iOS is Apple's operating system for the iPhone, iPad and iPod Touch.

learn more… | top users | synonyms (1)

3
votes
4answers
1k views

Are kiosk-style, full screen apps possible on iOS, Android, or Windows phone?

A popular car insurance company in the US has an app that displays "digital car insurance" papers. In the commercials, these apps are opened, and the user gives the unlocked phone to police officers. ...
3
votes
1answer
912 views

How to secure an application under iOS against jailbroken devices

I noticed that some apps, e.g. Skype, is capable to exit and not run in case one has jailbroken his iOS based device. I couldn't find online how to check that a device is jailbroken. Please anyhelp ...
3
votes
2answers
171 views

Security through obscurity - “https requests” are safe?

In an iPhone app that utilizes plain text (unencrypted) XML as the contents of its http POST requests over https to the app server; how would someone be able to discover the "format" of the plain text ...
3
votes
2answers
564 views

How secure is the private storage of a mobile app

Are there any know security flaws/hacks to gain access to the private storage(file system or SQLite database) of Android and iOS applications? What measures do Google and Apple take to "prevent" ...
3
votes
3answers
406 views

What are the best practices for maintaining privacy on a non-jailbroken iOS device?

iOS, like most other mobile OSs, has the potential to leak significant chunks of personal information to 3rd-party apps and to ad and tracking networks used by those apps, which in turn also has the ...
3
votes
1answer
91 views

Are “Security SMS codes” any safer than plain SMS?

Many banking webapps send this kind of SMS, for their 2FA systems. These messages do not appear in the main "Messages" app, seemingly being destroyed after viewing - at least on iOS. Firstly, are ...
3
votes
1answer
2k views

Secure erase iOS devices

All iOS devices from the iPhone 3GS have a hardware encryption chip, right? When you erase an iOS device with the "Erase All Content and Settings" menu item or via Remote Wipe the encryption keys are ...
3
votes
2answers
84 views

Can you use ssh for secure inter app communication on the same device?

I use ssh to get an encrypted connection between servers and local machines all the time. It's fast, it's secure, and there's a way to do it in nearly every system programming language that I've used ...
3
votes
2answers
379 views

IPhone iOS 8.3 encryption security against physical access

Excerpt from Apple's Whitepaper "iOS Security" on Effaceable Storage: A dedicated area of NAND storage, used to store cryptographic keys, that can be addressed directly and wiped securely. ...
3
votes
1answer
101 views

Why do mobile operating systems not implement a way to deny permissions to an app?

Android and iOS (afaik) implement a relativly fine-grained permission schema for their apps. But as I user I only have the change to acceppt all or nothing. When I think about it, it shouldn't be a ...
3
votes
1answer
1k views

How to verify the signature in an iOS Passbook pass?

The Passbook application in the new iOS6 keeps track of movie tickets, coupons, and other 'passes' for you, and the passes themselves are loaded onto the user's device via file packages with the ...
3
votes
1answer
107 views

iOS VPN profiles - are the signing certificates global? Can this be a MITM exploit?

I have installed an app on iOS to connect to a well-known VPN service. The app requests installation of a profile onto iOS, which as far as I can see are a collection of 7 certificates - 5 of which ...
3
votes
1answer
983 views

iPhone iOS 7 Encryption at Lock Screen

Following this topic, I have a question about how the OS and apps access data while the phone is locked. Particularly in the case of iPhone 5S running iOS 7. When the device is locked, what allows ...
3
votes
2answers
380 views

Detection of function hooking in iOS

So far as I know, in iOS there are three techniques of function hooking: preload library using DYLD_INSERT_LIBRARIES imported symbol table redirection using fishhook patch the functions when they ...
3
votes
1answer
232 views

How Secure Rooted or Jailbroken Devices are?

I am just wondering, but how can I harden the security of jailbroken or rooted devices? I understand that SD Card can be still accessible, but how could potential adversaries compromise for example ...
3
votes
1answer
2k views

Storing session key for iOS app

For an iOS app that communicates with a RESTful service over HTTPS, should the session key be stored in Keychain or NSUserDefaults? Username and password are stored in Keychain, and it would seem ...
3
votes
1answer
424 views

Loginless Client/Server Architecture (iOS)

I'm currently in the phase of planing a project involving loginless service. Users would be identified by an unique device id created on the client (ios). What are the security concerns? sockets ...
3
votes
2answers
163 views

iOS Unicode Notification Bug

Evidently, someone has discovered a Unicode bug in iOS, where if an app receives a specific Unicode sequence (infinitely-repeating Unicode code point), the OS will kill the Springboard as it allocates ...
3
votes
0answers
233 views

What unique device fingerprinting information can an iOS8 app collect?

As a follow-on to this question: What unique fingerprinting information can an iOS7 app collect? What remaining device fingerprinting privacy / security vulnerabilities still exist as of iOS 8? Can ...
2
votes
2answers
186 views

How does iOS prevent unauthorised code from running?

I'm just wondering. How does iOS prevent someone from executing code on their device that isn't from Apple or downloaded from the App Store? Also what exactly, does a Jailbreak do to allow ...
2
votes
4answers
879 views

Can visiting a malicious website infect an iOS or Android device?

Can visiting a malicious website infect an iOS or Android device? We're talking about visiting such sites via a browser. We're not talking about downloading any malicious apps. Thanks!
2
votes
3answers
5k views

Intercept data sent via bluetooth

I am trying to re-write a closed-source application, originally deployed on mobile devices, that lets you command and control a certain type of mechanical robots via bluetooth. The new application I ...
2
votes
3answers
534 views

Security of email sent/received on iPhone via Mail app

In regards to the default Mail app on iOS 8, setup with various mail accounts gmail, outlook etc. Are emails sent/received to/from the phone securely, if so, how? Can someone who is snooping on the ...
2
votes
3answers
147 views

Is possible to know if increased marketshare means more viruses?

I'm having an argument with other developers about why more "viruses" exist (including all forms of external attacks, exploits, etc) in Android vs iOS. Like with Windows vs *nix, the main idea is that ...
2
votes
2answers
423 views

How is it possible that a text message can reboot an Apple device?

I was reading through my infosec newsfeed and found this article: http://www.theguardian.com/technology/2015/may/27/iphone-crash-bug-text-imessage-ios It basically talks about a bug iOS has while ...
2
votes
2answers
2k views

Securing JSON data

I am planning to use JSON as the data transport mechanism between my iOS app and my server (the server is a WCF service). While learning about JSON, I realized that all the data is passed around ...
2
votes
1answer
431 views

How is the iOS KeyChain master key derived?

I'm no expert but I'm assuming that on OSX it's derived from the user account password. I'm more than open to the possibility of that being incorrect. On iOS there is no user account password, only a ...
2
votes
3answers
89 views

Proper implementation of HIPAA within iOS app with several factors

We are developing an iOS app that allows users to store/modify Protected Health Information (PHI) and the app needs to allow users to do so without an internet connection for large parts of the ...
2
votes
1answer
664 views

Capturing iTunes traffic with Wireshark - SSL decryption question

I'm fooling around with Wireshark to capture the activation packets for an iPhone and some other stuff, however the traffic is encrypted. There should be a private SSL key somewhere on my computer to ...
2
votes
1answer
4k views

How does Activesync security policy affect the usage of the iOS fingerprint scanner?

An Activesync IT administrator has the ability to choose if the phone should require a password, and also how complex it should be. Since the fingerprint scanner appears to replace the traditional ...
2
votes
2answers
5k views

HTTPS verification failed - get certificate information iPad/iPhone

I went to log onto my bank's internet banking website this morning using Google Chrome browser on my iPad. I get the red error message of death. I can't figure out why. It's happening on both my ...
2
votes
1answer
2k views

Is there any way to list the contents of the iPhone/OSX Keychain and their security level?

I have a few apps that I purchased from the app store that probably store information in my keychain on OSX and on the iPhone. Since it's possible for keychain items to be bound to a device (and ...
2
votes
2answers
2k views

Security analysis tools for iOS 6 [closed]

Searched over web, however could not find much info on security analysis tools for iOS6. Can somebody point me to the security analysis (Static Code Analysis & Pen Testing) tools for iOS6?
2
votes
1answer
587 views

How secure are native iPhone - PUSH Services

The native app is sending the UDID to Provider Service for recieving PUSH Notification thru APNS. How is it possible to prevent tampered request(modified UDID) getting processed at Provider Service? ...
2
votes
2answers
3k views

Mount Iphone for Forensic Analysis or Take Forensic Image

How do I mount my iphone to look at it's files forensically? I have FTK Imager (the only free program I could find) but it doesnt mount it as a drive and I can't seem to take a forensic image of the ...
2
votes
1answer
519 views

What unique fingerprinting information can an iOS7 app collect?

I'm interested in unique information that is beyond typical user knowledge or control. As of iOS 7, users can easily protect local physical tracking by controlling radios (cell, WiFi, Bluetooth) in ...
2
votes
1answer
235 views

Any problems with UCC (multidomain) SSL certs on iOS and Windows Phones?

Are they any known issues with UCC (multidomain) SSL certs on iOS or Windows Phone? Let's say I want to have Exchange server under outlook.mycompany.com and RemoteApp Portal under ...
2
votes
1answer
646 views

Is XRY Forensic Tool able to extract data from iPhones?

As far as I know this only DOESN'T work with iPhone 4S and iPad2 / iPad 3, because of the fixed Boot Rom. So, is it no longer possible to brute-force the passcode lock? Can anybody confirm this with ...
2
votes
1answer
968 views

Which crypto-algorithem uses iOS in NSDataWritingFileProtection and what is the keysize?

I need to know the crypto algorithm and key strength of NSDataWritingFileProtection. I would like to know the same things for using the Keychain and NSFileManager. I searched the Apple Developer ...
2
votes
2answers
1k views

Guidelines for secure iPhone application development

Are there any security guidelines for development and assessment of (native) iPhone applications?
2
votes
2answers
231 views

Securing iPads and laptops in an enterprise

We have users in our organization who own iPads and we'd like to connect them to the network; however, if the users download and store sensitive data on the devices, that can pose a security issue. Is ...
2
votes
1answer
308 views

How to tell if Firefox Home (iOS) is using Data Protection API?

The source code is here: http://mxr.mozilla.org/services-central/source/fx-home/ What should I be looking/search for? Or even how to extract /ffhomeDB.sq3 and see what it contains.
2
votes
1answer
86 views

Code analyzer for Objective C? [closed]

Has anyone come across a code analyzer that could be run on OS other than Mac to scan for Objective C (for iOS) code?
2
votes
1answer
123 views

Should a Mobile app able to check what password is locally saved via a user facing feature?

I'm working at a company who is currently working to secure their mobile app (iOS native) by adding check points to security sensitive screens on the device (data is stored in the iOS keychain). User ...
2
votes
1answer
126 views

Does using Chrome bypass the Apple iOS gotofail bug ?

Does the recent certificate gotofail bug affect me if I'm running version 6 of iOS, but only use Chrome as my browser?
2
votes
1answer
382 views

Security: Oauth and Mobile apps

This is what I believe are the security implications of integrating Oauth using embedded webview vs browser in mobile application. Embedded Webview * Keep UI for mobile app Security implications ...
2
votes
1answer
3k views

Kik | WhatsApp - Encrypted? iOS / Android Message encryption tips [closed]

Kik says that their client is using ssl etc. But it's kind of hard to tell if the messages is actually encrypted between the devices. What i can understand is that they don't got device-to-device ...
2
votes
1answer
381 views

Does iOS use built-in certificates to authenticate peers when using ipsec VPNs?

Suppose I am setting up an IPsec VPN for Apple iOS clients with the requirement that the iOS clients need to know that the server is legitimate and vice-versa. I create a root CA and issue a ...
2
votes
0answers
386 views

iCloud backup - which keys are transferred to Apple?

The iOS data protection implementation and the implementation of iTunes backups are both reasonably well documented, on a high level by by apple, and much more detailed by third parties. However, I'm ...
2
votes
2answers
3k views

Why is this SSL handshake failing with iPad? [closed]

I do have a tomcat server that listen on an SSL socket with TLS protocol. When connecting with all desktop browser everything work right. When connecting with Safari on iPad, the SSL handshake fails. ...