Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ios]

iOS is Apple's operating system for the iPhone, iPad and iPod Touch.

0
votes
0answers
13 views

Does malware can enter into Iphone or Mac os from chrome/safari in incognito mode [duplicate]

Every day I will open hundreds of websites some of them are SPAM, some of the fake, some sites may have malware content also but I will not download any files from those. After using that sites if I ...
2
votes
0answers
33 views

Is there any way for server side to verify the application integrity during oauth2 workflow

During oauth2 PKCE workflow, the native application(installed on android/ios device) issues the authorize request to server and exchange the oauth tokens. For server side, is there any way that can ...
0
votes
1answer
63 views

Can a 3rd-party iOS 12 app use any of the cameras without the user being aware?

Now with iOS devices having Face ID, there are potentially 3 cameras. But there is only 1 access permission for "Camera" in the Privacy settings. Well-Behaved apps use the camera in conjunction with ...
0
votes
0answers
31 views

Pinning SSL public key

I need to implement SSL pinning for my iOS app. To do this I relied on an open source library called TrustKit (many of you definitely know). Now this library allows me to block public keys for a given ...
0
votes
0answers
53 views

Best Practice to implement Pinning SSL [on hold]

In my app I am implementing Asymmetric encryption, thus obtaining a private key and a public key. The two keys are used to encrypt and decrypt messages exchanged between two users in chat Now I ...
1
vote
1answer
19 views

Read NTFS / EFS encrypted files on iOS with saved certificate

I have data saved on old NTFS-format hard disks which were encrypted on Windows machines, using EFS (the native file encryption system built into Windows). I encrypted selected files/folders, only, ...
0
votes
1answer
32 views

Whether cross cookie sharing between the android apps is potential threat to privacy?

Recently I wanted to buy the particular product from an online website and was just searching that product during my leisure time. after some time suddenly I saw the ad of that product on Instagram ...
2
votes
1answer
74 views

How to Manage Public Key with Asymmetric Cryptography

I'm working on an iOS chat project using Firebase RealTime Database. I want to use asymmetric cryptography for the management of messages between two users .. Browsing the net I found an excellent ...
0
votes
1answer
27 views

Should I back up automatic strong passwords of iCloud?

I’ve recently started to use iCloud’s automatic strong passwords. I feel like that if iCloud were down for some reason, the passwords would be lost. Considering it, should I back them up on other ...
0
votes
0answers
26 views

Native mobile app securely launching another native mobile app

Let's say native mobile apps App1 and App2 from vendors V1 and V2 already exist independently. How would App1 securely launch App2? Both App1 and App2 must operate in the user authentication ...
1
vote
1answer
101 views

Photo vault security

I moved pictures from my stock iOS photos app to an old photo vault app. I used my LTE to move the pictures and was wondering if whenever I opened the app on WiFi, if my school could potentially see ...
10
votes
1answer
143 views

How can faulty version of an iOS app (such as WhatsApp) expose the whole device to crashes or take-over

There was a lot of recent, prominent news about a security vulnerability in WhatsApp that affects also iOS versions of the app. The volnerability has been described as carrying the risk of an attacker ...
1
vote
0answers
45 views

What are the security implications of using an iPhone purchased in China

I recently bought an iPhone off Craigslist, but It's come to my attention that the phone was purchased by it's original owner in China (The model no is: A1528). Are there any security implications if ...
1
vote
1answer
209 views

iOS 12 built in password manager vs third party apps like Keepass

On my personal computers I have always used Keepass2, which however was a bit of a pain to set up with my browser. On my iPhone I have now started to use the built-in password manager (iOS 12 -> ...
1
vote
0answers
266 views

Can an iPhone run two operating systems?

I'm looking for something similar to Virtualbox, but in iOS where each system would be isolated. The content in the virtual environment shouldn't be detectable by the host. (Not restricting answers to ...
0
votes
2answers
90 views

What tests can be performed on mobile apps to determine if they are secure?

My company is looking to work with a potential client's backend provider in order to make an app for them. To do this, we need to use their API. We've spoken to this company and they are worried about ...
3
votes
2answers
109 views

Authenticate user based on mobile device identifier

I have a hypothetical mobile game where players don't necessarily need to create accounts to play. Their data is keyed off of a device identifier like an advertising identifier (IDFA) or Apple's ...
0
votes
1answer
90 views

Is there a way to secure an API key on iOS?

When a user logs in the App, they are given a unique API key (each user's API key will be different). The user uses this API key to make HTTP requests. Currently, the API key is saved in an SQLite ...
2
votes
1answer
69 views

How safe is it to give a device that has malfunctioned to just anyone?

My friend's iPad 2 Air fell to the ground and something malfunctioned and the device stopped working. She took it to a repair shop where they looked at what they could do to fix it. They said if they ...
0
votes
1answer
102 views

Apple iPhone Security

How difficult it would be to install an application that could record users keystrokes on an Apple device, for example, an iPhone X, and send it online without the knowledge of the user.
1
vote
2answers
58 views

At What Point Does A Device Correspond/Link to its Owner?

I am aware that governments, organizations and hackers can do a plethora of things to your device (i.e. track your location, tap calls, etc.), but I can only assume that they can only do these things ...
2
votes
1answer
70 views

Can Apple Devices Give Away Location to Hackers?

In a hypothetical scenario, I am travelling with my iPhone to, let's say, New Zealand. I stop at some random hotel and simply stay there doing nothing but staring at a wall for days with no ...
3
votes
1answer
444 views

Optimal way to capture HTTP(S) traffic on proxy-unaware iOS applications

I am trying to capture HTTP(S) traffic from a proxy-unaware Xamarin iOS application. The current tools I have available is a Mac with a Linux Mint VM, Xcode and iOS developer tools, Burp Suite ...
2
votes
1answer
418 views

Is it secure to use UUID as authentication? [duplicate]

I have an application which uses UUID as an authentication. The UUID is stored as KeyChain inside my iOS application. When I post the UUID, I use https. Is there any way to obtain the password, unless ...
1
vote
0answers
18 views

Does any MDM provide privacy assurances to the end user?

I'm a former network admin who deployed and configured MDM solutions. I recall being able to do things like List all the applications on a device (including 3rd party apps) Get device IP information,...
1
vote
1answer
141 views

Feasibility of persistent iOS malware which survives factory reset

Generally speaking, when an iOS device is purchased, it will be a couple of security updates behind the latest version of iOS. This means that in many cases, out of the box an iOS device will be ...
1
vote
1answer
117 views

Is showing the package name(Android)/bundle ID(ios) a security risk?

Suppose I release an app and accidentally publish the package name/bundle ID of the app which is suppose to be shown in development only, in a page. Is there any security concern that arises from this?...
1
vote
1answer
58 views

Is it possible to get infected by malware from running a foreign Xcode project?

An entrepreneur hired me to build out his mobile app and passed me the Xcode project files. From what I've read and heard about the development agency that built out his beta they're sketchy to say ...
1
vote
0answers
124 views

iOS traffic not shown in proxy when SSL pinning enabled

I have and iOS application to test. As per the latest security fix SSL pinning is enabled in the app. But now I am not able to see any traffic related to the application in my proxy tool. But ...
0
votes
0answers
103 views

Securing mobile app API Using UDID and Argon2

I'm trying to build an iOS app, I have wrote the code and all, and now I am implementing the APIs to communicate with the database. The app will be using HTTPS and POST Requests to communicate with ...
1
vote
1answer
95 views

Shoulder surfing prevention or mitigation for unlocking mobile devices

How can shoulder surfing be prevented or mitigated when unlocking mobile devices? I found other questions about shoulder surfing that focus more on desktop machines, but I believe the issue is much ...
1
vote
2answers
258 views

What is the use of EXE and DLL files on iOS device

I have a doubt regarding iOS application pentest. I am pentesting one iOS application. The application is protected by MDM software. Installation Process - Once I install the MDM on iPhone device ...
0
votes
0answers
23 views

Mobile apps AUTH flow

When the user enters username and password into an mobile app( iOS ,Android or windows app)it calls a thirds party oAuth login web service which responds back with oAuth access token and refresh token....
1
vote
1answer
2k views

How to prevent “JailBreak detection bypass” by Cydia tools such as “Flex 3” etc?

For sensitive mobile apps such as banking applications, it is recommended to detect if the device is JailBroken and prevent the application from working on that device. But there are tools such as "...
2
votes
0answers
83 views

Apple iOS and KRACK

KRACK consist of several vulnerabilities (https://www.kb.cert.org/vuls/id/228519). Apple released patches against CVE-2017-13077, CVE-2017-13078 and CVE-2017-13080 from what I could find in their ...
3
votes
0answers
672 views

What unique device fingerprinting information can an iOS 11 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? What unique device ...
-1
votes
1answer
489 views

How to avoid silent SMS attack?

I am worried about silent SMS being used incorrectly by people. What are the ways on which it can be avoided on Android and iOS?
0
votes
0answers
20 views

Pegasus Stage 1 confusion

I am reading the analysis of pagasus-exploits report and on page 9 where it says after garbage collector deallocates the original arr and the program reallocates a number of uint32Array, it occurs ...
2
votes
1answer
144 views

How can Telegram find my phone number on iOS 11 after uninstall?

I wanted to sign in Telegram on my iPod Touch running iOS 11 with another account. I deleted the app and install it again. On the sign up screen Telegram filled the phone number field with the number ...
2
votes
3answers
495 views

iPhone passcode security

With iOS 11 I was compelled to switch from two-step-verification to two-factor-authentication. This has the implication that somewhere at Apple there is some blackbox that can decide, using my AppleID ...
3
votes
0answers
60 views

Does Apple have access to the cryptographic keys to decrypt Safari Sync Data?

I was reading over iOS's security guide, and it is unclear to me whether Apple can accessed synced Safari data. For example, if Apple received a FISA Order for all information on iCloud on all ...
1
vote
1answer
2k views

How secure is Keepass when using mobile apps

Keepass appears to be very secure, because it is open-source and the code is examined by a lot of independent people. Furthermore the database which holds all passwords is stored wherever the user ...
1
vote
0answers
81 views

How to secure sip/voip server? [closed]

For registration on voip server the standard port is 5060. For security reasons, iptables rules forbade requests for port 5060 from any addresses except one static (customer support). Now the problem ...
0
votes
0answers
198 views

MSF payloads that work for iOS (32 and 64 bit)

I have been using MetaSploit a lot lately, and I know how to make and use pretty much every payload. There is one exception... iOS payloads. I've tried using osx/armle/* payloads, but whenever I do ...
0
votes
2answers
2k views

What does Encryption at REST and HTTPS mean?

What does it mean when apps claim they encrypt at REST and HTTPS? I find this a little difficult to understand how different they are from the rest of the encryption-based Apps.
0
votes
2answers
272 views

VPN profile working in Iphone

I am using a VPN on my iphone https://itunes.apple.com/us/app/hotspot-vpn-free-secure-fast-internet/id1121846465?mt=8 Their privacy policy states that they can get data but doesn't says that will ...
5
votes
2answers
569 views

Should the Payload of Push Notification also be encrypted?

If you have a fully end-end encrypted app, should the push messages sent to the APNS or GCM also be encrypted. The payload only contains message ids, from uid n conversation gid. Is there a major ...
0
votes
1answer
897 views

How does iOS screenshot prevention (ScreenShield by Confide) work under the hood?

Official blog: https://blog.getconfide.com/introducing-screenshield-ios-screenshot-prevention-for-confide-and-beyond-692bbae2c31d More coverage: https://9to5mac.com/2018/01/10/confide-messenger-...
7
votes
1answer
304 views

Why do Android and iOS not let users view wifi passwords?

On Windows, admin users can view saved wifi passwords. I know that by rooting the device, it is possible to view them on Android and iOS, but usually, rooting is simply not an option. So, why don't ...
3
votes
1answer
598 views

iOS : Possible cache DB security issue?

I currently found something interesting when browsing my iPhone app's cache.db file. There is a table called cfurl_cache_receiver_data and there is a column called receiver_data. This contains all ...