Local Actions against network, device, and app threats

No action will be taken on the device.

Removes configurations that provide access to corporate resources, such as certificates. Configurations that secure the device are not removed.

Removes configurations that provide access to corporate resources, such as certificates, with the exception of Wi-Fi settings on all devices. Configurations that secure the device are not removed.

Disables Bluetooth to the company App Catalog and/or work apps.

A reconnaissance scan using the ARP protocol that is oftentimes an indicator of a malicious attacker searching for a device vulnerable for a network attack such as man-in-the-middle (MITM).

Danger Zone Connected provides device users with information on nearby Wi-Fi networks and their potential risk. If an iOS or Android device user does connect to a malicious Wi-Fi access point, the device user will be notified: "This device has connected to a Wi-Fi network where malicious attacks have been observed. It is recommended to disconnect immediately and use an alternative network."

Procedure

To enable Danger Zone Connected:

1. Log into the MTD console, and navigate to the Manage > General page.

2. Click Enable the Danger Zone feature in zIPS.

   For Android release 9.0 and higher supported releases, if the app developer does not add the Access_Coarse_Location permission, then the following MTD console functionality is not enabled:

   • Network name and BSSID fields are not available for threat forensics information.
   • Network threats are not mitigated.

   If MTD console cannot get the BSSID from the device, then the Danger Zone Connection threat will not work.

Detected application connecting to private, internal servers. It is uncommon for public applications to connect to internal servers. Public applications connecting to internal servers is considered suspicious behavior and should be investigated immediately for the possible threat of malware installed on the device and the risk of data leakage.

Man-in-the-Middle attack using ARP table poisoning where a malicious attacker can hijack traffic and steal credentials or deliver malware to the device.

Man-in-the-Middle attack using ICMP protocol where a malicious attacker can hijack traffic and steal credentials or deliver malware to the device.

Network handoff allows a device to alter routing on a network, potentially allowing for a man-in-the-middle attack.

Rogue Access Point exploits a device vulnerability to connect to a previously known Wi-fi network by masking a nearby network.

A reconnaissance scan using the TCP protocol that is oftentimes an indicator of a malicious attacker searching for a device vulnerable for a network attack such as MITM.

Detected abnormal activity. User device is being monitored for any attacks.

Ivanti Mobile Threat Defense has detected this device is vulnerable to BlueBorne, an attack leveraging Bluetooth connections to penetrate and take control of targeted devices. To avoid any sort of risk from BlueBorne, it is highly recommended that the user turn off Bluetooth permanently until an update is available from the device manufacturer or wireless carrier. For those users that still require the use of Bluetooth, it is recommended that Bluetooth is turned off until it is needed and only in a trusted and secure area.

Daemon Anomaly indicates abnormal system process activities which could indicate that the device has been exploited.

Device Encryption notifies an administrator when a device is not setup to use encryption to protect device content.

Jailbreaking and rooting are the processes of gaining unauthorized access or elevated privileges on a system. Jailbreaking and rooting can potentially open security holes that may have not been readily apparent, or undermine the device's built-in security measures.

A normal file system change.

Proxy configuration change on the mobile device that can be indicative of sending traffic to a non-intended destination.

Sideloaded apps are installed independently of an official app store and can present a security risk.

Suspicious profiles identifies profiles that are untrusted or not explicitly trusted. Ivanti recommends that you review the profile and mark it as trusted or untrusted.

USB Debugging is an advanced configuration option intended for development purposes only. By enabling USB Debugging, the user device can accept commands from a computer when plugged into a USB connection.

An untrusted profile is considered unsafe to install on your devices. An untrusted profile could be used to control devices remotely, monitor and manipulate user activities, and /or hijack traffic.

Ivanti Mobile Threat Defense has detected that the iOS version installed on your device is not up-to-date. The outdated operaing system exposes the device to known vulnerabilities and the threat of being exploited by malicious actors. It is advised to update the device's operating system immediately.