iOS is Apple's operating system for the iPhone, iPad and iPod Touch.

learn more… | top users | synonyms (1)

1
vote
0answers
17 views

Does NSURLConnection on iOS support HSTS?

I have an app for iOS that uses NSURLConnection to retrieve things from a server. Will enabling HTTP Strict Transport Security (HSTS) on the server have any impact on the app? Will it refuse to ...
-1
votes
0answers
5 views

What's the preferred way to deal with the security surrounding creating new users in an iOS app? [closed]

I'm trying to get my client side talking to my server for app I'm making and I want to start with signing up new users. I'm not exactly sure, even through some research online, which is the best way ...
3
votes
0answers
338 views

Security flaw in iOS, Safari weird behavior or what else?

some months ago I was travelling and flew from Frankfurt airport and, while there, I probably connected to some Telekom.de free hotspot. I have an iPhone 6 with iOS 9.02 (at that time it was 8.1.x). ...
12
votes
2answers
2k views

When does iOS check validity of enterprise certificates?

Here is an article that should give a little more context (and see my comment on it, same username, for additional info). iOS developers are able to distribute apps outside of the App Store using an ...
0
votes
0answers
22 views

Renewal of ssl client certificate on iOS app

I'm a bit confused on how ssl renewal would work on an iOS app. I've gotten a LetsEncrypt certificate for my domain name to secure data transfer between my iOS app and my web server. In the ...
9
votes
3answers
1k views

Is it safe to sync private keys between iOS devices using iCloud?

My iOS app has to handle storing private keys for the user. Normally I would just use Keychain Services for this as I would a password, but it would be great if I could sync the keys between the ...
1
vote
0answers
37 views

iOS keychain - who or what can access it

I have an iOS app that needs to be able to upload data in the background, and so also when the device is locked. To achieve background uploading I use information stored in the key chain. Therefore I ...
4
votes
2answers
79 views

Is there a security benefit in knowing if my iPhone is jailbroken?

There is an app for the iPhone supposedly detects if your smartphone has a jailbreak installed. Is there a security benefit in knowing whether your phone has a jailbreak or not?
2
votes
1answer
92 views

Viewing HTTPs Traffic - ZAP Proxy / MacOS / iOS App

I've noticed a curious oddity with some traffic sniffing from my Apps on my iPhone. I've installed the ZAP Proxy CA Cert on the device, but I've noticed I can sniff some App traffic, and others I ...
2
votes
1answer
89 views

Can an attacker make in-app-purchases of my products in their app?

My iOS app needs to store a pre-shared secret. It cannot embedded within the App Bundle itself because it could be extracted by statically analysing the bundle. Apple's In-App-Purchase system allows ...
6
votes
2answers
406 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
0
votes
0answers
30 views

SQLCipher and PRAGMA key on iOS

I'm a bit confused as to how SQLCipher handles the PRAGMA key provided for encrypting the SQLite database For background: I'm looking at options for encrypting application data at rest. From the ...
0
votes
0answers
5 views

Mobile Security and Vulnerability Analysis tool [migrated]

What tools should I use to test the security of my iOS application? What are the open source tools available to make vulnerability assessment of an iOS and android application? Any online tool which ...
0
votes
0answers
81 views

Should I blur the cached snapshot of my app?

I recently ran a security scan on one of my iOS apps that suggested I modify my apps display as it enters the background so that the screenshot stored in the cache does not expose any sensitive data. ...
4
votes
2answers
374 views

What data is not encrypted in iOS 8+ when “locked”

Scenario: iPhone 5+ with iOS 8+ with system encryption enabled. The phone is on and locked. (the user has authenticated (unlocked phone) at least once since power-up, and then relocked). What ...
0
votes
1answer
93 views

Does non-persistent data ever need to be encrypted?

Does non-persistent data ever need to be encrypted? If I had a project with confidential data stored in non-persistent class variables should I be doing anything to protect this data? I am developing ...
6
votes
1answer
125 views

What tools are needed to view or detect covert messages in a 60 fps video?

The eye can't detect changes in a frame greater than 60 FPS. Similar to this scene in Fight Club, a QR code equivalent is used in pairing the Apple Watch with the iPhone Without knowing that the ...
4
votes
1answer
40 views

Seamless authentication from an iPad to several enterprise apps - what are the options?

What are the options for authenticating users of corporate iPads which are MDM managed to access sensitive corporate web apps exposed over the internet? The issue here is there are several web apps ...
7
votes
2answers
55 views

Are any inherently insecure AES-CBC keys or key-IV combos known for properly generated random values?

This is mostly a theoretical question. I am using AES128 CBC to encrypt small files. Both my keys and my IVs are randomly generated per file using iOS's secure random value generation ...
-2
votes
1answer
151 views

Are VPNs for iPhones vulnerable to hacking?

I use VPNs all the time on my iPhone to get around websites being blocked and sometimes just for privacy, but are they secure? In this video the guy installed a certificate on the lady's phone that ...
157
votes
6answers
18k views

Apple's open letter - they can't or won't backdoor iOS?

Apple released an open letter to the public outlining their reasons for not complying with the FBI's demands to modify the iPhone's security mechanism. Here's a summary: The FBI has an iPhone in ...
6
votes
1answer
71 views

Why isn't there a FROST-like cold boot exploit for iOS?

I know there's a cold boot attack for Android called FROST (Forensic Recovery Of Scrambled Phones). But there doesn't seem to be one for iOs. Why is this? Is it because iOS is inherently more ...
2
votes
2answers
197 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
1
vote
0answers
33 views

What is leaked about devices connected to iOS personal hotspot?

This is the scenario: 1) I set up a personal hotspot using my iPhone 4S running iOS 5 (we call this device A) 2) I connect a mobile device (e.g. a smartphone) using WiFi to have it use the hotspot ...
5
votes
1answer
93 views

How was iMessage broken?

It was reported today that iMessage was broken (CVE-2016-1788) by a team from John Hopkins around Matthew Green. They said it was kinda to be expected after inspecting the security guide closely ...
1
vote
2answers
88 views

encrypting data while in memory

What is the best way to protect sensitive text input and store it in memory until form submission is complete and then clear it out shortly thereafter? I'm looking to protect sensitive information ...
-2
votes
1answer
86 views

How to legally jailbreak an iPhone? [closed]

I'm looking to jailbreak my work phone to pen test iOS applications. From a compliance point of view I've got the green light as long as I don't go on our companies intranet with it or put company ...
2
votes
0answers
73 views

Disk Decipher: iOS app with TrueCrypt and VeraCrypt functionality — Has there been any security review? Is it safe to use?

http://disk-decipher.hekkihek.nl/ I am having trouble finding information about source code, software license, and code review. Is there any way to know that once I decrypt a volume with this app ...
33
votes
4answers
2k views

How do I verify HTTPS connections in Mobile apps?

There are a lot of mobile apps nowadays with payment gateways support. However, unlike desktop browsers, these mobile apps do not show us an 'Address bar' by which we can identify a HTTPS connection. ...
11
votes
3answers
1k views

Why can't apple simply add the backdoor now and then remove it after the FBI is done?

Summary of the current situation by @TTT Apple released an open letter to the public outlining their reasons for not complying with the FBI's demands to modify the iPhone's security mechanism. ...
5
votes
3answers
252 views

Can someone read a iOS class variable from outside the app?

a class variable like this: @property (strong, nonatomic) NSString *privateValue; Can someone read the value of that variable while it´s in memory? I can´t find anything about this on the apple ...
-2
votes
1answer
86 views

How to clean-up an iPhone

Suppose that an iPhone has been rooted and a back-door installed on the firmware and that this was done in a way that the factory re-start cannot clear out the problems. How does one clean up this ...
2
votes
1answer
42 views

What are the security implications of installing an iPhone configuration profile?

What are the security risks of installing a "configuration profile" on iOS from www.vshare.com? I don't know what a configuration profile is or what it does. They are found in Settings > General > ...
6
votes
1answer
249 views

John McAfee's Explanation of iOS Hack

I'm referring to this YouTube video, and further comment from John: I hope everyone knows that the Apple explanation was VASTLY dumbed down for the press. I know the A7 system chip well, ...
2
votes
1answer
214 views

T-Mobile WWAN IP address is DoD Network Information Center? [closed]

I wrote an app that grabs the IP address of my Wifi as well as the WWAN i.e. the data part of my Tmobile plan. I have an iPhone. Here is what my app prints. I use pretty standard code to obtain the ...
0
votes
1answer
30 views

How can I secure the state of a compromised iPhone for evidence of evil before resetting it?

I'm a web developer and generalist programmer with a bit of mobile experience. A friend of my wife is being stalked by a guy she was dating briefly and dumped over a month ago. He has somehow (not to ...
-4
votes
1answer
118 views

How is it technically possible for Apple to unlock the San Bernardino shooter's iPhone? [duplicate]

If the iPhone of the San Bernadino shooters is locked, how would it even be possible for Apple to acquiesce to the FBI's request for them to unlock the phone? Does that mean Apple has some kind of ...
3
votes
2answers
242 views

How to secure JSON data that is shown on web service page?

I have an iOS app that uses a web service to get data from my server. It grabs the data and echoes a JSON feed to the web page, and the iOS app interprets it. I have SSL so I am not worried about the ...
3
votes
2answers
225 views

Is Apple’s latest encryption considered to be munitions grade?

According to U.S. Export and Import laws, any device that has a minimum level of encryption is considered as falling under munitions type laws. Does Apple’s latest OS contain that level? And if it ...
0
votes
1answer
186 views

Why IOS on IPhone cannot be brute-forced programatically? [duplicate]

I am interested in the recent Apple case where FBI wants to get access, but they say it's not technically possible other than creating a new OS (or I guess just modifying the existing one). More ...
2
votes
1answer
56 views

iOS: intercepting passcode before it reaches secure enclave

From what little I read about Apple's "Secure enclave", I understand that it's a coprocessor which encrypts/decrypts data based on the user's passcode. So here's the scenario: I somehow get root ...
0
votes
0answers
848 views

Is it possible to intercept ssl with burp on iOS 8.3

I have tried to intercept SSL connection on iOS 8.3 using BURP Proxy. I receive the error "There was a problem communicating with the secure web proxy server (HTTPS)." Is it because of some ...
2
votes
0answers
765 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook. Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
1
vote
1answer
108 views

Could the FBI dump the drive contents of an iOS device, and then somehow run Virtual CPU's with different keys?

This seems like the most logical answer that would prevent wiping the data. Dump Contents of Drive. SetUp Virtual CPU with different keys. Use existing firmware and hardware for ios x Profit Is ...
1
vote
1answer
75 views

Is there any way or tool to check whether a particular iOS app is implementing SSL Pinning functionality?

I'm just learning the iOS security. This is completely a beginner question. I'm trying to figure out whether there is any particular way to check if an iOS app is implementing SSL Pinning ...
1
vote
1answer
99 views

My iTunes account got hacked and someone used it to buy in-app purchase. How could that happen? [closed]

The account was hacked, I found out in my credit card statement and Apple support gave me refund which is nice. I wonder how it happened, and if there are even more serious risks that I don't know. ...
2
votes
1answer
57 views

Is it completely safe to store the unencrypted credentials within a variable in the ios device

Overview is we encrypt the credentials using the pincode as the passphrase that the user also sets. One of the requirements is to NEVER SAVE THE PINCODE anytime anywhere. Everytime the user goes out ...
1
vote
4answers
411 views

iPad infected with virus (popup - admobinew.com)

This morning I was reading some news on some websites (I think one of them was haaretz.com) using my iPad (ios 9.0.1), I clicked on a news and I was redirected to some dodgy website and I started ...
3
votes
1answer
954 views

What can an iOS app tell about you?

We all know while using a new iOS app it might ask for information like location or access to the camera. Those are both features we can deny to the app. There are, however, features apps can access ...
10
votes
0answers
378 views

What unique device fingerprinting information can an iOS8 app collect?

As a follow-on to this question: What unique fingerprinting information can an iOS7 app collect? What remaining device fingerprinting privacy / security vulnerabilities still exist as of iOS 8? Can ...