iOS is Apple's operating system for the iPhone, iPad and iPod Touch.

learn more… | top users | synonyms (1)

11
votes
3answers
1k views

Why can't apple simply add the backdoor now and then remove it after the FBI is done?

Summary of the current situation by @TTT Apple released an open letter to the public outlining their reasons for not complying with the FBI's demands to modify the iPhone's security mechanism. ...
0
votes
0answers
914 views

Is it possible to intercept ssl with burp on iOS 8.3

I have tried to intercept SSL connection on iOS 8.3 using BURP Proxy. I receive the error "There was a problem communicating with the secure web proxy server (HTTPS)." Is it because of some ...
1
vote
1answer
109 views

Could the FBI dump the drive contents of an iOS device, and then somehow run Virtual CPU's with different keys?

This seems like the most logical answer that would prevent wiping the data. Dump Contents of Drive. SetUp Virtual CPU with different keys. Use existing firmware and hardware for ios x Profit Is ...
158
votes
6answers
18k views

Apple's open letter - they can't or won't backdoor iOS?

Apple released an open letter to the public outlining their reasons for not complying with the FBI's demands to modify the iPhone's security mechanism. Here's a summary: The FBI has an iPhone in ...
1
vote
1answer
141 views

My iTunes account got hacked and someone used it to buy in-app purchase. How could that happen? [closed]

The account was hacked, I found out in my credit card statement and Apple support gave me refund which is nice. I wonder how it happened, and if there are even more serious risks that I don't know. ...
1
vote
1answer
106 views

Is there any way or tool to check whether a particular iOS app is implementing SSL Pinning functionality?

I'm just learning the iOS security. This is completely a beginner question. I'm trying to figure out whether there is any particular way to check if an iOS app is implementing SSL Pinning ...
2
votes
1answer
64 views

Is it completely safe to store the unencrypted credentials within a variable in the ios device

Overview is we encrypt the credentials using the pincode as the passphrase that the user also sets. One of the requirements is to NEVER SAVE THE PINCODE anytime anywhere. Everytime the user goes out ...
3
votes
1answer
987 views

What can an iOS app tell about you?

We all know while using a new iOS app it might ask for information like location or access to the camera. Those are both features we can deny to the app. There are, however, features apps can access ...
0
votes
0answers
28 views

SpriteKit Level Data Security Handling

I have been reading many different posts, threads, etc. regarding the best practices to store level data to be used throughout a game application (level boundary data, images, characters, time, etc.). ...
1
vote
1answer
46 views

Can I use a TLS certificate (first generated for a Windows Server) on a Linux Server?

I don't have any experience on this kind of things, so please bear with me. And I apologise if this has been asked before, but I couldn't find it in this site. My situation: I have a Windows ...
6
votes
2answers
146 views

Why should you clear your pasteboard when exiting your app?

I've been scanning an iOS application of mine and the highest risk vulnerability appears to be that the pasteboard is not getting cleared when I terminate the application. I don't want the user to ...
6
votes
1answer
78 views

Why isn't there a FROST-like cold boot exploit for iOS?

I know there's a cold boot attack for Android called FROST (Forensic Recovery Of Scrambled Phones). But there doesn't seem to be one for iOs. Why is this? Is it because iOS is inherently more ...
1
vote
0answers
37 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
3
votes
2answers
195 views

Can I store a pair of keys on iOS secure element?

I would like to know if I can use the iPhone's secure element to store a pair of keys. I need to store them in the safest emplacement, and I can't think of a better one than the secure element.
4
votes
0answers
89 views

How to encrypt data using the iOS secure element?

I would like to know if there's a way to encrypt/decrypt data using the iOS secure element chip (Java card). Or does the keychain already use it?
0
votes
0answers
105 views

iSniff-GPS: Certificate Verification

iSniff-GPS I came across an interesting sounding project on GitHub, called iSniff-GPS. I decided to check it out, but i experienced some issues when trying to use the web interface. Instructions ...
1
vote
0answers
106 views

Sensitive Information Disclosure via plist on iOS, does this affect security at all?

The security team has found sensitive information which is disclosed in info.plist, API keys were also exposed. Fabric is being used and Fabric API key is the way to authenticate the users or their ...
2
votes
1answer
109 views

Securing APIs from Rogue/Fake iOS or Android apps?

How do you protect a non-public web API from a malicious app where a developer has discovered how to perform some requests? Take Instagram's app as an example: Instagram does not have a public API ...
0
votes
1answer
111 views

Can an iOS/android app encrypt data without the user entering a password?

I found an iOS app that claims to save all user data only encrypted. But the app never asks me for a password. Is it even possible that the app encrypts the data in a useful way? I do need see what ...
3
votes
2answers
80 views

How protect mobile website against encapsulating into rogue native mobile app?

We are developping a mobile application (m.website.com). Is there a way to prevent a rogue developper to build an IOS / Android native app that simply encapsulate our website into the app using ...
6
votes
1answer
2k views

iOS Mail App Security

I have my own domain name and I had some issues with the delivery time. So, I started looking at the mail header to see where my mail was stuck and why. That is not the issue.. While messing around ...
0
votes
0answers
62 views

iOS Real Money Game Security [duplicate]

I am developing an iOS game that will be played with real money. The problem that I am facing is the security behind the game. First of all, the game is client-side. When the player buys into a game, ...
1
vote
4answers
545 views

iPad infected with virus (popup - admobinew.com)

This morning I was reading some news on some websites (I think one of them was haaretz.com) using my iPad (ios 9.0.1), I clicked on a news and I was redirected to some dodgy website and I started ...
2
votes
2answers
131 views

Data security implications of using Android over iOS [closed]

What are the security implications of using Android as opposed to iOS? Many sources say Android is much less secure and much less capable of handing a user's data in a secure manner. What are the main ...
2
votes
1answer
269 views

iOS encryption and performance

iOS file encryption deploys many layers of encryption; There is the AES-256 accelerator encrypting general flash memory with the per-file-, UID-, and GID keys. There is Data Protection on the software ...
2
votes
0answers
122 views

Installing a cocoapod and 'github' asks for login credentials?

I just added a cocoapod and got this >ls Podfile superApp Podfile.lock superApp.xcodeproj Pods superApp.xcworkspace >pod install Updating local specs ...
3
votes
1answer
130 views

Is it ok from the viewpoint of PCI DSS to send credit card info to my own server which then directly sends it to PayPal?

Currently I'm developing an iOS application which has an option to pay an order (clothes cleaning) via scanning credit card info using device camera. I can't use Apple In-App Purchases (IAP) for this, ...
6
votes
1answer
126 views

What tools are needed to view or detect covert messages in a 60 fps video?

The eye can't detect changes in a frame greater than 60 FPS. Similar to this scene in Fight Club, a QR code equivalent is used in pairing the Apple Watch with the iPhone Without knowing that the ...
2
votes
1answer
74 views

Yovo screenshot blocker vulnerability [closed]

I was studying Yovo's screenshot blocker and I noticed that when watching their demo, I was easily able to pause the video when the screenshot blocker was taking effect and get a fairly clear view of ...
0
votes
3answers
2k views

What footprint iOS or Android App leaves? and how to change it

I've read some place that each phone and/or sim leaves some kind of footprints when it uses a social app (Google, Instagram etc.). I would like to stay anonymous or at least blend in with the crowd. ...
2
votes
0answers
75 views

Google/Apple account for corporate issued mobile phones

We are working on implementing MDM (Airwatch) for all corporate mobile devices (no BYOD will be allowed). But I have a question as what is the best way to avoid users use their personal Gmail or ...
2
votes
1answer
282 views

Bruteforcing an iOS PIN

The iOS Security document describes several security mechanisms implemented in iOS 9. I am specifically interested in the actual security of a 4 digits PIN on iOS. I am looking for tangible ...
3
votes
0answers
389 views

Security flaw in iOS, Safari weird behavior or what else?

some months ago I was travelling and flew from Frankfurt airport and, while there, I probably connected to some Telekom.de free hotspot. I have an iPhone 6 with iOS 9.02 (at that time it was 8.1.x). ...
2
votes
2answers
97 views

xcodeghost infection in a byod device

We detected network traffic from a device infected with xcodeghost trying to reach a known bot command and control address. Obviously, we removed the device from the network. The user removed two ...
2
votes
0answers
113 views

HTML Injection on iOS?

I had an uncommon issue with both Safari and Chrome on an iPhone 6 running iOS 9.0.1 last night - a number of sites were displayed with altered links and/or additional links (clearly from a third-...
2
votes
2answers
4k views

Can an employer see cellular network traffic routed through company-owned device?

When on the road, I have a company issued iPad with Verizon service, my personal ipad (wifi only version), and my iPhone. If I turn on the hotspot on my company iPad, then connect my personal ...
0
votes
0answers
165 views

Any recent IOS Monitor Mode Projects?

There was a project back for IOS 5 that created a sudo-moniter mode using tcpdump, python, and libpcap. It does require a jailbreak. It is located here: Ios Monitor Mode Are there any projects for ...
4
votes
2answers
442 views

What data is not encrypted in iOS 8+ when “locked”

Scenario: iPhone 5+ with iOS 8+ with system encryption enabled. The phone is on and locked. (the user has authenticated (unlocked phone) at least once since power-up, and then relocked). What data/...
3
votes
2answers
1k views

Mitigating SSL bypassing on iOS

I am trying to mitigate SSL bypassing on a jailbroken iOS. I am unable to find any good work around as Mobile Substrate and SSL kill switch are able to bypass SSL. I have tried two things: SSL ...
3
votes
1answer
503 views

How critical is App Transport Security?

As we've probably all heard, App Transport Security in iOS 9 requires: TLS 1.2 or better Forward secrecy ciphers SHA256 or better with >= 2048-bit RSA or >= 256-bit ECC key Google and Facebook ...
2
votes
2answers
563 views

How to intercepting iOS HTTPS traffic

How can I intercept & parse through the SSL traffic (incoming & outgoing) generated by my iPad application?
4
votes
1answer
1k views

iOS application pentest without jailbreak

Is it possible to run a security assessment on an iOS application using a non-jailbroken device? My device was recently restored (recovered - no SHSH blobs) to iOS 8.4.1 (as Apple doesn't like ...
0
votes
0answers
67 views

How can I protect a mobile application from LogJam?

I develop a two-factor authentication app on iOS and Android and I recently noticed that they run perfectly fine against a local dev server that is vulnerable to LogJam. Is there any way to secure ...
2
votes
1answer
48 views

Is it secure to have an iPad app run a webDAV server on localhost without authentication?

I have two iPad apps running on the same device. One is hosting a webDAV server on http://localhost:8080 without any authentication (the server is active whilst the app is foregrounded, and for a few ...
4
votes
3answers
492 views

How is “Touch Jacking” prevented on iOS, Android, and Win 10 - touch?

I'm looking at the security of both iOS and Android from a Touch-jacking security perspective. In other words, I expect that an application can be in a secure state to ensure that no overlays, screen ...
4
votes
1answer
124 views

Are “Security SMS codes” any safer than plain SMS?

Many banking webapps send this kind of SMS, for their 2FA systems. These messages do not appear in the main "Messages" app, seemingly being destroyed after viewing - at least on iOS. Firstly, are ...
1
vote
0answers
334 views

What are the best ways for an iOS 9 user to protect against device fingerprinting?

In response to this series of questions: What unique device fingerprinting information can an iOS9 app collect? and as an update to this question: What are the best practices for maintaining privacy ...
4
votes
0answers
205 views

What unique device fingerprinting information can an iOS9 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? Apple has apparently ...
3
votes
3answers
977 views

Proper implementation of HIPAA within iOS app with several factors

We are developing an iOS app that allows users to store/modify Protected Health Information (PHI) and the app needs to allow users to do so without an internet connection for large parts of the ...
5
votes
1answer
917 views

Would the Stagefright vulnerability existing in Android be able to run on other phones?

I saw a question about Android's "Stagefright" vulnerability, and I got to thinking: other OS'es pre-process MMS messages to make it easier to view. iOS does it and shows a preview. Even BREW OS (the ...