Too Easy – Adding Root CA’s to iOS Devices

This blog demonstrates how trivial it can be to push a malicious root CA or a signed configuration profile to iOS devices (via captive portals or delivered .mobileconfig files), which allows an attacker to perform HTTPS MitM and configure device settings — potentially including persistent MDM — with minimal overhead and only user interaction. The author shows the steps, UI screenshots, and explains that while this enables broad interception, certificate pinning (e.g., for recent iMessage traffic) mitigates some specific attacks.