iOS is Apple's operating system for the iPhone, iPad and iPod Touch.

learn more… | top users | synonyms (1)

2
votes
0answers
97 views

Installing a cocoapod and 'github' asks for login credentials?

I just added a cocoapod and got this >ls Podfile superApp Podfile.lock superApp.xcodeproj Pods superApp.xcworkspace >pod install Updating local specs ...
3
votes
1answer
94 views

Is it ok from the viewpoint of PCI DSS to send credit card info to my own server which then directly sends it to PayPal?

Currently I'm developing an iOS application which has an option to pay an order (clothes cleaning) via scanning credit card info using device camera. I can't use Apple In-App Purchases (IAP) for this, ...
6
votes
1answer
124 views

What tools are needed to view or detect covert messages in a 60 fps video?

The eye can't detect changes in a frame greater than 60 FPS. Similar to this scene in Fight Club, a QR code equivalent is used in pairing the Apple Watch with the iPhone Without knowing that the ...
2
votes
1answer
68 views

Yovo screenshot blocker vulnerability [closed]

I was studying Yovo's screenshot blocker and I noticed that when watching their demo, I was easily able to pause the video when the screenshot blocker was taking effect and get a fairly clear view of ...
0
votes
3answers
1k views

What footprint iOS or Android App leaves? and how to change it

I've read some place that each phone and/or sim leaves some kind of footprints when it uses a social app (Google, Instagram etc.). I would like to stay anonymous or at least blend in with the crowd. ...
2
votes
0answers
69 views

Google/Apple account for corporate issued mobile phones

We are working on implementing MDM (Airwatch) for all corporate mobile devices (no BYOD will be allowed). But I have a question as what is the best way to avoid users use their personal Gmail or ...
2
votes
1answer
199 views

Bruteforcing an iOS PIN

The iOS Security document describes several security mechanisms implemented in iOS 9. I am specifically interested in the actual security of a 4 digits PIN on iOS. I am looking for tangible ...
1
vote
0answers
298 views

Security flaw in iOS, Safari weird behavior or what else?

some months ago I was travelling and flew from Frankfurt airport and, while there, I probably connected to some Telekom.de free hotspot. I have an iPhone 6 with iOS 9.02 (at that time it was 8.1.x). ...
2
votes
2answers
93 views

xcodeghost infection in a byod device

We detected network traffic from a device infected with xcodeghost trying to reach a known bot command and control address. Obviously, we removed the device from the network. The user removed two ...
2
votes
0answers
104 views

HTML Injection on iOS?

I had an uncommon issue with both Safari and Chrome on an iPhone 6 running iOS 9.0.1 last night - a number of sites were displayed with altered links and/or additional links (clearly from a ...
2
votes
2answers
2k views

Can an employer see cellular network traffic routed through company-owned device?

When on the road, I have a company issued iPad with Verizon service, my personal ipad (wifi only version), and my iPhone. If I turn on the hotspot on my company iPad, then connect my personal ...
0
votes
0answers
117 views

Any recent IOS Monitor Mode Projects?

There was a project back for IOS 5 that created a sudo-moniter mode using tcpdump, python, and libpcap. It does require a jailbreak. It is located here: Ios Monitor Mode Are there any projects for ...
4
votes
2answers
348 views

What data is not encrypted in iOS 8+ when “locked”

Scenario: iPhone 5+ with iOS 8+ with system encryption enabled. The phone is on and locked. (the user has authenticated (unlocked phone) at least once since power-up, and then relocked). What ...
3
votes
2answers
1k views

Mitigating SSL bypassing on iOS

I am trying to mitigate SSL bypassing on a jailbroken iOS. I am unable to find any good work around as Mobile Substrate and SSL kill switch are able to bypass SSL. I have tried two things: SSL ...
3
votes
1answer
449 views

How critical is App Transport Security?

As we've probably all heard, App Transport Security in iOS 9 requires: TLS 1.2 or better Forward secrecy ciphers SHA256 or better with >= 2048-bit RSA or >= 256-bit ECC key Google and Facebook ...
2
votes
2answers
394 views

How to intercepting iOS HTTPS traffic

How can I intercept & parse through the SSL traffic (incoming & outgoing) generated by my iPad application?
3
votes
1answer
760 views

iOS application pentest without jailbreak

Is it possible to run a security assessment on an iOS application using a non-jailbroken device? My device was recently restored (recovered - no SHSH blobs) to iOS 8.4.1 (as Apple doesn't like ...
0
votes
0answers
66 views

How can I protect a mobile application from LogJam?

I develop a two-factor authentication app on iOS and Android and I recently noticed that they run perfectly fine against a local dev server that is vulnerable to LogJam. Is there any way to secure ...
1
vote
1answer
33 views

Is it secure to have an iPad app run a webDAV server on localhost without authentication?

I have two iPad apps running on the same device. One is hosting a webDAV server on http://localhost:8080 without any authentication (the server is active whilst the app is foregrounded, and for a few ...
4
votes
3answers
401 views

How is “Touch Jacking” prevented on iOS, Android, and Win 10 - touch?

I'm looking at the security of both iOS and Android from a Touch-jacking security perspective. In other words, I expect that an application can be in a secure state to ensure that no overlays, screen ...
4
votes
1answer
120 views

Are “Security SMS codes” any safer than plain SMS?

Many banking webapps send this kind of SMS, for their 2FA systems. These messages do not appear in the main "Messages" app, seemingly being destroyed after viewing - at least on iOS. Firstly, are ...
1
vote
0answers
282 views

What are the best ways for an iOS 9 user to protect against device fingerprinting?

In response to this series of questions: What unique device fingerprinting information can an iOS9 app collect? and as an update to this question: What are the best practices for maintaining privacy ...
1
vote
0answers
158 views

What unique device fingerprinting information can an iOS9 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? Apple has apparently ...
3
votes
3answers
716 views

Proper implementation of HIPAA within iOS app with several factors

We are developing an iOS app that allows users to store/modify Protected Health Information (PHI) and the app needs to allow users to do so without an internet connection for large parts of the ...
5
votes
1answer
804 views

Would the Stagefright vulnerability existing in Android be able to run on other phones?

I saw a question about Android's "Stagefright" vulnerability, and I got to thinking: other OS'es pre-process MMS messages to make it easier to view. iOS does it and shows a preview. Even BREW OS (the ...
1
vote
1answer
160 views

What security practices should I keep in mind during development? [closed]

I am beginning to develop apps for Android and iOS that make API calls to a PHP web application that I will be developing. Users will be required to sign up with a username, password, and (optional) ...
0
votes
1answer
174 views

I need to transfer user's private key (RSA) to my App. Is file sharing a good solution?

I've asked a similar question here earlier iOS: Is it ok to store a RSA private key (use to decrypt text) in your application document directory? However, the person recommend me to use keychain ...
-1
votes
1answer
79 views

User account password hashing [duplicate]

We are developing a mobile app that includes a user account system. Currently, we have a system password flow like this: User enters password -> SHA-256 HMAC hash with key -> server -> SHA-256 ...
2
votes
1answer
209 views

Web services API key

I have a PHP server with some .php files. Swift iOS application send POST request to server and get some response in JSON. PHP files on server do some work with MSQL. The question is: How to provide ...
3
votes
2answers
146 views

Can you use ssh for secure inter app communication on the same device?

I use ssh to get an encrypted connection between servers and local machines all the time. It's fast, it's secure, and there's a way to do it in nearly every system programming language that I've used ...
2
votes
0answers
140 views

common crypto and bouncy castle, PBKDF2 generation

I am working on an iOS app and android app, for iOS I am using common crypto, and for android bouncy castle. I noticed that in android when I generate PBKDF2, if I use a salt or pass ...
3
votes
2answers
1k views

IPhone iOS 8.3 encryption security against physical access

NB: While you are free to answer this question, there is a more specific discussion here Excerpt from Apple's Whitepaper "iOS Security" on Effaceable Storage: A dedicated area of NAND storage, ...
6
votes
2answers
388 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
2
votes
2answers
195 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
3
votes
2answers
203 views

iOS Unicode Notification Bug

Evidently, someone has discovered a Unicode bug in iOS, where if an app receives a specific Unicode sequence (infinitely-repeating Unicode code point), the OS will kill the Springboard as it allocates ...
2
votes
2answers
522 views

How is it possible that a text message can reboot an Apple device?

I was reading through my infosec newsfeed and found this article: http://www.theguardian.com/technology/2015/may/27/iphone-crash-bug-text-imessage-ios It basically talks about a bug iOS has while ...
1
vote
1answer
530 views

Secure socket communication between iOS device and 3rd party server

I'd like your advice on what is the best approach for the challenge in my hands... I'm developing an extension to a 3rd party software. I'm doing my development using Python/Twisted/Autobahn. The end ...
6
votes
1answer
120 views

Does iPhone home button act as Secure Attention Key?

On an iPhone, does pressing the home button act as a Secure Attention Sequence? The home button is a physical button. You can press the home button whereever you are and go back to the home screen. ...
1
vote
1answer
188 views

iOS permissions for 3rd party app developers [closed]

I am putting together a summary on iOS and Android security risks based on app permissions. On Android, it is easy to define all of the permissions and what 3rd party developers have access to (from ...
6
votes
2answers
505 views

Are SIM proactive commands secure?

A SIM card can initiate some communication with a mobile device with so called "proactive commands" (chapter 6 of http://www.etsi.org/deliver/etsi_gts/11/1114/05.04.00_60/gsmts_1114v050400p.pdf). ...
1
vote
1answer
162 views

Private messages for an ios app - how secure is this system?

I'm designing architecture for sending private messages (i.e. only sender and receiver are able to read a message). Client side - iOS, server side - Parse.com I'm thinking of using RSA to ...
3
votes
1answer
146 views

Why do mobile operating systems not implement a way to deny permissions to an app?

Android and iOS (afaik) implement a relativly fine-grained permission schema for their apps. But as I user I only have the change to acceppt all or nothing. When I think about it, it shouldn't be a ...
3
votes
1answer
143 views

iOS VPN profiles - are the signing certificates global? Can this be a MITM exploit?

I have installed an app on iOS to connect to a well-known VPN service. The app requests installation of a profile onto iOS, which as far as I can see are a collection of 7 certificates - 5 of which ...
4
votes
2answers
106 views

Does changing my password after OAuth login in mobile app help reduce risk?

When you use a mobile app that needs Google OAuth login, you can't fully trust the third party app because you can't tell what url the webview is using. Who knows if they aren't storing my login and ...
2
votes
3answers
1k views

Security of email sent/received on iPhone via Mail app

In regards to the default Mail app on iOS 8, setup with various mail accounts gmail, outlook etc. Are emails sent/received to/from the phone securely, if so, how? Can someone who is snooping on the ...
3
votes
4answers
2k views

Can visiting a malicious website infect an iOS or Android device?

Can visiting a malicious website infect an iOS or Android device? We're talking about visiting such sites via a browser. We're not talking about downloading any malicious apps. Thanks!
0
votes
2answers
118 views

how to encrypt a sensitive model on android and ios

I am writing a mobile app which uses a statistical model contained in binary files. I want to be able to distribute the app freely, but I don't want anyone to be able to use my model files, even on a ...
1
vote
0answers
168 views

Force TLS on mobile app

i'm developing a mobile application for iOS and Android. On this app i'm asking resources on a secure server through ajax. Server's developers asked me to force the call in order that we use TLS ...
2
votes
1answer
149 views

Code analyzer for Objective C? [closed]

Has anyone come across a code analyzer that could be run on OS other than Mac to scan for Objective C (for iOS) code?
0
votes
1answer
415 views

Iphone app not allowing proxy

Hi everyone I am interested in how a banking app works, especially the way it handles https requests. So I installed one, set my proxy settings, started burp suite and expected it to work. As you may ...