Jailbreak Detection overview

Understand the security implications of jailbroken or rooted devices and how BigFix MCM identifies these risks.

What is Jailbreaking and Rooting?

Jailbreaking (iOS/iPadOS) and Rooting (Android) are processes that bypass the manufacturer's security restrictions to gain administrative or "root" access to the operating system. While this allows for greater customization, it compromises the device's built-in security sandbox.

Enterprise Security Risks

Compromised devices present significant vulnerabilities to corporate data, including:

  • Malware Susceptibility: Unauthorized apps can bypass security checks to install spyware or ransomware.
  • Data Exfiltration: Enterprise apps lose their encrypted isolation, allowing malicious tools to scrape sensitive data.
  • OS Vulnerability: Rooted devices often miss critical security patches or run outdated kernel versions.

Supported Operating Systems

The Jailbreak Detection is supported for the following platforms:

  • iOS / iPadOS
  • Android

How BigFix Detects Compromised Devices

The BigFix Agent app performs local inspections for specific "indicators of compromise" (IoCs), such as:

  • Presence of the Cydia, Sileo, or Zebra package managers.
  • Existence of the /bin/bash or /etc/apt directories on mobile platforms.
  • Unsigned system binaries or modified bootloaders.

Compliance Scenario

An organization can use the Scan for Jailbreak action to identify non-compliant devices. If a device returns a Positive status, an administrator can immediately trigger a Wipe or Lock action to protect corporate resources.

Best Practices

Important: Always combine Jailbreak scans with Policy Groups to automate the response to compromised endpoints.
  • Schedule scans during off-peak hours to minimize user impact.
  • Inform users that rooted devices are strictly prohibited by corporate policy via the App Catalog messaging.