It will take you less than 30-seconds to check your iPhone for this dangerous setting and delete any threats to your device and your data—given this latest warning, you should do that today…
Serious new warning issued for iPhone users
Getty Images
A serious new warning doing the rounds in Asia has alerted Apple users to the risk of rogue VPNs and device profiles on their iPhones—“users may have been tricked to install suspicious apps via bogus websites, SMS messages and links to the malicious malware.” While the risks for most users are low, checking your device takes less than 30-seconds—and so it’s well worth the time.
This latest story broke after users were tricked into installing malware that accessed their bank accounts. While those targeted initially suspected a malicious power cable might have been the issue, in reality it was a dangerous profile they had been tricked into installing. “The scammers often waited for the user to go to sleep before they would trigger the malware to take control of the phone and open mobile banking apps to steal from their victims’ accounts.”
As ESET’s Jake Moore warns, “when playing around with device management, you must be extremely careful and confident with what you are installing. This is the closest users can get to editing device configurations, but if it’s malicious then dangers can follow.”
MORE FROMFORBES ADVISOR
For those unlucky enough to fall foul, a dangerous profile would theoretically enable remote access to your device—it would certainly create a potential vulnerability. And while Apple locks down its own devices much more tightly than Android equivalents. The EU-inspired DMA changes to app installs from outside Apple’s own ecosystem will make these kinds of risks more likely.
Apple has publicly warned exactly that: “The DMA requires changes that bring… new avenues for malware, fraud and scams, illicit and harmful content, and other privacy and security threats. These changes also compromise Apple’s ability to detect, prevent, and take action against malicious apps on iOS and to support users impacted by issues with apps downloaded outside of the App Store.”
‘VPN & Device Management’ settings
Apple / iOS 17
Head to “Settings-General-VPN & Device Management,” and make sure you recognize all the profiles you find there. If you’re certain a profile is no longer needed or it’s something that shouldn’t be on your phone at all, you can easily delete/remove it.
As well as enabling VPNs to be installed, these configuration settings form a key part of the mobile device management (MDM) options that enable enterprises such as schools and businesses to securely manage device permissions inside their networks. This becomes ever more needed with the increasing use of bring your own device (BYOD) policies.
Checking there are no illicit VPN or device profiles on your device is exactly the kind of good housekeeping that a more open ecosystem warrants. But make sure profiles are not associated with your school or company before deleting. As Apple warns, “if you delete a profile, all of the settings, apps, and data associated with the profile are also deleted.”
“Organizational policies are standard, but with open ecosystem changes the potential of letting in rogue capabilities increases,” Moore says. “But with increasing use of VPNs and BYOD, handing over such capabilities and even some degree of ownership are becoming more normal.”
If there’s a profile you do recognize but you no longer use, you should also delete it. It’s not good device management to leave dormant vulnerabilities in place. That means old VPNs you no longer use can be deleted. As for which VPNs to keep, the usual advice applies—they’re only secure if they’re secure. Only use VPNs from reputable developers you recognize. Avoid the free giveaway ones.
And as Moore advises, “it is worth regularly revisiting the VPN and Device Management setting to see what has authorization and if there is anything unusual then it should be investigated or deleted.”
