a Teams call if it's possible to buy some more.....

    For now i just deleted the App from the App-List in the Sophos MDM ==> Waited some minutes ==> cleared VPP cache ==> waited again ==> reimported VPP-Apps ==> got the App in the List again ==> same error... :(

    Peter Berger said:
    The Problem is the Link ( 1. ) ==> if i try to open it on an Windows Browser it's just loding and nothing happening -- on iOS / iPadOS => i get the error "you are not allowed to download the app"

    I would like to know some general things about custom apps & vpp:

    If everything would work

    • would there still some sort of that link :
    • Could i copy it to other devices and download the app in this way ? For now i just get the error that i am not allowed to download the app and this seems logical - cause any one else with that link ( wherever he got it from ) should not be able to download / use the app.

    • So how is the whole system working ?
      • Custom App gets in the Customer Apple Business Manager
      • We "buy" the amount of licenses needed
      • We import via VPP the new App to Sophos Mobile
      • We push the App to a device with Sophos Mobile
        • Sophos Mobile checks the "app link" ==> is there any "authentication" ? So our System is veryfied ?
        • Sophos Mobile send the "installation command" to the device
        • The Device is now authorized to use / download the App

    What i want to say: Is it possible, that in may case the error could be on developers side ? ==> I already asked them about this => the just have the option to "publish the app to the mentioned Apple business manager with no extra settings"

    Regards

    Peter

  • 0 in reply to Peter Berger

    I suggest opening a support case with our team to investigate this further if you have not already. Feel free to provide me with the support case number once it is opened, you can send this to me via private message so I may follow up with our team. 

    You may already have the following setting enabled, though it would be good to check. 

    Kushal Lakhan
    Global Community Support Engineer
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0 in reply to Qoosh

    Hi,

    ok - i will open a support case. To answer your question - see to following image. Just looks a bit different to yours.

    Text in green Box: " Turn the Custom Apps tab on or off for your entire organization. If enabled, this tab will appear in the Apple Business Manager sidebar. "

    I tried " turn off an on again " ;-)

    

    

     
    

    

    Thanks for the replys.
    

    Regards
    

    Peter
    
				                    
    
                
    
            
    
        	
    

		
		
		
		
	
    
	
    
		
    
			
		
    
	
    
	
    
		
						
				
				
				
				
				
		
		
    
			
		
    
	
    

    

    • 

	





	
			





















































			











Unfiltered HTML