iOS is Apple's operating system for the iPhone, iPad and iPod Touch.

learn more… | top users | synonyms (1)

1
vote
1answer
108 views

What security practices should I keep in mind during development? [closed]

I am beginning to develop apps for Android and iOS that make API calls to a PHP web application that I will be developing. Users will be required to sign up with a username, password, and (optional) ...
3
votes
1answer
149 views

Would the Stagefright vulnerability existing in Android be able to run on other phones?

I saw a question about Android's "Stagefright" vulnerability, and I got to thinking: other OS'es pre-process MMS messages to make it easier to view. iOS does it and shows a preview. Even BREW OS (the ...
3
votes
4answers
977 views

Are kiosk-style, full screen apps possible on iOS, Android, or Windows phone?

A popular car insurance company in the US has an app that displays "digital car insurance" papers. In the commercials, these apps are opened, and the user gives the unlocked phone to police officers. ...
0
votes
1answer
48 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
3
votes
1answer
137 views

iOS Unicode Notification Bug

Evidently, someone has discovered a Unicode bug in iOS, where if an app receives a specific Unicode sequence (infinitely-repeating Unicode code point), the OS will kill the Springboard as it allocates ...
3
votes
2answers
78 views

Can you use ssh for secure inter app communication on the same device?

I use ssh to get an encrypted connection between servers and local machines all the time. It's fast, it's secure, and there's a way to do it in nearly every system programming language that I've used ...
0
votes
1answer
74 views

I need to transfer user's private key (RSA) to my App. Is file sharing a good solution?

I've asked a similar question here earlier iOS: Is it ok to store a RSA private key (use to decrypt text) in your application document directory? However, the person recommend me to use keychain ...
-1
votes
1answer
35 views

User account password hashing [duplicate]

We are developing a mobile app that includes a user account system. Currently, we have a system password flow like this: User enters password -> SHA-256 HMAC hash with key -> server -> SHA-256 ...
1
vote
1answer
56 views

Web services API key

I have a PHP server with some .php files. Swift iOS application send POST request to server and get some response in JSON. PHP files on server do some work with MSQL. The question is: How to provide ...
4
votes
2answers
65 views

Does changing my password after OAuth login in mobile app help reduce risk?

When you use a mobile app that needs Google OAuth login, you can't fully trust the third party app because you can't tell what url the webview is using. Who knows if they aren't storing my login and ...
3
votes
2answers
321 views

IPhone iOS 8.3 encryption security against physical access

Excerpt from Apple's Whitepaper "iOS Security" on Effaceable Storage: A dedicated area of NAND storage, used to store cryptographic keys, that can be addressed directly and wiped securely. ...
6
votes
2answers
207 views

Are SIM proactive commands secure?

A SIM card can initiate some communication with a mobile device with so called "proactive commands" (chapter 6 of http://www.etsi.org/deliver/etsi_gts/11/1114/05.04.00_60/gsmts_1114v050400p.pdf). ...
1
vote
0answers
37 views

common crypto and bouncy castle, PBKDF2 generation

I am working on an iOS app and android app, for iOS I am using common crypto, and for android bouncy castle. I noticed that in android when I generate PBKDF2, if I use a salt or pass ...
1
vote
0answers
62 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
2
votes
2answers
405 views

How is it possible that a text message can reboot an Apple device?

I was reading through my infosec newsfeed and found this article: http://www.theguardian.com/technology/2015/may/27/iphone-crash-bug-text-imessage-ios It basically talks about a bug iOS has while ...
1
vote
1answer
144 views

Secure socket communication between iOS device and 3rd party server

I'd like your advice on what is the best approach for the challenge in my hands... I'm developing an extension to a 3rd party software. I'm doing my development using Python/Twisted/Autobahn. The end ...
7
votes
4answers
716 views

Method to integrate Touch ID in iOS apps

With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
1
vote
3answers
225 views

What security mechanisms are in place for iOS' custom keyboards?

Apple has just announced iOS 8. The new version appears to be more extensible than previous versions, and one of the new possiblities is to allow developers to develop custom keyboards, different than ...
2
votes
2answers
2k views

Securing JSON data

I am planning to use JSON as the data transport mechanism between my iOS app and my server (the server is a WCF service). While learning about JSON, I realized that all the data is passed around ...
6
votes
1answer
92 views

Does iPhone home button act as Secure Attention Key?

On an iPhone, does pressing the home button act as a Secure Attention Sequence? The home button is a physical button. You can press the home button whereever you are and go back to the home screen. ...
1
vote
1answer
504 views

Share and store RSA - public key in java server and vice versa

My requirements are: Requirement 1: Share public key to java server. Steps: Generate public-private keys in iOS app. Store the generated keys in keychain. Send generated public key to java server. ...
2
votes
2answers
1k views

Guidelines for secure iPhone application development

Are there any security guidelines for development and assessment of (native) iPhone applications?
1
vote
1answer
73 views

iOS permissions for 3rd party app developers [closed]

I am putting together a summary on iOS and Android security risks based on app permissions. On Android, it is easy to define all of the permissions and what 3rd party developers have access to (from ...
1
vote
1answer
79 views

Private messages for an ios app - how secure is this system?

I'm designing architecture for sending private messages (i.e. only sender and receiver are able to read a message). Client side - iOS, server side - Parse.com I'm thinking of using RSA to ...
3
votes
1answer
91 views

Why do mobile operating systems not implement a way to deny permissions to an app?

Android and iOS (afaik) implement a relativly fine-grained permission schema for their apps. But as I user I only have the change to acceppt all or nothing. When I think about it, it shouldn't be a ...
2
votes
0answers
209 views

What unique device fingerprinting information can an iOS8 app collect?

As a follow-on to this question: What unique fingerprinting information can an iOS7 app collect? What remaining device fingerprinting privacy / security vulnerabilities still exist as of iOS 8? Can ...
3
votes
3answers
393 views

What are the best practices for maintaining privacy on a non-jailbroken iOS device?

iOS, like most other mobile OSs, has the potential to leak significant chunks of personal information to 3rd-party apps and to ad and tracking networks used by those apps, which in turn also has the ...
2
votes
4answers
743 views

Can visiting a malicious website infect an iOS or Android device?

Can visiting a malicious website infect an iOS or Android device? We're talking about visiting such sites via a browser. We're not talking about downloading any malicious apps. Thanks!
4
votes
2answers
337 views

Is Google API Key a sensitive information that needs to be protected?

I'm making use of google API for location (in Android, iOS apps).. Can the key be hardcoded? Or should it be protected? If It's sensitive, why is it sensitive and how can attackers exploit this?
0
votes
0answers
32 views

Does sending a token back with a different channel (iOS Push Notification) improve security?

So I have this customer who has a project which is "very sensitive". It's a Jabber client which will connect to their servers to allow users to communicate. Here's what he requires for the ...
6
votes
3answers
4k views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
3
votes
1answer
97 views

iOS VPN profiles - are the signing certificates global? Can this be a MITM exploit?

I have installed an app on iOS to connect to a well-known VPN service. The app requests installation of a profile onto iOS, which as far as I can see are a collection of 7 certificates - 5 of which ...
2
votes
3answers
452 views

Security of email sent/received on iPhone via Mail app

In regards to the default Mail app on iOS 8, setup with various mail accounts gmail, outlook etc. Are emails sent/received to/from the phone securely, if so, how? Can someone who is snooping on the ...
0
votes
1answer
217 views

Iphone app not allowing proxy

Hi everyone I am interested in how a banking app works, especially the way it handles https requests. So I installed one, set my proxy settings, started burp suite and expected it to work. As you may ...
0
votes
2answers
109 views

how to encrypt a sensitive model on android and ios

I am writing a mobile app which uses a statistical model contained in binary files. I want to be able to distribute the app freely, but I don't want anyone to be able to use my model files, even on a ...
1
vote
0answers
117 views

Force TLS on mobile app

i'm developing a mobile application for iOS and Android. On this app i'm asking resources on a secure server through ajax. Server's developers asked me to force the call in order that we use TLS ...
2
votes
1answer
82 views

Code analyzer for Objective C? [closed]

Has anyone come across a code analyzer that could be run on OS other than Mac to scan for Objective C (for iOS) code?
12
votes
1answer
948 views

When does iOS check validity of enterprise certificates?

Here is an article that should give a little more context (and see my comment on it, same username, for additional info). iOS developers are able to distribute apps outside of the App Store using an ...
0
votes
1answer
545 views

What tools are available for iOS vulnerability assessment and penetration testing [closed]

I want to start learning about VA on Apple iOS devices. Besides documentation, is there any good tool - in terms of automated vulnerability scanners, or scripts - to start?
8
votes
2answers
5k views

Android L encryption vs. iOS 8 encryption

Recently, the new full-disk encryption system of Apple's iOS 8 operating system has been in the news. And soon after Apple's release, Google announced that they will also enable encryption by default ...
1
vote
0answers
117 views

FIPS Compliance with iOS app

Our company is working on getting FIPS validation for the iOS app and is in the initial phase. We have decided to use a private FIPS-certified libraries for using in the crypto modules. I have some ...
1
vote
1answer
136 views

Will ios8 encryption fail on forced shutdown?

I understand that IOS 8 data can be encrypted when the phone is locked, and decrypted for use when the phone is unlocked. But let's say the phone was unlocked (and thus the data is decrypted), and ...
6
votes
3answers
2k views

Accessing iPhone data without passcode - how difficult?

I use iOS7 with a 4-digit passcode that isn't on any top 10 lists. I have "Erase all data after 10 failed passcode attempts" turned on. How hard would it be for someone who stole my phone to get ...
3
votes
2answers
168 views

Security through obscurity - “https requests” are safe?

In an iPhone app that utilizes plain text (unencrypted) XML as the contents of its http POST requests over https to the app server; how would someone be able to discover the "format" of the plain text ...
0
votes
0answers
39 views

Do iOS applications have access to the certificates installed?

As the title says, I'm curious if a generic iOS application can access/retrieve the certificates installed in the device (e.g., via a management profile) Thanks
4
votes
2answers
435 views

Encrypt with private and decrypt with public

Above picture is captured from iOS Security overview at page 25. The path encrypt with public and decrypt with private makes sense. But the other path, encrypt with private and decrypt with public ...
3
votes
2answers
369 views

Detection of function hooking in iOS

So far as I know, in iOS there are three techniques of function hooking: preload library using DYLD_INSERT_LIBRARIES imported symbol table redirection using fishhook patch the functions when they ...
1
vote
1answer
97 views

Securing iOS applications communication from client side

Many of you have heard about instagram flaw that facebook has not fixed yet, The flaw allows the attacker to hijack the session by sniffing the session cookie on Instagram iOS app since it does not ...
1
vote
3answers
1k views

How secure is iOS Touch ID?

I was wondering how secure Touch ID/Keychain is really. My understanding is that iPhone 5S devices that use Touch ID allow you to enter a passcode if your fingerprint doesn't work, as a "fallback". ...
5
votes
3answers
2k views

Proof of SIM card possession on iOS devices

I need to proof that a user of my app is in possession of the correct SIM card. On android devices, this is possible by simply sending a challenge within an SMS to the corresponding number (the proof ...