iOS is Apple's operating system for the iPhone, iPad and iPod Touch.

learn more… | top users | synonyms (1)

7
votes
3answers
7k views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
3
votes
1answer
620 views

What unique fingerprinting information can an iOS7 app collect?

I'm interested in unique information that is beyond typical user knowledge or control. As of iOS 7, users can easily protect local physical tracking by controlling radios (cell, WiFi, Bluetooth) in ...
7
votes
4answers
2k views

How effective is iPhone 3GS and 4 device-at-rest encryption?

My primary goal is to protect Activesync-based communication from being copied or stolen from an offline device. In that context how effective is iPhone 3GS and 4 encryption?
1
vote
0answers
140 views

What unique device fingerprinting information can an iOS9 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? Apple has apparently ...
28
votes
1answer
7k views

iOS Encryption Details

Following on from this question, what resources are available relating to the technical specifics of how apple implement encryption on their iOS 4.x series devices? The Apple marketing material here, ...
11
votes
3answers
4k views

iOS/Android Pen-Test

This question might be vague, that is because I am not sure where to start. There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...
7
votes
0answers
319 views

What unique device fingerprinting information can an iOS8 app collect?

As a follow-on to this question: What unique fingerprinting information can an iOS7 app collect? What remaining device fingerprinting privacy / security vulnerabilities still exist as of iOS 8? Can ...
2
votes
1answer
198 views

What data is not encrypted in iOS 8+ when “locked”

Scenario: iPhone 5+ with iOS 8+ with system encryption enabled. The phone is on and locked. (the user has authenticated (unlocked phone) at least once since power-up, and then relocked). What ...
11
votes
2answers
168 views

Does Centralisation Decrease the Probability but Increase the Damage of Exploits?

This question is, perhaps, a tad too abstract for a Q&A site. But it's been playing on my mind for a while, so I'm throwing it out there. Modern systems seem to be increasingly centralised. An ...
10
votes
8answers
766 views

iPhone Tracking debacle - risks and countermeasures

For those of you who are not familiar with the topic, a quick search will turn up a lot of hits, e.g. see the researcher's report at Got an iPhone or 3G iPad? Apple is recording your moves - O'Reilly ...
0
votes
3answers
89 views

What footprint iOS or Android App leaves? and how to change it

I've read some place that each phone and/or sim leaves some kind of footprints when it uses a social app (Google, Instagram etc.). I would like to stay anonymous or at least blend in with the crowd. ...
4
votes
2answers
775 views

How secure is the private storage of a mobile app

Are there any know security flaws/hacks to gain access to the private storage(file system or SQLite database) of Android and iOS applications? What measures do Google and Apple take to "prevent" ...
14
votes
2answers
6k views

Is Apple's push notification service implementation vulnerable to a MitM attack

Recently(more info) I've spotted a strange message in the logs on my quite recent, fresh installation of OS X Mavericks 10.9.2 Apr 27 15:26:47 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf ...
6
votes
2answers
3k views

Accessing iPhone data without passcode - how difficult?

I use iOS7 with a 4-digit passcode that isn't on any top 10 lists. I have "Erase all data after 10 failed passcode attempts" turned on. How hard would it be for someone who stole my phone to get ...
6
votes
1answer
2k views

Is there cryptographic material in a phone's SIM card that can be used with RSA encryption?

Given that a smart card stores a private key that can't be extracted, it appears that a SIM card is similar to a smart card in these respects. I need to store (or use an existing) private key on a ...
11
votes
5answers
2k views

Best practices for securing an iPhone

As this question on voicemail protection got answers veering more to protecting the mobile phone, I thought I should add a specific question on this topic. There is already a question on protecting ...
4
votes
1answer
383 views

Data remanence on mobile devices

The methods in which data should be deleted is strictly enforced by the DoD as well as others security sensitive organizations. However, there are complications with deleting data on an SSD. Given ...
3
votes
2answers
691 views

IPhone iOS 8.3 encryption security against physical access

NB: While you are free to answer this question, there is a more specific discussion here Excerpt from Apple's Whitepaper "iOS Security" on Effaceable Storage: A dedicated area of NAND storage, ...
6
votes
2answers
5k views

iPhone full disk encryption and theft protection?

Is it possible to fully encrypt an iPhone? What cipher does it use and are there any weaknesses? How can I protect my valuable data, such as email, when my iPhone gets stolen?
4
votes
2answers
591 views

Is Google API Key a sensitive information that needs to be protected?

I'm making use of google API for location (in Android, iOS apps).. Can the key be hardcoded? Or should it be protected? If It's sensitive, why is it sensitive and how can attackers exploit this?
3
votes
3answers
433 views

What are the best practices for maintaining privacy on a non-jailbroken iOS device?

iOS, like most other mobile OSs, has the potential to leak significant chunks of personal information to 3rd-party apps and to ad and tracking networks used by those apps, which in turn also has the ...
2
votes
2answers
663 views

Can an employer see cellular network traffic routed through company-owned device?

When on the road, I have a company issued iPad with Verizon service, my personal ipad (wifi only version), and my iPhone. If I turn on the hotspot on my company iPad, then connect my personal ...
1
vote
1answer
431 views

Secure socket communication between iOS device and 3rd party server

I'd like your advice on what is the best approach for the challenge in my hands... I'm developing an extension to a 3rd party software. I'm doing my development using Python/Twisted/Autobahn. The end ...
3
votes
2answers
194 views

iOS Unicode Notification Bug

Evidently, someone has discovered a Unicode bug in iOS, where if an app receives a specific Unicode sequence (infinitely-repeating Unicode code point), the OS will kill the Springboard as it allocates ...
1
vote
0answers
140 views

FIPS Compliance with iOS app

Our company is working on getting FIPS validation for the iOS app and is in the initial phase. We have decided to use a private FIPS-certified libraries for using in the crypto modules. I have some ...