iOS is Apple's operating system for the iPhone, iPad and iPod Touch.

learn more… | top users | synonyms (1)

2
votes
2answers
5k views

HTTPS verification failed - get certificate information iPad/iPhone

I went to log onto my bank's internet banking website this morning using Google Chrome browser on my iPad. I get the red error message of death. I can't figure out why. It's happening on both my ...
2
votes
1answer
2k views

Is there any way to list the contents of the iPhone/OSX Keychain and their security level?

I have a few apps that I purchased from the app store that probably store information in my keychain on OSX and on the iPhone. Since it's possible for keychain items to be bound to a device (and ...
2
votes
2answers
2k views

Security analysis tools for iOS 6 [closed]

Searched over web, however could not find much info on security analysis tools for iOS6. Can somebody point me to the security analysis (Static Code Analysis & Pen Testing) tools for iOS6?
2
votes
1answer
673 views

How secure are native iPhone - PUSH Services

The native app is sending the UDID to Provider Service for recieving PUSH Notification thru APNS. How is it possible to prevent tampered request(modified UDID) getting processed at Provider Service? ...
2
votes
2answers
54 views

How protect mobile website against encapsulating into rogue native mobile app?

We are developping a mobile application (m.website.com). Is there a way to prevent a rogue developper to build an IOS / Android native app that simply encapsulate our website into the app using ...
2
votes
1answer
102 views

iOS encryption and performance

iOS file encryption deploys many layers of encryption; There is the AES-256 accelerator encrypting general flash memory with the per-file-, UID-, and GID keys. There is Data Protection on the software ...
2
votes
2answers
87 views

xcodeghost infection in a byod device

We detected network traffic from a device infected with xcodeghost trying to reach a known bot command and control address. Obviously, we removed the device from the network. The user removed two ...
2
votes
1answer
198 views

What data is not encrypted in iOS 8+ when “locked”

Scenario: iPhone 5+ with iOS 8+ with system encryption enabled. The phone is on and locked. (the user has authenticated (unlocked phone) at least once since power-up, and then relocked). What ...
2
votes
3answers
281 views

What security mechanisms are in place for iOS' custom keyboards?

Apple has just announced iOS 8. The new version appears to be more extensible than previous versions, and one of the new possiblities is to allow developers to develop custom keyboards, different than ...
2
votes
1answer
252 views

Any problems with UCC (multidomain) SSL certs on iOS and Windows Phones?

Are they any known issues with UCC (multidomain) SSL certs on iOS or Windows Phone? Let's say I want to have Exchange server under outlook.mycompany.com and RemoteApp Portal under ...
2
votes
1answer
729 views

Is XRY Forensic Tool able to extract data from iPhones?

As far as I know this only DOESN'T work with iPhone 4S and iPad2 / iPad 3, because of the fixed Boot Rom. So, is it no longer possible to brute-force the passcode lock? Can anybody confirm this with ...
2
votes
1answer
1k views

Which crypto-algorithem uses iOS in NSDataWritingFileProtection and what is the keysize?

I need to know the crypto algorithm and key strength of NSDataWritingFileProtection. I would like to know the same things for using the Keychain and NSFileManager. I searched the Apple Developer ...
2
votes
2answers
1k views

Guidelines for secure iPhone application development

Are there any security guidelines for development and assessment of (native) iPhone applications?
2
votes
2answers
263 views

Securing iPads and laptops in an enterprise

We have users in our organization who own iPads and we'd like to connect them to the network; however, if the users download and store sensitive data on the devices, that can pose a security issue. Is ...
2
votes
1answer
310 views

How to tell if Firefox Home (iOS) is using Data Protection API?

The source code is here: http://mxr.mozilla.org/services-central/source/fx-home/ What should I be looking/search for? Or even how to extract /ffhomeDB.sq3 and see what it contains.
2
votes
1answer
106 views

Bruteforcing an iOS PIN

The iOS Security document describes several security mechanisms implemented in iOS 9. I am specifically interested in the actual security of a 4 digits PIN on iOS. I am looking for tangible ...
2
votes
1answer
164 views

Web services API key

I have a PHP server with some .php files. Swift iOS application send POST request to server and get some response in JSON. PHP files on server do some work with MSQL. The question is: How to provide ...
2
votes
1answer
121 views

Code analyzer for Objective C? [closed]

Has anyone come across a code analyzer that could be run on OS other than Mac to scan for Objective C (for iOS) code?
2
votes
1answer
146 views

Should a Mobile app able to check what password is locally saved via a user facing feature?

I'm working at a company who is currently working to secure their mobile app (iOS native) by adding check points to security sensitive screens on the device (data is stored in the iOS keychain). User ...
2
votes
1answer
131 views

Does using Chrome bypass the Apple iOS gotofail bug ?

Does the recent certificate gotofail bug affect me if I'm running version 6 of iOS, but only use Chrome as my browser?
2
votes
1answer
417 views

Security: Oauth and Mobile apps

This is what I believe are the security implications of integrating Oauth using embedded webview vs browser in mobile application. Embedded Webview * Keep UI for mobile app Security implications ...
2
votes
1answer
3k views

Kik | WhatsApp - Encrypted? iOS / Android Message encryption tips [closed]

Kik says that their client is using ssl etc. But it's kind of hard to tell if the messages is actually encrypted between the devices. What i can understand is that they don't got device-to-device ...
2
votes
1answer
398 views

Does iOS use built-in certificates to authenticate peers when using ipsec VPNs?

Suppose I am setting up an IPsec VPN for Apple iOS clients with the requirement that the iOS clients need to know that the server is legitimate and vice-versa. I create a root CA and issue a ...
2
votes
0answers
50 views

Installing a cocoapod and 'github' asks for login credentials?

I just added a cocoapod and got this >ls Podfile superApp Podfile.lock superApp.xcodeproj Pods superApp.xcworkspace >pod install Updating local specs ...
2
votes
1answer
56 views

Yovo screenshot blocker vulnerability [closed]

I was studying Yovo's screenshot blocker and I noticed that when watching their demo, I was easily able to pause the video when the screenshot blocker was taking effect and get a fairly clear view of ...
2
votes
0answers
60 views

Google/Apple account for corporate issued mobile phones

We are working on implementing MDM (Airwatch) for all corporate mobile devices (no BYOD will be allowed). But I have a question as what is the best way to avoid users use their personal Gmail or ...
2
votes
0answers
85 views

HTML Injection on iOS?

I had an uncommon issue with both Safari and Chrome on an iPhone 6 running iOS 9.0.1 last night - a number of sites were displayed with altered links and/or additional links (clearly from a ...
2
votes
0answers
127 views

common crypto and bouncy castle, PBKDF2 generation

I am working on an iOS app and android app, for iOS I am using common crypto, and for android bouncy castle. I noticed that in android when I generate PBKDF2, if I use a salt or pass ...
2
votes
0answers
673 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
2
votes
2answers
4k views

Why is this SSL handshake failing with iPad? [closed]

I do have a tomcat server that listen on an SSL socket with TLS protocol. When connecting with all desktop browser everything work right. When connecting with Safari on iPad, the SSL handshake fails. ...
1
vote
3answers
1k views

How secure is iOS Touch ID?

I was wondering how secure Touch ID/Keychain is really. My understanding is that iPhone 5S devices that use Touch ID allow you to enter a passcode if your fingerprint doesn't work, as a "fallback". ...
1
vote
1answer
408 views

Obfuscation and Mobile App

Recently, I stumbled with this topic in my mind for few days. I understand that obfuscation is not the best protection against reverse engineering. I wonder if there is another method that make it ...
1
vote
4answers
249 views

iPad infected with virus (popup - admobinew.com)

This morning I was reading some news on some websites (I think one of them was haaretz.com) using my iPad (ios 9.0.1), I clicked on a news and I was redirected to some dodgy website and I started ...
1
vote
1answer
155 views

What security practices should I keep in mind during development? [closed]

I am beginning to develop apps for Android and iOS that make API calls to a PHP web application that I will be developing. Users will be required to sign up with a username, password, and (optional) ...
1
vote
2answers
70 views

Data security implications of using Android over iOS [closed]

What are the security implications of using Android as opposed to iOS? Many sources say Android is much less secure and much less capable of handing a user's data in a secure manner. What are the main ...
1
vote
3answers
2k views

Sending secure information from app with ssl

I'm a web developer, but I occasionally step over into doing some mobile app development here and there. A client recently asked me to help them develop a very simple app. The app is essentially just ...
1
vote
1answer
138 views

Private messages for an ios app - how secure is this system?

I'm designing architecture for sending private messages (i.e. only sender and receiver are able to read a message). Client side - iOS, server side - Parse.com I'm thinking of using RSA to ...
1
vote
2answers
346 views

Protecting the remote database against tampering in a mobile app

This is the first time I face a mobile app deployment at big scale. This app needs to connect to a remote server where to store and retrieve data. I discarded connecting directly to the MySQL ...
1
vote
1answer
41 views

My iTunes account got hacked and someone used it to buy in-app purchase. How could that happen? [on hold]

The account was hacked, I found out in my credit card statement and Apple support gave me refund which is nice. I wonder how it happened, and if there are even more serious risks that I don't know. ...
1
vote
1answer
11 views

Is there any way or tool to check whether a particular iOS app is implementing SSL Pinning functionality?

I'm just learning the iOS security. This is completely a beginner question. I'm trying to figure out whether there is any particular way to check if an iOS app is implementing SSL Pinning ...
1
vote
1answer
41 views

Is it completely safe to store the unencrypted credentials within a variable in the ios device

Overview is we encrypt the credentials using the pincode as the passphrase that the user also sets. One of the requirements is to NEVER SAVE THE PINCODE anytime anywhere. Everytime the user goes out ...
1
vote
1answer
137 views

Securing iOS applications communication from client side

Many of you have heard about instagram flaw that facebook has not fixed yet, The flaw allows the attacker to hijack the session by sniffing the session cookie on Instagram iOS app since it does not ...
1
vote
1answer
204 views

Secure way of opening web page from iOS without need of logging in

I am developing an iOS application and web page, both use same Parse backend. Web page contains some functionality that is not available in the iOS application. Therefore I would like to present the ...
1
vote
1answer
461 views

What encryption does Apple use?

With their iOS devices, Apple allows people to block certain applications through "Restrictions". I recently had an issue with my iPhone where I'm positive that I entered the correct passcode on my ...
1
vote
1answer
704 views

Share and store RSA - public key in java server and vice versa

My requirements are: Requirement 1: Share public key to java server. Steps: Generate public-private keys in iOS app. Store the generated keys in keychain. Send generated public key to java server. ...
1
vote
1answer
3k views

iOS: sandbox of an iphone app

I am new to iOS so I do have only limited knowledge about iOS in general. For self learning purposes, I would like to know several things as I am quite confused after searching the web. I do know ...
1
vote
1answer
989 views

Using Apple NSKeyedArchiver class without encryption to save score data locally

first of all I'm sorry for my bad English! I have a question about the security of NSKeyedArchiver, a subclass of NSCoder of Apple Foundation.framework ...
1
vote
1answer
80 views

Starting point for Mobile Device Security particularly in a MDM setting?

I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
1
vote
0answers
26 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
1
vote
0answers
51 views

Sensitive Information Disclosure via plist on iOS, does this affect security at all?

The security team has found sensitive information which is disclosed in info.plist, API keys were also exposed. Fabric is being used and Fabric API key is the way to authenticate the users or their ...