Hot answers tagged

16

I am trying to mitigate SSL bypassing on a jailbroken iOS. ... My application handles confidential data so securing from SSL kill switch and mobile substrate is necessary. There is nothing to mitigate here. SSL is only used for transport level security, that is to protect everything between the client and the server. It is not used to protect the data ...


7

The issues are mostly the same as for secure software development in general. Note that the most critical issue for secure software development is (1) integrating security into your software development lifecycle (so security is integrated into each step of the process: design, implementation, maintenance, ops), and (2) training of developers. It is a ...


5

If the device is jailbroken, then you have already lost. You cannot trust a jailbroken system. You can make an effort to detect the jailbreak and then refuse to run. But none of these detection methods are foolproof. Because, well, you cannot trust a jailbroken system. Further reading: Questions about (detecting) Jailbreaks: ...


3

You can do this by setting kSecAttrTokenID to kSecAttrTokenIDSecureEnclave when generating the key. According to the documentation (which consists of some comments in SecItem.h), the only kinds of keys the secure enclave can store are elliptic curve secp256r1 keys. You can't put RSA keys there, for example.


2

Apple themselves use 256-bit AES for their apps, but you can choose from AES, RC4, or 3DES in a variety of key lengths. See Apple's Certificate, Key, and Trust Services Reference and Cryptographic Services Guide


2

Quite a few things have been published since the question was asked back in January, including: ENISA Smartphone Secure Development Guidelines for App Developers viaForensics Secure Mobile Development Best Practices (you need to register to download the PDF version) W3C Mobile Web Application Best Practices: W3C Recommendation 14 December 2010 Denim Group: ...


2

I am not aware of any, but I also don't think its needed. The mobile platform is nothing new. At the end of the day a lot of the same vulnerabilities affect this platform. A lot of mobile apps are just web applications where the client side of the code is written entirely in HTML/JavaScript. That being said Mobile developers violate CWE-602 more than ...


2

The secure element is not exposed to developers, and likely requires a custom entitlement in the App Store / App review process that isn't given out


1

OCLint works on Linux and OSX. It doesn't focus on security, but integrates with Clang, a static code analyser to do style and security at the same time. Of course, if you don't care about style you can just use Clang to begin with! But if your code is tidy and readable, your security reviews will be a little less painful. Agnito also scans objective-C, and ...



Only top voted, non community-wiki answers of a minimum length are eligible