iOS is Apple's operating system for the iPhone, iPad and iPod Touch.

learn more… | top users | synonyms (1)

5
votes
1answer
7k views

How safe is the new iOS Keychain that stores credit card numbers?

iOS7 includes iCloud Keychain which syncs your stored passwords across devices. Not only that but it also syncs credit card numbers. The only information I can find about encryption is that they are ...
5
votes
2answers
524 views

Detection of function hooking in iOS

So far as I know, in iOS there are three techniques of function hooking: preload library using DYLD_INSERT_LIBRARIES imported symbol table redirection using fishhook patch the functions when they ...
5
votes
1answer
755 views

What iOS apps use data protection?

The iOS data protection API and its implementation are fairly well documented, but it is only really useful if apps actually use some level other than NSFileProtectionNone for their files. Is there ...
5
votes
1answer
684 views

What unique fingerprinting information can an iOS7 app collect?

I'm interested in unique information that is beyond typical user knowledge or control. As of iOS 7, users can easily protect local physical tracking by controlling radios (cell, WiFi, Bluetooth) in ...
5
votes
1answer
6k views

Can an iOS 7 app access either device camera without user knowledge?

This statement in the iOS 7 release notes implies that non-China devices do not need user consent: iOS now requests user consent for apps to use audio input on all iOS 7 devices. For devices ...
5
votes
1answer
1k views

Distributing API Keys to Mobile Apps

I'm currently developing a mobile app (iOS based initially) that consumes multiple APIs. Currently we're storing API keys as strings in the the prefix header file, and initializing most of the APIs ...
5
votes
3answers
2k views

Proof of SIM card possession on iOS devices

I need to proof that a user of my app is in possession of the correct SIM card. On android devices, this is possible by simply sending a challenge within an SMS to the corresponding number (the proof ...
4
votes
2answers
4k views

How to supply OpenSSL generated Private & Public Keys to iOS & Android apps?

The problem statement is: To supply clients on a network with individual Private & Public keys generated on a Server over the wire(over a HTTPS connection after they are registered). The clients ...
4
votes
2answers
937 views

How secure is the private storage of a mobile app

Are there any know security flaws/hacks to gain access to the private storage(file system or SQLite database) of Android and iOS applications? What measures do Google and Apple take to "prevent" ...
4
votes
2answers
374 views

What data is not encrypted in iOS 8+ when “locked”

Scenario: iPhone 5+ with iOS 8+ with system encryption enabled. The phone is on and locked. (the user has authenticated (unlocked phone) at least once since power-up, and then relocked). What ...
4
votes
1answer
393 views

Data remanence on mobile devices

The methods in which data should be deleted is strictly enforced by the DoD as well as others security sensitive organizations. However, there are complications with deleting data on an SSD. Given ...
4
votes
3answers
452 views

What are the best practices for maintaining privacy on a non-jailbroken iOS device?

iOS, like most other mobile OSs, has the potential to leak significant chunks of personal information to 3rd-party apps and to ad and tracking networks used by those apps, which in turn also has the ...
4
votes
2answers
79 views

Is there a security benefit in knowing if my iPhone is jailbroken?

There is an app for the iPhone supposedly detects if your smartphone has a jailbreak installed. Is there a security benefit in knowing whether your phone has a jailbreak or not?
4
votes
2answers
1k views

On iOS, what's the benefit of OpenSSL over using CFStream, CFNetwork etc. for secure sockets?

I asked this already on Stack Overflow, here. I was told I might find answers here.
4
votes
1answer
121 views

Are “Security SMS codes” any safer than plain SMS?

Many banking webapps send this kind of SMS, for their 2FA systems. These messages do not appear in the main "Messages" app, seemingly being destroyed after viewing - at least on iOS. Firstly, are ...
4
votes
2answers
653 views

iOS data protection: Who decrypts files transferred over USB?

I'm trying to understand an implementation detail of Apple's data protection in iOS: I know about the per-file encryption and the various key encryption classes and keybags; however, I don't ...
4
votes
3answers
433 views

How is “Touch Jacking” prevented on iOS, Android, and Win 10 - touch?

I'm looking at the security of both iOS and Android from a Touch-jacking security perspective. In other words, I expect that an application can be in a secure state to ensure that no overlays, screen ...
4
votes
2answers
109 views

Does changing my password after OAuth login in mobile app help reduce risk?

When you use a mobile app that needs Google OAuth login, you can't fully trust the third party app because you can't tell what url the webview is using. Who knows if they aren't storing my login and ...
4
votes
1answer
40 views

Seamless authentication from an iPad to several enterprise apps - what are the options?

What are the options for authenticating users of corporate iPads which are MDM managed to access sensitive corporate web apps exposed over the internet? The issue here is there are several web apps ...
4
votes
2answers
751 views

Is Google API Key a sensitive information that needs to be protected?

I'm making use of google API for location (in Android, iOS apps).. Can the key be hardcoded? Or should it be protected? If It's sensitive, why is it sensitive and how can attackers exploit this?
4
votes
0answers
71 views

How to encrypt data using the iOS secure element?

I would like to know if there's a way to encrypt/decrypt data using the iOS secure element chip (Java card). Or does the keychain already use it?
3
votes
2answers
1k views

Mitigating SSL bypassing on iOS

I am trying to mitigate SSL bypassing on a jailbroken iOS. I am unable to find any good work around as Mobile Substrate and SSL kill switch are able to bypass SSL. I have tried two things: SSL ...
3
votes
4answers
1k views

Are kiosk-style, full screen apps possible on iOS, Android, or Windows phone?

A popular car insurance company in the US has an app that displays "digital car insurance" papers. In the commercials, these apps are opened, and the user gives the unlocked phone to police officers. ...
3
votes
3answers
6k views

Intercept data sent via bluetooth

I am trying to re-write a closed-source application, originally deployed on mobile devices, that lets you command and control a certain type of mechanical robots via bluetooth. The new application I ...
3
votes
2answers
225 views

Is Apple’s latest encryption considered to be munitions grade?

According to U.S. Export and Import laws, any device that has a minimum level of encryption is considered as falling under munitions type laws. Does Apple’s latest OS contain that level? And if it ...
3
votes
4answers
3k views

Can visiting a malicious website infect an iOS or Android device?

Can visiting a malicious website infect an iOS or Android device? We're talking about visiting such sites via a browser. We're not talking about downloading any malicious apps. Thanks!
3
votes
2answers
242 views

How to secure JSON data that is shown on web service page?

I have an iOS app that uses a web service to get data from my server. It grabs the data and echoes a JSON feed to the web page, and the iOS app interprets it. I have SSL so I am not worried about the ...
3
votes
2answers
181 views

Security through obscurity - “https requests” are safe?

In an iPhone app that utilizes plain text (unencrypted) XML as the contents of its http POST requests over https to the app server; how would someone be able to discover the "format" of the plain text ...
3
votes
1answer
455 views

How critical is App Transport Security?

As we've probably all heard, App Transport Security in iOS 9 requires: TLS 1.2 or better Forward secrecy ciphers SHA256 or better with >= 2048-bit RSA or >= 256-bit ECC key Google and Facebook ...
3
votes
2answers
141 views

Can I store a pair of keys on iOS secure element?

I would like to know if I can use the iPhone's secure element to store a pair of keys. I need to store them in the safest emplacement, and I can't think of a better one than the secure element.
3
votes
1answer
3k views

Secure erase iOS devices

All iOS devices from the iPhone 3GS have a hardware encryption chip, right? When you erase an iOS device with the "Erase All Content and Settings" menu item or via Remote Wipe the encryption keys are ...
3
votes
2answers
73 views

How protect mobile website against encapsulating into rogue native mobile app?

We are developping a mobile application (m.website.com). Is there a way to prevent a rogue developper to build an IOS / Android native app that simply encapsulate our website into the app using ...
3
votes
3answers
789 views

Proper implementation of HIPAA within iOS app with several factors

We are developing an iOS app that allows users to store/modify Protected Health Information (PHI) and the app needs to allow users to do so without an internet connection for large parts of the ...
3
votes
2answers
150 views

Can you use ssh for secure inter app communication on the same device?

I use ssh to get an encrypted connection between servers and local machines all the time. It's fast, it's secure, and there's a way to do it in nearly every system programming language that I've used ...
3
votes
1answer
98 views

Is it ok from the viewpoint of PCI DSS to send credit card info to my own server which then directly sends it to PayPal?

Currently I'm developing an iOS application which has an option to pay an order (clothes cleaning) via scanning credit card info using device camera. I can't use Apple In-App Purchases (IAP) for this, ...
3
votes
1answer
149 views

Why do mobile operating systems not implement a way to deny permissions to an app?

Android and iOS (afaik) implement a relativly fine-grained permission schema for their apps. But as I user I only have the change to acceppt all or nothing. When I think about it, it shouldn't be a ...
3
votes
1answer
1k views

iPhone iOS 7 Encryption at Lock Screen

Following this topic, I have a question about how the OS and apps access data while the phone is locked. Particularly in the case of iPhone 5S running iOS 7. When the device is locked, what allows ...
3
votes
2answers
6k views

Mount Iphone for Forensic Analysis or Take Forensic Image

How do I mount my iphone to look at it's files forensically? I have FTK Imager (the only free program I could find) but it doesnt mount it as a drive and I can't seem to take a forensic image of the ...
3
votes
1answer
2k views

How to verify the signature in an iOS Passbook pass?

The Passbook application in the new iOS6 keeps track of movie tickets, coupons, and other 'passes' for you, and the passes themselves are loaded onto the user's device via file packages with the ...
3
votes
1answer
954 views

What can an iOS app tell about you?

We all know while using a new iOS app it might ask for information like location or access to the camera. Those are both features we can deny to the app. There are, however, features apps can access ...
3
votes
1answer
814 views

iOS application pentest without jailbreak

Is it possible to run a security assessment on an iOS application using a non-jailbroken device? My device was recently restored (recovered - no SHSH blobs) to iOS 8.4.1 (as Apple doesn't like ...
3
votes
2answers
1k views

IPhone iOS 8.3 encryption security against physical access

NB: While you are free to answer this question, there is a more specific discussion here Excerpt from Apple's Whitepaper "iOS Security" on Effaceable Storage: A dedicated area of NAND storage, ...
3
votes
1answer
149 views

iOS VPN profiles - are the signing certificates global? Can this be a MITM exploit?

I have installed an app on iOS to connect to a well-known VPN service. The app requests installation of a profile onto iOS, which as far as I can see are a collection of 7 certificates - 5 of which ...
3
votes
1answer
266 views

How Secure Rooted or Jailbroken Devices are?

I am just wondering, but how can I harden the security of jailbroken or rooted devices? I understand that SD Card can be still accessible, but how could potential adversaries compromise for example ...
3
votes
1answer
3k views

Storing session key for iOS app

For an iOS app that communicates with a RESTful service over HTTPS, should the session key be stored in Keychain or NSUserDefaults? Username and password are stored in Keychain, and it would seem ...
3
votes
1answer
449 views

Loginless Client/Server Architecture (iOS)

I'm currently in the phase of planing a project involving loginless service. Users would be identified by an unique device id created on the client (ios). What are the security concerns? sockets ...
3
votes
0answers
338 views

Security flaw in iOS, Safari weird behavior or what else?

some months ago I was travelling and flew from Frankfurt airport and, while there, I probably connected to some Telekom.de free hotspot. I have an iPhone 6 with iOS 9.02 (at that time it was 8.1.x). ...
3
votes
2answers
208 views

iOS Unicode Notification Bug

Evidently, someone has discovered a Unicode bug in iOS, where if an app receives a specific Unicode sequence (infinitely-repeating Unicode code point), the OS will kill the Springboard as it allocates ...
3
votes
0answers
512 views

iCloud backup - which keys are transferred to Apple?

The iOS data protection implementation and the implementation of iTunes backups are both reasonably well documented, on a high level by by apple, and much more detailed by third parties. However, I'm ...
2
votes
1answer
965 views

How to secure an application under iOS against jailbroken devices

I noticed that some apps, e.g. Skype, is capable to exit and not run in case one has jailbroken his iOS based device. I couldn't find online how to check that a device is jailbroken. Please anyhelp ...