Are we now saying a central authority can simply brick or forcefully install software on any mac at any time given only the serial number? What the actual fuck!?
Is this an OS feature or part of the "secure enclave" (Are macs entirely useless now or can you install Linux and still trust the device)?
With Macs, it’s more closely tied to the hardware because of course they’re integrated.
With PCs, Intune and Autopilot are Windows features that depend on hardware, but hardware alone isn’t sufficient. You can install and run Linux or DOS all you want on an Autopilot enrolled device, but every time you boot Windows it will want to phone home.
It’s fairly carefully controlled. With a PC, serial number is not sufficient. You need a device specific hash that is not generated and that you can’t get until you turn on the computer at least once, so you need physical possession at some point in the workflow.
With Macs, Apple more completely manages those first stages of enrollment. Devices are enrolled when sold through a B2B channel, or when manually enrolled through Business Manager.
Either way, it would be difficult for an adversary to assume control of a device without authorization. Not impossible, surely, but it’s definitely a scenario these vendors have anticipated and worked to prevent.
The good news for device owners is that it adds complexity to resale of a stolen device.
The bad news is things like OP’s situation occur.
Even if Apple are "the good guys" (now), we know they can be compelled by governments to do things quietly (see the push notifications thing that came up recently). So simply having the ability to remotely push software or configuration changes to any machine targeted by just a serial number is a big security hole.
This is very disappointing...
Naturally, that's not great either, but it's not quite the same kind of "not great".
Essentially, the device phones home during setup, and asks Apple whether it’s in Apple Business/School Manager. If it is, and it’s assigned to an MDM, Apple will let it know the host name of that server to try and prompt the user to enroll into.
And once that's burned into the UEFI, I'd like it plastered all over; maybe as part of the boot logo "This device belongs to Expedia"; there will be no risk of someone buying the device (perhaps on the used market) and not realize they don't own it.
Of course, there should also be an un-enrollment option for when companies decommission devices so they can be reused instead of just trashed, but that's an environmental concern not a security one.
Apple can brick or install an update to your computer even without MDM. For MDM you can not be spontaneously enrolled. In the article the user didn't notice this had been done until he reformatted his device.
2) YES.
3) Part of ... not specifically the Secure Enclave but the whole system. Hardware, firmware and software. You cannot bypass it.