MDM on personal iPhone - Businesses, unauthorized developer activity HELP!

I am going through the same struggle. You were probably not actually on a phone call or chat with the legitimate Apple support, usually when you contact you will get a confirmation email of your contact. I also got elevated to the “Senior Technician” and I got suspicious and started asking questions and he hung up. That was from a “chat” and then the person typing said their supervisor would ring me straight back. Another time I was calling the correct number from my iPhone using the legitimate Apple website number, she asked for my AppleID and then tried to get me to screen share (did not ID me other than my email address) so I hung up.

I ended up taking in to the Apple Store my devices which were reset but it hasn’t resolved. From what I have pieced together it has been active for at least a year on my iPhone. The updates have not solved anything. I have never run anything non genuine on it and it’s always been keep updated. Tonight I captured my MacBook Pro kernel launching a buffer overflow to one of the Apple Devices.

I have also had the battle of the off and on settings, although it hasn’t happened on the iPhone in front of me as soon as I close Settings it changes it back.

Unfortunately until more people start kicking up a fuss we are on our own. I’m stuck with thousands of dollars worth of new Apple products that are not in my control.

You are quite correct, fortunately no one has accused me of being crazy as I’m a psychologist.

I guess what we have to remember is these discussion forums are answered by fellow Apple users and not Apple staff. So we may not find much support.

Whatever this is extremely insidious, my sharing is all disabled on my iPhone yet it is constantly searching for powered and unpowered devices nearby. I can see the data usage does not add up to the user activity. I feel sick to think how long it was on there without knowing and what it has captured of my children as it’s a part of their daily lives too.

It is something akin to the Mac Dirty Cow, although what is done after it is exploited I suppose may vary, there are actions being performed on my devices that I cannot find references to anywhere.

Question, can you see JavaScript and Xcode on a Mac? The MDM spread to Windows with the fraudulent remote access apps, I could see that, but permissions are changed always, MDM on, parental controls on. Another question, I unplugged my router 8 weeks ago, but they are still accessing devices, I’ve seen ppl parked at end of driveway a couple of times when several devices were active but not every time. I’ve seen a lot of data transfers on Roku )not to movie or Roku). I did a scan for active BT, one Roku showed up (I’ve seen many users on there as well), and data transfers from the former Alarm. Idk if Roku is connecting to neighbor? Lots of settings and downloads are put in iCloud with synch to all, but a user can’t do that, unless it’s a MAC option. I’ve had tons of scripts, not always visible on iPad (unless under shortcuts), but visible on a Windows PC (although 7 PCs are compromised). I know the MDM will have to be blocked before entering my house!

When they say you are crazy, ask them if they ever read? See Pegasus 2015 and forward. There are also scripts (37) that is C&C that will take complete control of your device! I also read (but not verified Apple now gets viruses 2 per 1 in Windows. Unfortunately, this is not a virus.

I know a lot of what is happening and have documentation, read through my posts. But the knowledge does not help to remove the MDM. I wish I could help you. I have decades of security experience (now disabled). But even with Corp Security tools, I still could not remove this. I can’t even delete games. And ppl that say you are crazy just don’t understand the complex technology. The MDM tool does not appear to be complicated, but it causes a lot of damage. Please do write to IC3.org, it might help with the antitrust issue with MDM that the DOJ considers to be a high security risk!

This is getting really bad. Why Apple and Google won’t address the elephant in the room is just so wrong.

I am seeing everything you guys are, the wifi is hacked, iOS iPhone and iPads, macOS MacBook Pro and Mac mini, Chromebook ChromeOS, Android phone.

I’ve been calling it InvisibleBeta and StealthyDeveloper because we can’t see it but they are there!

To Pia, I received info in my inbox sent by you, but attempting to use the link to your post was blocked, it included the wording “can lshow you a screen shot where the Mac “. I’d read that you must have a Mac to install this, I have no MAC. But I’ve received attacks and such from a MAC, web iCloud access with a Mac and more. I’ve lost a lot of $ due to equipment destruction, hiring ppl, software and much more, a lot of fraud, including Apple apps that were purchased then hidden. I also read that purchases only show on the device used to purchase, but sometimes I see these purchases, and some are free. When I searched on your name, only the above post showed up. I should mention the app is hidden. At one point, I decided to download the App, it was the only app I’ve seen to date that included a hide or hidden button on the shortcut. When I downloaded, it said I had to contact the administrator [of the Apple Configurator or MDM] to view anything. I have the usual symptoms of MDM plus many more at this point, lots of JavaScript on websites, 87 JS under shortcuts in one day. Getting new everything has not helped. I completely disconnected my Internet weeks ago, but they are using a rogue Wi-Fi router. I’ve found 3 other routers, but not this one. It turns on Bluetooth then the router, all devices have been compromised. Resetting network made no difference. Turning off settings, no difference as they get turned back on. Only my iPhones have connectivity. A lot of data transfers in the background, and my devices had data offloaded to a cloud service, about 9 were installed. Simple settings, like only use the current number for messages does not work, they are broadcast across devices. Also, I recently found out that ppl were coming in my home when I’m not here. Ok, I don’t recall the last time I went to iTunes, I used to avoid all apps on phones, at least no third party apps. The other thing, the beta site, I’ll have to try to find that. But there is no MDM under VPN settings, there is a link to work or school but the Apple ID does not work there. Must you have a Mac to view this information? It’s been a long time since I’ve used one. And I don’t recall, but it seems like you can’t search MDM on IOS, found many entries on Windows PCs, 1,000+. Then strangely enough, if I start out with a new PC or reformatted device, settings are changed within 3 minutes, permissions, accounts deleted, restricted to C drive, restricted on everything I look at! All with no Wi-Fi network (except the rogue). Same thing happens in router/firewall. When I reset, or buy another they jump in, change admin password and throw me out. This app is one of many that were installed and hidden, like 2 remote access apps, a screen recorder (which I can view but without any controls), it even created and mailed a link of the recording to me and company (someone else?).

I”m certain I’ll have to get rid of all equipment again, but the MDM scans for all devices, phones, PCs, iPads, IoT, everything.

ok, did your actions get rid of this? Must I get a MAC computer? There have been many attacks on Apple lately, one called VastFlux and it used JavaScript, 11 million phones! Plus, 1,700 apps on the App Store were infected, even viewing the ad for these apps caused infection, dubbed the largest attack in history. More on Human Security, point is, I think the flood gate is open. Antivirus has been no help on the iPhones.

I have to remove the MDM, I even asked if I could install it on a new set of devices, but was told “NO” because I’m not a company! This is not a third party app, it indicates it was developed by Apple.

so, would getting a MAC work or help? Are the MAC devices able to be protected with AV? Can you see installed files? I’m seeing something new now, attempts to install a “WebKit” which some sites indicate has been compromised, but this activity is not very visible. Could I use an iPad to view anything? We have public places where you can go and use computers, but no MACs, and you can’t install anything. I’m going to look for the beta site. Thanks so much for your info. This has been going on for 2 years now.

More to gravityfed:

I guess you must get rid of everything that could have Wi-Fi, Bluetooth or mobile access, possibly DECT, but not sure. Getting just new Apple devices won’t help. So, router, modem, printers, PC, Apple, any old devices, all light bulbs, connected cameras, TV sets of vulnerable, Wi-Fi headsets, much more. more. Other devices as well. Idk if you put “smart” devices in the guest network would help if already compromised. And keep in mind, if you configure your smart device using something that resides in your regular 2-5 ghz router, you just crossed over.

There are many things that I can’t remember how to do (if I ever knew), like securing remote access with 801.x, ppl get in my network within minutes. Firewall rules get over written in seconds. It seems very extreme. I was in Info Security for many years, never saw anything like this. And, you need a corp email/domain to read white papers about security tools! I’ve looked at the referenced logs you mentioned “The presence of beta identifier strings in logs” but what does that mean? I’ve seen installations of things, some worked some did not. But could you give me a sample of what I’d look for with “identifier strings”. I know that the shorter JavaScripts store most data in the cloud, but have no

idea how to view what is actually being done, unless it’s standard Apple Stuff. I know simple words can mean something very bad? Have you reported to IC3 dot org? They have a major issue with the MDM, search on that and Antitrust. I hope they lock this stuff down.

You only own 1 device? No Windows or android? Oh, it says Linux? Search on file system for MDM. Those apps are likely fake! Search on 13 million iPhones compromised (2015?). It involved many fake apps. It’s likely someone you know with a MAC computer. I think the initial install must be done with physical access. You can’t get rid of it. But it also gets on everything!

I have been going through this type of situation for 2 years 8 apple ids 3 carriers

3 brand new apple devices and one Mac Pro all infected the same way . I have tried everything once I put my name and dob in device it’s a dead ringer I cannot stop sharing with note or home. But I’m sure if all the users with the same problem can get help because as consumers we have rights

T3ddy19 wrote:

Report the MDM to IC3.org! You will have to use another computer. Search the net for MDM, Antitrust, government. It’s a dangerous program to USA security!

I believe you mean IC3.gov. The address you provided is to some insecure site registered to a company called "Dynadot".

I’ve found several hidden devices. If it’s the Hidden MDM, it does geo fencing and scans your network for any new devices. It appears they can get into network once MDM is installed, it sends a beacon and it searches for serial numbers. Contact IC3.gov as they (gov) are trying to get rid of the MDM due to security issues! Also, Apple keeps a record of all devices that access your devices, although you will likely need a subpoena. I’ve read a sheriff can issue one. You will need supporting documentation.

You can’t get rid of it unless you get a subpoena. Be very specific on data you need (they keep it for 10 years). It is likely the person you suspect. The MDM has a “geo fence”, or designated area that basically is used to scan the area around your house. Anything new automatically gets scanned and installed. There have been many reported cases of this same issue! Look at any “hidden” apps downloaded since it started, I didn’t know you could hide apps! You will likely see the Configurator. Or MDM, plus several other apps, such as remote access. I had to get help from Apple to view hidden apps. Apple also provides scripting tools, so SSH (used for remote access) CMD and so on can be purchased in the App Store. They say you must be a company or school to purchase this? It goes by the serial number which is also the Wi-Fi address, so unless the person/installer removes it, it will come back! Most of the script is stored in the cloud. You can see some of the scripts under shortcuts (JavaScript). I’m not an expert with coding, but like you, I gave it a try. It’s been two years now, and things get worse as time goes by. They even used Siri to search communities for posts.

T3ddy19 wrote:

You can’t get rid of it unless you get a subpoena.

How does a request for documents (or a request for someone to appear in court) remove anything from your phone?

It goes by the serial number which is also the Wi-Fi address,

Device serial numbers are not WiFi addresses.

They even used Siri to search communities for posts.

Siri does not have that capability.

It does not remove it from your iphone. A subpoena tells you who/what/when/where. Based on state, you might be able to get a subpoena from the sheriffs dept, or DIY, I don’t recall saying court? It’s not taking someone to court. You could get a restraining order (and request removal). The details would show who installed it.

I was also not aware Siri could do such things, I tried it myself with no results, but the search showed in history? And, Siri does provide web searches, since it was done, yes it can if you have the skill. But I’m not interested in Siri.

But the MDM and compromise has also done many things previously thought impossible.

I’ve already been told considerable information. I’ve not researched Siri or how it conducts web searches, but have received web sites when I tried it. But I’m really not interested in learning how to do web searches using Siri, I’m trying to remove the MDM.

what helpful info have you provided on how to remove the MDM? I thought you requested help, as others have.