So, is there a way to safeguard against this? I assume when I connect to an exchange server at home it doesn't have root access to my laptop, right?
MS Exchange “remote wipe” is a terrible, terrible bug
71–80 of 117 posts
Re: MS Exchange “remote wipe” is a terrible, terrible bug
#72Seems like we need something like vmware on phones. Then I can run the company's phone on my device. They can wipe, er, administer it any way they must. And I can still have one phone.
Re: MS Exchange “remote wipe” is a terrible, terrible bug
#73Is the "remote wipe" command really supposed to delete all the data on the device? It sounds to me like it's meant to erase just the data associated with the Exchange account, but that the implementors misinterpreted it to mean "erase the whole volume".
Yes, because once things hit your exchange account they can leak all over the phone. Attachments stored on it's flash storage/SD card and the like.
Re: MS Exchange “remote wipe” is a terrible, terrible bug
#74At first read it seems like a normal, in fact, useful feature, but the key line is this: "When he turns it back on, it’s back to factory defaults. All the settings, apps, and data have been erased. wtf?" Major case of Exchange over-reaching and wiping more than just Exchange data !?
As has been said elsewhere in the comments, it overreaches because once that data hits your phone it can leak in to other applications, the phone can store attachments on it's flash storage or the SD card, etc.
Re: MS Exchange “remote wipe” is a terrible, terrible bug
#75One point not being made here is that nearly every wireless carrier requires you to add an Enterprise Data Plan to your service in order to use an Exchange connector. AT&T requires this with the iPhone. Verizon, T-Mobile, etc. all require it for the Blackberry. I haven't heard of a single device/provider that doesn't require an elevated service level to allow for enterprise mail access.
So there's a security by obscurity to start with: the average user doesn't know to ask for the Enterprise plan, let alone what Enterprise even means in context. So the scenario here requires that a) the salesman talked them into it, b) they bought into that service for the extra $15 on top of the data plan, or c) they consulted with the company's IT department or policies and knew they had to get that service. If they didn't, they simply cannot connect to the Exchange account. There's very little "oops, I didn't know what I was doing" here. I hope that most companies have a clear policy against checking your work e-mail from personal devices, and on your own time. There are legal implications for overtime pay. We may look the other way in startups, but this can't always be done.
Most law firms require this, unilaterally. It's part of the deal-- we'll pay your enterprise data plan in exchange for knowing that we may wipe the device, control which apps you can install [this is another can of worms], so on and so forth, per the requirements of malpractice insurance and data security.
In a perfect world this wouldn't be required, but I think we all know this can't possibly be the case in many industries.
Re: MS Exchange “remote wipe” is a terrible, terrible bug
#76One point not being made here is that nearly every wireless carrier requires you to add an Enterprise Data Plan to your service in order to use an Exchange connector. AT&T requires this with the iPhone. Verizon, T-Mobile, etc. all require it for the Blackberry. I haven't heard of a single device/provider that doesn't require an elevated service level to allow for enterprise mail access. So there's a security by obscu…
Ugh--sorry for the inadvertent downvote. My bad.
Re: MS Exchange “remote wipe” is a terrible, terrible bug
#77If an IT department did this to me without warning, I'd quit that day , CC'ing my manager and the IT guy's manager telling them exactly why they'll now have to spend months finding and training my replacement.
I parked my personal car in the company fleet car garage and they clamped it. I didn't understand what was happening and called the rescue company telling them it had broken down and wasted lots of time. This was so unfair I quit that day , causing a dramatic fuss pointing out exactly how much they'll suffer. That'll show them.
Your analogy would be more apt if you once parked your car in the company lot, and then years later some IT guy sneaks into your house at night and clamps your car.
Re: MS Exchange “remote wipe” is a terrible, terrible bug
#78What is the offending module or piece of software on, for example, Android that does this? If it's an Exchange specific thing and works on many phones, why does it come preinstalled with root access and can I just disable or enable Exchange support to be sure nobody ever nukes my phone?
Re: MS Exchange “remote wipe” is a terrible, terrible bug
#79Uhm. Data loss is a huge deal. HUGE. This isn't an evil feature. It isn't a pointless feature. In fact it's a critical feature in the running of an organisation. Email. Calendar. Address Book. A gold mine of absurdly sensitive data. If you want corporate email on your phone, expect to have the possibility of a remote wipe. It isnt Microsofts fault that people use it maliciously. If you ask the user "do you wish to al…
> If you ask the user "do you wish to allow administrators to remote wipe your phone allow/deny?" what do you think they'll click ??? They will probably click "deny", and then not be allowed to connect to the server. Problem solved!
That solves nothing. You'd then have to buy company blackberries (probably for the best) as no one would be able to use corporate email on their home phones.
Re: MS Exchange “remote wipe” is a terrible, terrible bug
#80Seems like we need something like vmware on phones. Then I can run the company's phone on my device. They can wipe, er, administer it any way they must. And I can still have one phone.
You appear to be talking about ARM's TrustZone technology.