you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 2 years ago (13 children)

... actually they aren't wrong. MDMs are given special permissions including but not limited to reading your SMSes and phone records, restricting and monitoring your installed apps and even wiping your device.

  • source
  • parent
  • hideshow 13 child comments
  • [–] 45 points 2 years ago* (3 children)

    I’m not sure what MDM you’re subjected to but I’ve been an MDM engineer for 7 years using Intune and JAMF and no, no SMS or phone records. Even the phone # is blanked out minus the last 4 digits. Yes we can wipe the devices if it’s lost\compromised but personal versus corporate owned devices are limited. I can’t see what apps you have that were personally installed. And the only info I can get are the device stats (SN, IMEI, storage, battery, memory, etc).

  • source
  • parent
  • hideshow 3 child comments
  • [–] 22 points 2 years ago* (2 children)
  • [+] 36 points 2 years ago* (last edited 2 years ago) (6 children)
  • [–] 5 points 2 years ago (5 children)
  • [+] 4 points 2 years ago (4 children)
  • [–] 1 point 2 years ago (3 children)

    I looked through your links. I don’t see anywhere that SMS can be read.

    From the link, emphasis mine. SMC is the MDM in question

    Read SMS or MMS
    Allows an application to read SMS messages stored on your device or SIM card.
    Malicious applications may read your confidential messages.
    SMC usage:

    1. Read the initial configuration and further server notifications.
      2. Read all SMS for Backup.
  • source
  • parent
  • hideshow 3 child comments
  • [–] 19 points 2 years ago* (1 child)

    Please cite any one of your sources. I've managed MDM for over a decade and you're spreading misinformation.

    Absolutely none of the MDM products on the market allow for the reading of personal e-mail, SMS, phone records, etc. On the contrary, almost every single one provides an information screen during the enrollment that makes it abundantly clear that they do not (and can not) access that data. Moreover, the "wipe" of data is the removal of company data. It doesn't wipe your phone, it just removes the work profile (Android) or deprovisions the work profile and associated apps (Apple). All of your non-work-related data is untouched.

    Quick Sources for Intune and JAMF -- do your own googling for others:
    https://learn.microsoft.com/en-us/mem/intune/protect/privacy-data-collect
    https://www.jamf.com/blog/apple-mobile-device-management-faq/

  • source
  • parent
  • hideshow 1 child comment
  • [–] 15 points 2 years ago* (last edited 2 years ago)

    Absolutely none of the MDM products on the market allow for the reading of personal e-mail, SMS, phone records, etc.

    So you're not aware of Sophos's MDM offering? That explicitly states they can make copies of all SMS messages?

    https://support.sophos.com/support/s/article/KB-000034436?language=en_US

    How about call logs, with SureMDM?

    https://knowledgebase.42gears.com/article/how-to-view-call-logs-on-android-phones-remotely-using-suremdm/

    Also I said nothing about personal emails.

    Moreover, the "wipe" of data is the removal of company data. It doesn't wipe your phone, it just removes the work profile (Android) or deprovisions the work profile and associated apps (Apple). All of your non-work-related data is untouched.

    No, the 'wipe' can be a full factory reset.

    https://learn.microsoft.com/en-us/mem/intune/remote-actions/devices-wipe

    Edit: typo

  • source
  • parent