Automating Jailbreak/Root Detection and Remediation

This document outlines the operational and technical framework for implementing Jailbreak and Root Detection within Hexnode UEM. It covers the detection logic, the configuration of automated response workflows, and remediation protocols to ensure zero-trust security across the mobile fleet.

1. The Automated Defense Loop

   In a Hexnode UEM environment, detection is the trigger for an Automated Quarantine Workflow. When the Hexnode agent identifies a compromised kernel or unauthorized binary managers (e.g., Cydia, Magisk), it transitions the device into a “digital isolation” state. This prevents a single compromised endpoint from serving as a lateral movement gateway into the corporate network.

2. Detection Mechanisms

   Hexnode utilizes multi-layer sensors to verify OS integrity. These checks occur during periodic syncs or are triggered by specific security events.

3. Configuration Steps (Hexnode UEM)

   Step A: Enable Detection Sensors

   1. Navigate to Policies > Compliance Policies > New Policy > Android/iOS > New Blank Policy.
   2. Under Basic Settings for iOS, enable the checkboxes for Device is Jailbroken for iOS/iPadOS devices.
   3. Under Advanced Settings for Android, add the criteria Device Root Status is True to mark device as non-compliant.
   4. Set the Scan Frequency (under Admin > General Settings) to ensure periodic validation.

   Step B: The Quarantine Workflow (Dynamic Groups)

   Dynamic groups serve as the “logical engine” for automation.

   1. Navigate to Manage > Device Groups > New Dynamic Group.
   2. Define the Filter Logic: Compliance Status is Non-Compliant AND Compliance info for Jailbreak AND Rooted is True.
   3. Name this group QUARANTINE_COMPROMISED.

   Step C: Automate Access Revocation

   Create a Quarantine Policy associated with the dynamic group above to enforce the following:

   • Device Restrictions: Disable Wi-Fi, Camera, and Bluetooth to prevent data exfiltration.
   • App Management: Configure “Blocklisted Apps” or remove managed corporate apps (e.g., Outlook, Slack) upon non-compliance.
   • Network Isolation: Use the Global HTTP Proxy or VPN-based Data Restrictions to redirect web traffic to a security warning page.

4. The Quarantine Matrix: Severity Actions

   Detection Type	Severity	Hexnode Action
   Suspected Root	Medium	Block Access: Revoke email/IdP tokens via Okta/Entra ID integration.
   Confirmed Jailbreak	High	Enterprise Wipe: Automatically remove all corporate-installed apps, accounts, and profiles.
   Integrity Failure	High	Lost Mode/Lock: Enable Hexnode “Lost Mode” to render the device unusable.

5. User Remediation & Troubleshooting

   Set an automated broadcast message to be sent to the devices in this dynamic group to initiate at device non-compliance.
   CRITICAL SECURITY ALERT: Your device has been flagged for “Unauthorized OS Modification.” To protect company data, all corporate apps have been removed. Please contact the IT Security team immediately.

Common Issues

• False Positives: Certain developer-centric Android devices may ship with unlocked bootloaders. These should be manually added to an Exclusion Group.
• Delayed Status: If a user “reverts” a jailbreak, the status remains “Non-Compliant” until a Manual Scan is triggered from the Hexnode console.
• Agent Protection: Always enable the “Prevent MDM Profile Removal” restriction to prevent users from bypassing detection.