iOS is Apple's operating system for the iPhone, iPad and iPod Touch.

learn more… | top users | synonyms (1)

2
votes
0answers
148 views

common crypto and bouncy castle, PBKDF2 generation

I am working on an iOS app and android app, for iOS I am using common crypto, and for android bouncy castle. I noticed that in android when I generate PBKDF2, if I use a salt or pass ...
2
votes
0answers
800 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook. Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
2
votes
2answers
4k views

Why is this SSL handshake failing with iPad? [closed]

I do have a tomcat server that listen on an SSL socket with TLS protocol. When connecting with all desktop browser everything work right. When connecting with Safari on iPad, the SSL handshake fails. ...
1
vote
2answers
203 views

How does iOS prevent unauthorised code from running?

I'm just wondering. How does iOS prevent someone from executing code on their device that isn't from Apple or downloaded from the App Store? Also what exactly, does a Jailbreak do to allow ...
1
vote
3answers
1k views

How secure is iOS Touch ID?

I was wondering how secure Touch ID/Keychain is really. My understanding is that iPhone 5S devices that use Touch ID allow you to enter a passcode if your fingerprint doesn't work, as a "fallback". ...
1
vote
1answer
525 views

Obfuscation and Mobile App

Recently, I stumbled with this topic in my mind for few days. I understand that obfuscation is not the best protection against reverse engineering. I wonder if there is another method that make it ...
1
vote
4answers
505 views

iPad infected with virus (popup - admobinew.com)

This morning I was reading some news on some websites (I think one of them was haaretz.com) using my iPad (ios 9.0.1), I clicked on a news and I was redirected to some dodgy website and I started ...
1
vote
1answer
162 views

What security practices should I keep in mind during development? [closed]

I am beginning to develop apps for Android and iOS that make API calls to a PHP web application that I will be developing. Users will be required to sign up with a username, password, and (optional) ...
1
vote
1answer
109 views

Could the FBI dump the drive contents of an iOS device, and then somehow run Virtual CPU's with different keys?

This seems like the most logical answer that would prevent wiping the data. Dump Contents of Drive. SetUp Virtual CPU with different keys. Use existing firmware and hardware for ios x Profit Is ...
1
vote
3answers
2k views

Sending secure information from app with ssl

I'm a web developer, but I occasionally step over into doing some mobile app development here and there. A client recently asked me to help them develop a very simple app. The app is essentially just ...
1
vote
1answer
120 views

My iTunes account got hacked and someone used it to buy in-app purchase. How could that happen? [closed]

The account was hacked, I found out in my credit card statement and Apple support gave me refund which is nice. I wonder how it happened, and if there are even more serious risks that I don't know. ...
1
vote
1answer
45 views

Can I use a TLS certificate (first generated for a Windows Server) on a Linux Server?

I don't have any experience on this kind of things, so please bear with me. And I apologise if this has been asked before, but I couldn't find it in this site. My situation: I have a Windows ...
1
vote
1answer
171 views

Private messages for an ios app - how secure is this system?

I'm designing architecture for sending private messages (i.e. only sender and receiver are able to read a message). Client side - iOS, server side - Parse.com I'm thinking of using RSA to encrypt/...
1
vote
1answer
36 views

Is it possible to lock down the http / https proxy settings on an iPhone?

Is there any way to lock down the proxy settings on an iPhone so that they can't be changed by anyone but the person with the password?
1
vote
2answers
94 views

encrypting data while in memory

What is the best way to protect sensitive text input and store it in memory until form submission is complete and then clear it out shortly thereafter? I'm looking to protect sensitive information ...
1
vote
1answer
95 views

Is there any way or tool to check whether a particular iOS app is implementing SSL Pinning functionality?

I'm just learning the iOS security. This is completely a beginner question. I'm trying to figure out whether there is any particular way to check if an iOS app is implementing SSL Pinning ...
1
vote
1answer
153 views

Securing iOS applications communication from client side

Many of you have heard about instagram flaw that facebook has not fixed yet, The flaw allows the attacker to hijack the session by sniffing the session cookie on Instagram iOS app since it does not ...
1
vote
1answer
227 views

Secure way of opening web page from iOS without need of logging in

I am developing an iOS application and web page, both use same Parse backend. Web page contains some functionality that is not available in the iOS application. Therefore I would like to present the ...
1
vote
1answer
540 views

What encryption does Apple use?

With their iOS devices, Apple allows people to block certain applications through "Restrictions". I recently had an issue with my iPhone where I'm positive that I entered the correct passcode on my ...
1
vote
1answer
158 views

Should a Mobile app able to check what password is locally saved via a user facing feature?

I'm working at a company who is currently working to secure their mobile app (iOS native) by adding check points to security sensitive screens on the device (data is stored in the iOS keychain). User ...
1
vote
1answer
866 views

Share and store RSA - public key in java server and vice versa

My requirements are: Requirement 1: Share public key to java server. Steps: Generate public-private keys in iOS app. Store the generated keys in keychain. Send generated public key to java server. ...
1
vote
1answer
3k views

iOS: sandbox of an iphone app

I am new to iOS so I do have only limited knowledge about iOS in general. For self learning purposes, I would like to know several things as I am quite confused after searching the web. I do know ...
1
vote
1answer
1k views

Using Apple NSKeyedArchiver class without encryption to save score data locally

first of all I'm sorry for my bad English! I have a question about the security of NSKeyedArchiver, a subclass of NSCoder of Apple Foundation.framework (https://developer.apple.com/library/mac/#...
1
vote
1answer
84 views

Starting point for Mobile Device Security particularly in a MDM setting?

I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
1
vote
0answers
34 views

Fuzzing an iPhone

I'm currently researching how to fuzz Apple devices (specifically an iPhone 4 and an iPad 2). The devices are placed into DFU mode and then accessed using OpeniBoot. I've read through a good chunk of ...
1
vote
0answers
26 views

Does Rabbitmq support Elliptic Curve Encryption? [migrated]

I am using rabbitmq for chat. I have already installed the ssl on machine, which work fine for Android platform, but iOS broker not able to establish connection with machine and always show SSL ...
1
vote
0answers
29 views

Does NSURLConnection on iOS support HSTS?

I have an app for iOS that uses NSURLConnection to retrieve things from a server. Will enabling HTTP Strict Transport Security (HSTS) on the server have any impact on the app? Will it refuse to ...
1
vote
0answers
41 views

iOS keychain - who or what can access it

I have an iOS app that needs to be able to upload data in the background, and so also when the device is locked. To achieve background uploading I use information stored in the key chain. Therefore I ...
1
vote
0answers
35 views

What is leaked about devices connected to iOS personal hotspot?

This is the scenario: 1) I set up a personal hotspot using my iPhone 4S running iOS 5 (we call this device A) 2) I connect a mobile device (e.g. a smartphone) using WiFi to have it use the hotspot ...
1
vote
0answers
37 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
1
vote
0answers
100 views

Sensitive Information Disclosure via plist on iOS, does this affect security at all?

The security team has found sensitive information which is disclosed in info.plist, API keys were also exposed. Fabric is being used and Fabric API key is the way to authenticate the users or their ...
1
vote
0answers
311 views

What are the best ways for an iOS 9 user to protect against device fingerprinting?

In response to this series of questions: What unique device fingerprinting information can an iOS9 app collect? and as an update to this question: What are the best practices for maintaining privacy ...
1
vote
1answer
580 views

Secure socket communication between iOS device and 3rd party server

I'd like your advice on what is the best approach for the challenge in my hands... I'm developing an extension to a 3rd party software. I'm doing my development using Python/Twisted/Autobahn. The end ...
1
vote
1answer
231 views

iOS permissions for 3rd party app developers [closed]

I am putting together a summary on iOS and Android security risks based on app permissions. On Android, it is easy to define all of the permissions and what 3rd party developers have access to (from ...
1
vote
0answers
173 views

Force TLS on mobile app

i'm developing a mobile application for iOS and Android. On this app i'm asking resources on a secure server through ajax. Server's developers asked me to force the call in order that we use TLS ...
1
vote
1answer
2k views

What tools are available for iOS vulnerability assessment and penetration testing [closed]

I want to start learning about VA on Apple iOS devices. Besides documentation, is there any good tool - in terms of automated vulnerability scanners, or scripts - to start?
1
vote
0answers
151 views

FIPS Compliance with iOS app

Our company is working on getting FIPS validation for the iOS app and is in the initial phase. We have decided to use a private FIPS-certified libraries for using in the crypto modules. I have some ...
1
vote
0answers
45 views

Is SCEP safe if I use a different long and complex password per enrollment, and validate it against expected parameters?

I'm considering using SCEP to enroll iPads and other devices in my network. The iOS configuration profile allows me to configure a different password for each device. Is it valid, and safe for me to ...
1
vote
2answers
3k views

Why do I need a certificate to pin an SSL connection with AF Networking 2?

I am using the AF Networking 2 library and read that I need to include the server's certificate here. The client should be able to tell that the certificate is valid when it connects to the server, ...
1
vote
0answers
259 views

HIPAA Compliant App, using Encypted Core Data vs Core Data Attribute Encyption

I am writing an iOS app which needs to be HIPAA compliant. The app should preferably function offline, so data needs to be stored on the phone. So here is what I was thinking of doing: On First ...
1
vote
0answers
221 views

Implementation of different BCrypt versions

I'm fairly new to encryption, and I am investigating the different kind of encryptions. I want to encrypt passwords in a secure way. I discussed this with my colleague, and he said that BCrypt is the ...
0
votes
2answers
1k views

Are passwords safe to send through POST, without SSL in a iOS app?

Is it safe to post passwords to my web server in this manner? NSURL *url=[NSURL URLWithString:@"http://mywebsite/test/register.php"]; NSData *postData = [post dataUsingEncoding:NSASCIIStringEncoding ...
0
votes
2answers
118 views

how to encrypt a sensitive model on android and ios

I am writing a mobile app which uses a statistical model contained in binary files. I want to be able to distribute the app freely, but I don't want anyone to be able to use my model files, even on a ...
0
votes
3answers
97 views

How secure is my method?

I want to select data from a MySql database on an iphone device. The method I seem is the easiest one is to connect to a php file with GET arguments and then return it as a string. Now I'm just ...
0
votes
1answer
2k views

How to prove iOS app is vulnerable to MiTM

I'm updating an iOS app and I want to prove that it is vulnerable to MiTM attack. I have set up Charles Proxy on my mac and configured the Simulator so that it trusts Charles CA Certificate, per ...
0
votes
3answers
272 views

Restrict request to Android and Iphone App only?

I have a ASP.NET/IIS server. I want to restrict my server to only accept request from Android and Iphone(IOS) applications. I have heard about HMAC. Can HMAC help me?
0
votes
1answer
93 views

Does non-persistent data ever need to be encrypted?

Does non-persistent data ever need to be encrypted? If I had a project with confidential data stored in non-persistent class variables should I be doing anything to protect this data? I am developing ...
0
votes
1answer
32 views

What data (of or about the app) remains in the device after the app is uninstalled?

The question is for both Android and iOS. Recently, the information security team of my company raised a concern about the Application cache being maintained after the app (made using Cordova) was ...
0
votes
1answer
105 views

Can an iOS/android app encrypt data without the user entering a password?

I found an iOS app that claims to save all user data only encrypted. But the app never asks me for a password. Is it even possible that the app encrypts the data in a useful way? I do need see what ...
0
votes
2answers
403 views

Protecting the remote database against tampering in a mobile app

This is the first time I face a mobile app deployment at big scale. This app needs to connect to a remote server where to store and retrieve data. I discarded connecting directly to the MySQL ...