Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
On Android versions prior to 7, apps can abuse Device Administrator access to reset the device lock passcode, preventing the user from unlocking the device. After Android 7, only device or profile owners (e.g. MDMs) can reset the device’s passcode.[1]
On iOS devices, this technique does not work because mobile device management servers can only remove the screen lock passcode; they cannot set a new passcode. However, on jailbroken devices, malware has been discovered that can lock the user out of the device.[2]
| ID | Name | Description |
|---|---|---|
| S0323 | Charger |
Charger locks the device if it is granted admin permissions, displaying a message demanding a ransom payment.[3] |
| S0522 | Exobot |
Exobot can lock the device with a password and permanently disable the screen.[4] |
| S0536 | GPlayed |
GPlayed can lock the user out of the device by showing a persistent overlay.[5] |
| S1185 | LightSpy |
LightSpy has used the DeleteSpring plugin to render the device’s user interface inoperable by disabling SpringBoard, which is iOS's home screen manager.[6] LightSpy has used the BootDestroy plugin to prevent the victim device from booting by modifying the NVRAM parameter |
| S0298 | Xbot |
Xbot can remotely lock infected Android devices and ask for a ransom.[7] |
| ID | Mitigation | Description |
|---|---|---|
| M1006 | Use Recent OS Version |
Android 7 changed how the Device Administrator password APIs function. |
| M1011 | User Guidance |
Users should be cautioned against granting administrative access to applications. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0627 | Detection of Endpoint Denial of Service | AN1695 |
For Android, detect Endpoint Denial of Service by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: DevicePolicyManager.lockNow() or resetPassword() called by caller NOT IN $MDMAgentPackageList$]; Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Host Status via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |
| AN1696 |
For iOS, detect Endpoint Denial of Service from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |