iOS is Apple's operating system for the iPhone, iPad and iPod Touch.

learn more… | top users | synonyms (1)

0
votes
0answers
26 views

improving iOS 8 and os x security [closed]

I was just going through the iOS security guide and it made me wonder how could one improve security features already present. the current system in general looks pretty secure and well thought out ...
1
vote
1answer
24 views

iOS permissions for 3rd party app developers [closed]

I am putting together a summary on iOS and Android security risks based on app permissions. On Android, it is easy to define all of the permissions and what 3rd party developers have access to (from ...
3
votes
1answer
41 views

Are SIM proactive commands secure?

A SIM card can initiate some communication with a mobile device with so called "proactive commands" (chapter 6 of http://www.etsi.org/deliver/etsi_gts/11/1114/05.04.00_60/gsmts_1114v050400p.pdf). ...
1
vote
1answer
40 views

Private messages for an ios app - how secure is this system?

I'm designing architecture for sending private messages (i.e. only sender and receiver are able to read a message). Client side - iOS, server side - Parse.com I'm thinking of using RSA to ...
3
votes
1answer
69 views

Why do mobile operating systems not implement a way to deny permissions to an app?

Android and iOS (afaik) implement a relativly fine-grained permission schema for their apps. But as I user I only have the change to acceppt all or nothing. When I think about it, it shouldn't be a ...
0
votes
0answers
21 views

Does sending a token back with a different channel (iOS Push Notification) improve security?

So I have this customer who has a project which is "very sensitive". It's a Jabber client which will connect to their servers to allow users to communicate. Here's what he requires for the ...
3
votes
1answer
69 views

iOS VPN profiles - are the signing certificates global? Can this be a MITM exploit?

I have installed an app on iOS to connect to a well-known VPN service. The app requests installation of a profile onto iOS, which as far as I can see are a collection of 7 certificates - 5 of which ...
3
votes
0answers
37 views

Does changing my password after OAuth login in mobile app help reduce risk?

When you use a mobile app that needs Google OAuth login, you can't fully trust the third party app because you can't tell what url the webview is using. Who knows if they aren't storing my login and ...
2
votes
3answers
233 views

Security of email sent/received on iPhone via Mail app

In regards to the default Mail app on iOS 8, setup with various mail accounts gmail, outlook etc. Are emails sent/received to/from the phone securely, if so, how? Can someone who is snooping on the ...
2
votes
4answers
400 views

Can visiting a malicious website infect an iOS or Android device?

Can visiting a malicious website infect an iOS or Android device? We're talking about visiting such sites via a browser. We're not talking about downloading any malicious apps. Thanks!
0
votes
2answers
102 views

how to encrypt a sensitive model on android and ios

I am writing a mobile app which uses a statistical model contained in binary files. I want to be able to distribute the app freely, but I don't want anyone to be able to use my model files, even on a ...
1
vote
0answers
81 views

Force TLS on mobile app

i'm developing a mobile application for iOS and Android. On this app i'm asking resources on a secure server through ajax. Server's developers asked me to force the call in order that we use TLS ...
2
votes
1answer
69 views

Code analyzer for Objective C? [closed]

Has anyone come across a code analyzer that could be run on OS other than Mac to scan for Objective C (for iOS) code?
0
votes
1answer
106 views

Iphone app not allowing proxy

Hi everyone I am interested in how a banking app works, especially the way it handles https requests. So I installed one, set my proxy settings, started burp suite and expected it to work. As you may ...
0
votes
1answer
159 views

What tools are available for iOS vulnerability assessment and penetration testing [closed]

I want to start learning about VA on Apple iOS devices. Besides documentation, is there any good tool - in terms of automated vulnerability scanners, or scripts - to start?
1
vote
0answers
90 views

FIPS Compliance with iOS app

Our company is working on getting FIPS validation for the iOS app and is in the initial phase. We have decided to use a private FIPS-certified libraries for using in the crypto modules. I have some ...
6
votes
3answers
2k views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
1
vote
1answer
113 views

Will ios8 encryption fail on forced shutdown?

I understand that IOS 8 data can be encrypted when the phone is locked, and decrypted for use when the phone is unlocked. But let's say the phone was unlocked (and thus the data is decrypted), and ...
6
votes
3answers
1k views

Accessing iPhone data without passcode - how difficult?

I use iOS7 with a 4-digit passcode that isn't on any top 10 lists. I have "Erase all data after 10 failed passcode attempts" turned on. How hard would it be for someone who stole my phone to get ...
3
votes
2answers
152 views

Security through obscurity - “https requests” are safe?

In an iPhone app that utilizes plain text (unencrypted) XML as the contents of its http POST requests over https to the app server; how would someone be able to discover the "format" of the plain text ...
2
votes
0answers
175 views

What unique device fingerprinting information can an iOS8 app collect?

As a follow-on to this question: What unique fingerprinting information can an iOS7 app collect? What remaining device fingerprinting privacy / security vulnerabilities still exist as of iOS 8? Can ...
0
votes
0answers
39 views

Do iOS applications have access to the certificates installed?

As the title says, I'm curious if a generic iOS application can access/retrieve the certificates installed in the device (e.g., via a management profile) Thanks
12
votes
1answer
651 views

When does iOS check validity of enterprise certificates?

Here is an article that should give a little more context (and see my comment on it, same username, for additional info). iOS developers are able to distribute apps outside of the App Store using an ...
4
votes
2answers
311 views

Encrypt with private and decrypt with public

Above picture is captured from iOS Security overview at page 25. The path encrypt with public and decrypt with private makes sense. But the other path, encrypt with private and decrypt with public ...
8
votes
2answers
4k views

Android L encryption vs. iOS 8 encryption

Recently, the new full-disk encryption system of Apple's iOS 8 operating system has been in the news. And soon after Apple's release, Google announced that they will also enable encryption by default ...
1
vote
1answer
74 views

Securing iOS applications communication from client side

Many of you have heard about instagram flaw that facebook has not fixed yet, The flaw allows the attacker to hijack the session by sniffing the session cookie on Instagram iOS app since it does not ...
2
votes
1answer
489 views

Capturing iTunes traffic with Wireshark - SSL decryption question

I'm fooling around with Wireshark to capture the activation packets for an iPhone and some other stuff, however the traffic is encrypted. There should be a private SSL key somewhere on my computer to ...
3
votes
2answers
176 views

How does iOS prevent unauthorised code from running?

I'm just wondering. How does iOS prevent someone from executing code on their device that isn't from Apple or downloaded from the App Store? Also what exactly, does a Jailbreak do to allow ...
9
votes
4answers
5k views

How do location-based apps avoid getting cheated by emulated GPS?

Some apps like Foursquare require the user to "check in" at physical places, in order to gain money benefits. Given that emulated GPS are available for customized versions of Android, it sounds easy ...
4
votes
3answers
492 views

Method to integrate Touch ID in iOS apps

With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
1
vote
0answers
379 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
1
vote
0answers
36 views

Is SCEP safe if I use a different long and complex password per enrollment, and validate it against expected parameters?

I'm considering using SCEP to enroll iPads and other devices in my network. The iOS configuration profile allows me to configure a different password for each device. Is it valid, and safe for me to ...
0
votes
3answers
80 views

How secure is my method?

I want to select data from a MySql database on an iphone device. The method I seem is the easiest one is to connect to a php file with GET arguments and then return it as a string. Now I'm just ...
1
vote
3answers
897 views

How secure is iOS Touch ID?

I was wondering how secure Touch ID/Keychain is really. My understanding is that iPhone 5S devices that use Touch ID allow you to enter a passcode if your fingerprint doesn't work, as a "fallback". ...
1
vote
1answer
110 views

Secure way of opening web page from iOS without need of logging in

I am developing an iOS application and web page, both use same Parse backend. Web page contains some functionality that is not available in the iOS application. Therefore I would like to present the ...
0
votes
2answers
185 views

What security mechanisms are in place for iOS' custom keyboards?

Apple has just announced iOS 8. The new version appears to be more extensible than previous versions, and one of the new possiblities is to allow developers to develop custom keyboards, different than ...
1
vote
1answer
280 views

What encryption does Apple use?

With their iOS devices, Apple allows people to block certain applications through "Restrictions". I recently had an issue with my iPhone where I'm positive that I entered the correct passcode on my ...
1
vote
2answers
1k views

Securing JSON data

I am planning to use JSON as the data transport mechanism between my iOS app and my server (the server is a WCF service). While learning about JSON, I realized that all the data is passed around ...
2
votes
1answer
102 views

Should a Mobile app able to check what password is locally saved via a user facing feature?

I'm working at a company who is currently working to secure their mobile app (iOS native) by adding check points to security sensitive screens on the device (data is stored in the iOS keychain). User ...
1
vote
1answer
454 views

Share and store RSA - public key in java server and vice versa

My requirements are: Requirement 1: Share public key to java server. Steps: Generate public-private keys in iOS app. Store the generated keys in keychain. Send generated public key to java server. ...
3
votes
1answer
838 views

iPhone iOS 7 Encryption at Lock Screen

Following this topic, I have a question about how the OS and apps access data while the phone is locked. Particularly in the case of iPhone 5S running iOS 7. When the device is locked, what allows ...
1
vote
1answer
213 views

Obfuscation and Mobile App

Recently, I stumbled with this topic in my mind for few days. I understand that obfuscation is not the best protection against reverse engineering. I wonder if there is another method that make it ...
0
votes
1answer
533 views

How to prove iOS app is vulnerable to MiTM

I'm updating an iOS app and I want to prove that it is vulnerable to MiTM attack. I have set up Charles Proxy on my mac and configured the Simulator so that it trusts Charles CA Certificate, per ...
0
votes
2answers
522 views

Are passwords safe to send through POST, without SSL in a iOS app?

Is it safe to post passwords to my web server in this manner? NSURL *url=[NSURL URLWithString:@"http://mywebsite/test/register.php"]; NSData *postData = [post dataUsingEncoding:NSASCIIStringEncoding ...
0
votes
1answer
130 views

Tablet / phone app security in unsecured networks

Although reluctant to use my laptop on unsecured networks, I at least know that without me launching any processes or logging into certain web pages, that I will not be sending any credentials over ...
5
votes
1answer
91 views

Decline any custom ssl certificate in a mobile application

Consider the following scenario. Eve creates an access point in a public place. Alice connects to the AP via mobile phone and starts browsing the Web. Eve redirects Alice to a registration page and ...
5
votes
3answers
714 views

Asymmetric Key Encryption in Group Chat

I am working on a chat application which supports both single user chat as well as group chat. We planned to encrypt messages in single user chat by public key of receiver and decrypt it using ...
13
votes
2answers
4k views

Is Apple's push notification service implementation vulnerable to a MitM attack

Recently(more info) I've spotted a strange message in the logs on my quite recent, fresh installation of OS X Mavericks 10.9.2 Apr 27 15:26:47 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf ...
0
votes
0answers
16 views

Heartbleed - impact on iOS apps? [duplicate]

Just heard about the heartbleed news over the internet for OpenSSL and wondering if it affects ios apps as well. My app uses openssl crypto library and thus the concern ! Any views in this regard ...
2
votes
2answers
2k views

Mount Iphone for Forensic Analysis or Take Forensic Image

How do I mount my iphone to look at it's files forensically? I have FTK Imager (the only free program I could find) but it doesnt mount it as a drive and I can't seem to take a forensic image of the ...