News for hackers. Stuff that matters.
Re:Don’t Put Your Work Email on Your Personal Phone by cj on Wednesday July 24, 2019 @09:55AM (#20515278)
Our company uses G Suite's Advanced MDM on a G Suite Enterprise account. I administer its configuration.

Unless I'm missing something, there's not an obvious way to "spy" on employees, which this article is claiming. Perhaps it's possible, but if it is, it would require a lot of deliberate effort to accomplish. For example, there's not an out of the box way to track employee location. There's not a way to track employee internet browsing history out of the box.

TLDR: using G Suite Advanced MDM, there are not out of the box solutions for tracking or spying on employees in the ways suggested in the article. It might be technically possible, but to accomplish it, your company would need to make a (large) deliberate effort to do this.

Re:Don’t Put Your Work Email on Your Personal Phone by mathie25 on Wednesday July 24, 2019 @10:53AM (#20515862)
Same, we use gsuite MDM for BYOD just to ensure that personnel's devices have basic security configurations (e.g. encryption, lock screen, etc.) Beyond that, this MDM is quite limited to what's possible to accomplish.
Re:Don’t Put Your Work Email on Your Personal Phone by helen___keller on Wednesday July 24, 2019 @09:59AM (#20515321)
>There's not a way to track employee internet browsing history out of the box.

Some large enterprises use MDM to deploy certificates and proxy policies that essentially force you into a MitM situation, with the intention of tracking browser usage.

Location is a bit more tricky. I would say that's less common, but I've seen MDM solutions that offer location tracking as a feature

Re:Don’t Put Your Work Email on Your Personal Phone by cj on Wednesday July 24, 2019 @10:04AM (#20515370)
Yes, there are probably sketchy MDM providers that specialize in employee tracking / spying.

I'm speaking to what's possible to accomplish out of the box with G Suite's Advanced MDM offering, without an extreme amount of additional effort.

(This is relevant because, when prompted to install a MDM profile, the MDM provider such as G Suite is visible to the end user)

Re:Don’t Put Your Work Email on Your Personal Phone by helen___keller on Wednesday July 24, 2019 @10:57AM (#20515892)
I mention this because one of the top use cases for MDMs is deploying said MitM setups. It's common in certain industries, like for banks and for schools. Saying this from experience because I worked for a company that produced both an MDM product and a MitM product.

For an MDM solution on iOS there's a big list of supported profiles you can deploy after the MDM profile is installed ( see https://developer.apple.com/business/documentation/MDM-Proto... under "request types").

If the device belongs to the organization, you might not even know these profiles are installed, if it's a BYOD environment you know you are installing the MDM profile and if you open the settings page you can manually inspect which other sub-profiles have been installed by the MDM.

But you're right the MitM itself isn't built into the MDM, because that's a totally different product category ("Secure Web Gateway"). The MitM setup only works if you have an MDM to enforce the certificates and proxy setup upon the user.

Re:Don’t Put Your Work Email on Your Personal Phone by cannonedhamster on Wednesday July 24, 2019 @10:32AM (#20515657)
Not even sketchy. Monitoring how long techs take on calls is a requirement in some roles for quality assurance and training purposes. Company I worked for had GPS tracking that they used to make it show that one employee was visiting another employees wife because our home base was over street over. It was a funny prank until it wasn't.

For g suite location is under Mobile management. They list it as a find my phone type of feature. There's even a picture of it on their marketing.

Re:Don’t Put Your Work Email on Your Personal Phone by avh02 on Wednesday July 24, 2019 @11:55AM (#20516498)
If I remember correctly, even the isolated work profile can add certificates on android. Probably the only reason I don't use that either.
Re:Don’t Put Your Work Email on Your Personal Phone by xorcist on Wednesday July 24, 2019 @01:47PM (#20517678)
Being able to push software installs is a pretty basic feature of MDMs. Is that not the case with G Suite?