iOS is Apple's operating system for the iPhone, iPad and iPod Touch.

learn more… | top users | synonyms (1)

3
votes
1answer
775 views

Storing session key for iOS app

For an iOS app that communicates with a RESTful service over HTTPS, should the session key be stored in Keychain or NSUserDefaults? Username and password are stored in Keychain, and it would seem ...
3
votes
1answer
383 views

Loginless Client/Server Architecture (iOS)

I'm currently in the phase of planing a project involving loginless service. Users would be identified by an unique device id created on the client (ios). What are the security concerns? sockets ...
3
votes
3answers
301 views

Method to integrate Touch ID in iOS apps

With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
2
votes
3answers
3k views

Intercept data sent via bluetooth

I am trying to re-write a closed-source application, originally deployed on mobile devices, that lets you command and control a certain type of mechanical robots via bluetooth. The new application I ...
2
votes
2answers
130 views

Security through obscurity - “https requests” are safe?

In an iPhone app that utilizes plain text (unencrypted) XML as the contents of its http POST requests over https to the app server; how would someone be able to discover the "format" of the plain text ...
2
votes
3answers
142 views

Is possible to know if increased marketshare means more viruses?

I'm having an argument with other developers about why more "viruses" exist (including all forms of external attacks, exploits, etc) in Android vs iOS. Like with Windows vs *nix, the main idea is that ...
2
votes
1answer
272 views

Capturing iTunes traffic with Wireshark - SSL decryption question

I'm fooling around with Wireshark to capture the activation packets for an iPhone and some other stuff, however the traffic is encrypted. There should be a private SSL key somewhere on my computer to ...
2
votes
1answer
3k views

How does Activesync security policy affect the usage of the iOS fingerprint scanner?

An Activesync IT administrator has the ability to choose if the phone should require a password, and also how complex it should be. Since the fingerprint scanner appears to replace the traditional ...
2
votes
2answers
4k views

HTTPS verification failed - get certificate information iPad/iPhone

I went to log onto my bank's internet banking website this morning using Google Chrome browser on my iPad. I get the red error message of death. I can't figure out why. It's happening on both my ...
2
votes
2answers
2k views

Security analysis tools for iOS 6 [closed]

Searched over web, however could not find much info on security analysis tools for iOS6. Can somebody point me to the security analysis (Static Code Analysis & Pen Testing) tools for iOS6?
2
votes
2answers
330 views

What are the best practices for maintaining privacy on a non-jailbroken iOS device?

iOS, like most other mobile OSs, has the potential to leak significant chunks of personal information to 3rd-party apps and to ad and tracking networks used by those apps, which in turn also has the ...
2
votes
1answer
453 views

How secure are native iPhone - PUSH Services

The native app is sending the UDID to Provider Service for recieving PUSH Notification thru APNS. How is it possible to prevent tampered request(modified UDID) getting processed at Provider Service? ...
2
votes
1answer
149 views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
2
votes
2answers
916 views

Mount Iphone for Forensic Analysis or Take Forensic Image

How do I mount my iphone to look at it's files forensically? I have FTK Imager (the only free program I could find) but it doesnt mount it as a drive and I can't seem to take a forensic image of the ...
2
votes
1answer
2k views

How safe is the new iOS Keychain that stores credit card numbers?

iOS7 includes iCloud Keychain which syncs your stored passwords across devices. Not only that but it also syncs credit card numbers. The only information I can find about encryption is that they are ...
2
votes
1answer
2k views

Is there any way to list the contents of the iPhone/OSX Keychain and their security level?

I have a few apps that I purchased from the app store that probably store information in my keychain on OSX and on the iPhone. Since it's possible for keychain items to be bound to a device (and ...
2
votes
1answer
213 views

Any problems with UCC (multidomain) SSL certs on iOS and Windows Phones?

Are they any known issues with UCC (multidomain) SSL certs on iOS or Windows Phone? Let's say I want to have Exchange server under outlook.mycompany.com and RemoteApp Portal under ...
2
votes
1answer
522 views

Is XRY Forensic Tool able to extract data from iPhones?

As far as I know this only DOESN'T work with iPhone 4S and iPad2 / iPad 3, because of the fixed Boot Rom. So, is it no longer possible to brute-force the passcode lock? Can anybody confirm this with ...
2
votes
1answer
829 views

Which crypto-algorithem uses iOS in NSDataWritingFileProtection and what is the keysize?

I need to know the crypto algorithm and key strength of NSDataWritingFileProtection. I would like to know the same things for using the Keychain and NSFileManager. I searched the Apple Developer ...
2
votes
2answers
1k views

Guidelines for secure iPhone application development

Are there any security guidelines for development and assessment of (native) iPhone applications?
2
votes
2answers
230 views

Securing iPads and laptops in an enterprise

We have users in our organization who own iPads and we'd like to connect them to the network; however, if the users download and store sensitive data on the devices, that can pose a security issue. Is ...
2
votes
1answer
283 views

How to tell if Firefox Home (iOS) is using Data Protection API?

The source code is here: http://mxr.mozilla.org/services-central/source/fx-home/ What should I be looking/search for? Or even how to extract /ffhomeDB.sq3 and see what it contains.
2
votes
1answer
28 views

Code analyzer for Objective C? [on hold]

Has anyone come across a code analyzer that could be run on OS other than Mac to scan for Objective C (for iOS) code?
2
votes
1answer
104 views

Does using Chrome bypass the Apple iOS gotofail bug ?

Does the recent certificate gotofail bug affect me if I'm running version 6 of iOS, but only use Chrome as my browser?
2
votes
1answer
751 views

How to verify the signature in an iOS Passbook pass?

The Passbook application in the new iOS6 keeps track of movie tickets, coupons, and other 'passes' for you, and the passes themselves are loaded onto the user's device via file packages with the ...
2
votes
1answer
3k views

Kik | WhatsApp - Encrypted? iOS / Android Message encryption tips [closed]

Kik says that their client is using ssl etc. But it's kind of hard to tell if the messages is actually encrypted between the devices. What i can understand is that they don't got device-to-device ...
2
votes
1answer
342 views

Does iOS use built-in certificates to authenticate peers when using ipsec VPNs?

Suppose I am setting up an IPsec VPN for Apple iOS clients with the requirement that the iOS clients need to know that the server is legitimate and vice-versa. I create a root CA and issue a ...
2
votes
0answers
104 views

What unique device fingerprinting information can an iOS8 app collect?

As a follow-on to this question: What unique fingerprinting information can an iOS7 app collect? What remaining device fingerprinting privacy / security vulnerabilities still exist as of iOS 8? Can ...
2
votes
0answers
290 views

iCloud backup - which keys are transferred to Apple?

The iOS data protection implementation and the implementation of iTunes backups are both reasonably well documented, on a high level by by apple, and much more detailed by third parties. However, I'm ...
2
votes
2answers
2k views

Why is this SSL handshake failing with iPad? [closed]

I do have a tomcat server that listen on an SSL socket with TLS protocol. When connecting with all desktop browser everything work right. When connecting with Safari on iPad, the SSL handshake fails. ...
1
vote
3answers
625 views

How secure is iOS Touch ID?

I was wondering how secure Touch ID/Keychain is really. My understanding is that iPhone 5S devices that use Touch ID allow you to enter a passcode if your fingerprint doesn't work, as a "fallback". ...
1
vote
1answer
133 views

Obfuscation and Mobile App

Recently, I stumbled with this topic in my mind for few days. I understand that obfuscation is not the best protection against reverse engineering. I wonder if there is another method that make it ...
1
vote
1answer
85 views

Will ios8 encryption fail on forced shutdown?

I understand that IOS 8 data can be encrypted when the phone is locked, and decrypted for use when the phone is unlocked. But let's say the phone was unlocked (and thus the data is decrypted), and ...
1
vote
2answers
783 views

Securing JSON data

I am planning to use JSON as the data transport mechanism between my iOS app and my server (the server is a WCF service). While learning about JSON, I realized that all the data is passed around ...
1
vote
1answer
312 views

How is the iOS KeyChain master key derived?

I'm no expert but I'm assuming that on OSX it's derived from the user account password. I'm more than open to the possibility of that being incorrect. On iOS there is no user account password, only a ...
1
vote
3answers
1k views

Sending secure information from app with ssl

I'm a web developer, but I occasionally step over into doing some mobile app development here and there. A client recently asked me to help them develop a very simple app. The app is essentially just ...
1
vote
2answers
186 views

Protecting the remote database against tampering in a mobile app

This is the first time I face a mobile app deployment at big scale. This app needs to connect to a remote server where to store and retrieve data. I discarded connecting directly to the MySQL ...
1
vote
1answer
49 views

Securing iOS applications communication from client side

Many of you have heard about instagram flaw that facebook has not fixed yet, The flaw allows the attacker to hijack the session by sniffing the session cookie on Instagram iOS app since it does not ...
1
vote
1answer
94 views

Secure way of opening web page from iOS without need of logging in

I am developing an iOS application and web page, both use same Parse backend. Web page contains some functionality that is not available in the iOS application. Therefore I would like to present the ...
1
vote
1answer
211 views

What encryption does Apple use?

With their iOS devices, Apple allows people to block certain applications through "Restrictions". I recently had an issue with my iPhone where I'm positive that I entered the correct passcode on my ...
1
vote
1answer
87 views

Should a Mobile app able to check what password is locally saved via a user facing feature?

I'm working at a company who is currently working to secure their mobile app (iOS native) by adding check points to security sensitive screens on the device (data is stored in the iOS keychain). User ...
1
vote
1answer
316 views

What unique fingerprinting information can an iOS7 app collect?

I'm interested in unique information that is beyond typical user knowledge or control. As of iOS 7, users can easily protect local physical tracking by controlling radios (cell, WiFi, Bluetooth) in ...
1
vote
1answer
1k views

iOS: sandbox of an iphone app

I am new to iOS so I do have only limited knowledge about iOS in general. For self learning purposes, I would like to know several things as I am quite confused after searching the web. I do know ...
1
vote
1answer
311 views

Security: Oauth and Mobile apps

This is what I believe are the security implications of integrating Oauth using embedded webview vs browser in mobile application. Embedded Webview * Keep UI for mobile app Security implications ...
1
vote
1answer
469 views

Using Apple NSKeyedArchiver class without encryption to save score data locally

first of all I'm sorry for my bad English! I have a question about the security of NSKeyedArchiver, a subclass of NSCoder of Apple Foundation.framework ...
1
vote
1answer
71 views

Starting point for Mobile Device Security particularly in a MDM setting?

I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
1
vote
0answers
18 views

Force TLS on mobile app

i'm developing a mobile application for iOS and Android. On this app i'm asking resources on a secure server through ajax. Server's developers asked me to force the call in order that we use TLS ...
1
vote
0answers
37 views

FIPS Compliance with iOS app

Our company is working on getting FIPS validation for the iOS app and is in the initial phase. We have decided to use a private FIPS-certified libraries for using in the crypto modules. I have some ...
1
vote
2answers
1k views

Why do I need a certificate to pin an SSL connection with AF Networking 2?

I am using the AF Networking 2 library and read that I need to include the server's certificate here. The client should be able to tell that the certificate is valid when it connects to the server, ...
1
vote
0answers
106 views

HIPAA Compliant App, using Encypted Core Data vs Core Data Attribute Encyption

I am writing an iOS app which needs to be HIPAA compliant. The app should preferably function offline, so data needs to be stored on the phone. So here is what I was thinking of doing: On First ...