iOS Internals · Staying Safe on iPhone · Lesson 2 of 5

Configuration Profiles

Learn what a profile can change on an iPhone, and remove one that shouldn't be there.

A file that changes settings

A configuration profile is a small file, often ending in .mobileconfig, that changes many iPhone settings in one go. Each setting it carries is called a payload. One profile might add your work Wi-Fi password, set up a school email account and connect a VPN (virtual private network, a private tunnel that carries your internet traffic to another network).

Profiles are an everyday tool for schools and businesses. Many go further with MDM (mobile device management), a service that lets an IT team manage a phone remotely. An enrollment profile connects the phone to the MDM server, which can then send settings, install work apps, check details like the phone's name and battery level, and lock or erase it. Apple's Personal Safety guide notes that these tools may allow access to data or location information on the device. That's fine on a work phone you agreed to. It isn't fine when a stranger set it up.

iOS doesn't let a website install a profile silently. When you download one from a web page or an email, it waits in Settings as Profile Downloaded. You have to open Settings, tap it, tap Install and enter your passcode. If you don't install it within 8 minutes, iOS deletes it. Before you install, iOS shows what's inside, so that screen is your chance to say no.

Scammers know people tap through prompts. A fake prize page or a "free VPN" may walk you through each step and promise it's required. A real prize never needs a profile.

On the simulated phone, a scam site has asked you to install its profile to claim a prize. Follow the Profile Downloaded flow, open the installed profile in Settings, General, VPN & Device Management, read each item it contains, then tap Remove Profile.

Root certificates and cleaning up

When you visit a site over HTTPS, the site proves who it is with a certificate, a kind of digital ID card. Your iPhone trusts that ID because a well-known certificate authority vouched for it, and your phone ships with a list of the authorities it trusts, called root certificates.

A profile can add a new root certificate. If your phone fully trusted a scammer's root, the scammer could make fake ID cards for any website, and your phone would accept them. Pair that with a VPN that routes your traffic through their server, and they could see inside connections you thought were private, such as logins.

iOS adds a safeguard. A root certificate you install yourself from a website or email isn't trusted for websites until you turn on a separate switch in Settings, General, About, Certificate Trust Settings, under "Enable full trust for root certificates". If that heading doesn't appear, no extra certificates are installed. Certificates delivered by a company's MDM are trusted automatically, which is one reason to enroll only in MDM you know.

This isn't just theory. In 2018, Cisco Talos researchers reported attackers who enrolled 13 iPhones, apparently in India, in a malicious MDM server and used it to push altered versions of apps. Talos thought the victims were likely tricked by social engineering or that someone had physical access to the phones.

To check your own phone, go to Settings, General, VPN & Device Management. If no profiles appear, none are installed. To remove one, tap it, tap Remove Profile (Apple's safety guide calls it Delete Profile), follow the prompts and restart. Everything the profile added, including its settings, apps and data, goes with it.

Two cautions. On a work or school phone, ask your IT team before removing anything. And if you think someone you know installed a profile to watch you, consider your safety first, because removing it may be noticed.