Questions tagged [ios]
iOS is Apple's operating system for the iPhone, iPad and iPod Touch.
2
votes
1answer
61 views
Is copying passwords to iOS clipboard secure?
Since apps on iOS can access the clipboard should I worry about it when copying passwords from the keychain?
I do that when AutoFill feature doesn't work so I would not have to manually retype ...
1
vote
0answers
45 views
How can Apple allow all my devices to use iMessages without the key leaving my phone?
This question is related but different to this question.
Apple says that all iMessages are end-to-end encrypted, but how can a newly enrolled apple laptop read my phone's iMessages that were sent ...
0
votes
0answers
38 views
How to create an anonymous user account like the app Day-One does?
A new iOS app should be able to connect to a web service to sync data across devices. I like the way the diary app Day One solved this by offering "real" user accounts and automatically generated "...
1
vote
1answer
86 views
Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?
I'm analysing an iOS application and its communications through Charles.
I have access to most of SSL communications but not all, due to certificate pinning.
I know that there are many different ways ...
0
votes
0answers
52 views
iOS Security Architecture-Encryption Keys
As per iOS Security 12.1 documentation(Page-15), there are individual UID and GID for each processing unit i.e AP(Application Processor) and Secure Enclave.
The application processor and Secure ...
0
votes
1answer
49 views
Can a self-root certificate spy on me without a vpn or proxy on iOS?
Can a self-root certificate (implemented via mobile configuration) spy on me without a VPN or proxy on iOS?
4
votes
1answer
163 views
How should I use Facebook while giving as little information as possible?
As a college student, Facebook and Messenger are virtually necessary to have in my life for communicating with clubs, classmates, finding housing, and more. As much as I want to get rid of them, it's ...
1
vote
0answers
84 views
Can mobile service providers use my iPhone's microphone to listen even when I'm not on a call?
So is this technically possible? Basically can the service provider somehow hack into my phone and use the microphone to hear the surrounding of my phone if they somehow have a backdoor/malicious code ...
11
votes
2answers
212 views
Is there always a user notification when smartphones record audio?
Background: With microphones being embedded in all sorts of consumer electronics, there is widespread concern that certain actors (e.g. device manufacturers, ecosystem providers, third-party apps) ...
0
votes
1answer
54 views
Is it safe to just forget OAuth tokens, and not invalidate them in a mobile app?
I have a mobile application that a user signs into using OpenId Connect and OAuth 2.0. Currently when the user logs out, I open up a webpage to the end_session_endpoint (http://docs.identityserver.io/...
1
vote
1answer
134 views
What is a spinner (empty while loop) doing, and why?
I've seen that in the latest iOS jailbreak, they use so called "spinners". What exactly is a spinner doing? And why?
Apparently it's "blocking the thread execution", but why does the exploit need ...
0
votes
0answers
69 views
Store Credit Card data in memory for using with native payment SDKs (iOS, Android)
I am implementing a Credit Card processing in mobile apps for iOS (Swift) and Android (Kotlin) using native SDK (SAQ A EP compliance level)
We thought about:
disabling clipboard for CC field
...
3
votes
1answer
152 views
Is storing information in RAM more secure than on Disk?
I realize neither is foolproof, of course. I would just like to confirm my thought that it's harder for an attacker to get a memory dump than to copy from disk/flash-storage or that malware just tends ...
1
vote
3answers
173 views
How can I detect spyware on a smartphone
I'm pretty sure there is spyware on my friend's phone deployed there by her ex. She asked me to find a proof and detect it. I usually sniff my network card with Wireshark to detect such spyware and ...
0
votes
0answers
28 views
Enterprise Mobile Application Security Options?
Background: Recently we've joined one of the biggest data-driven company. Till now we do not have any mobile developer/architect within company. Now business wants to develop mobile applications for ...
1
vote
0answers
102 views
Fuzzing of Mobile Applications
I have used AFL recently for fuzzing of OpenSSL and it worked great. Now I am interesting in fuzzing mobile applications like I have got some .apk and .ipa files which I need to fuzz.
I searched on ...
1
vote
0answers
28 views
Is there a way to refuse Process Hooking on jailbroken iOS devices
I want to find a way to prevent apps from Cycript attaching. So far I know Cycript works as below, but I can not find a way to stop Cycript.
One method to stop injection is to add -Wl,-sectcreate,...
1
vote
2answers
113 views
What is technically different from iPhone/iOS to Android phones when it comes to data privacy?
Historically Apple never shows up at CES, and this year they put up the following ad close to the convention center:
There is always this argument that Apple has better privacy policies in it's ...
3
votes
1answer
115 views
Is there any way for server side to verify the application integrity during OAuth2 workflow
During OAuth2 PKCE workflow, the native application (installed on Android/iOS device) issues the authorize request to server and exchange the OAuthtokens.
For server side, is there any way that we ...
0
votes
1answer
93 views
Can a 3rd-party iOS 12 app use any of the cameras without the user being aware?
Now with iOS devices having Face ID, there are potentially 3 cameras. But there is only 1 access permission for "Camera" in the Privacy settings.
Well-Behaved apps use the camera in conjunction with ...
1
vote
1answer
44 views
Read NTFS / EFS encrypted files on iOS with saved certificate
I have data saved on old NTFS-format hard disks which were encrypted on Windows machines, using EFS (the native file encryption system built into Windows). I encrypted selected files/folders, only, ...
0
votes
1answer
47 views
Whether cross cookie sharing between the android apps is potential threat to privacy?
Recently I wanted to buy the particular product from an online website and was just searching that product during my leisure time. after some time suddenly I saw the ad of that product on Instagram ...
2
votes
1answer
85 views
How to Manage Public Key with Asymmetric Cryptography
I'm working on an iOS chat project using Firebase RealTime Database.
I want to use asymmetric cryptography for the management of messages between two users ..
Browsing the net I found an excellent ...
0
votes
2answers
63 views
Should I back up automatic strong passwords of iCloud?
I’ve recently started to use iCloud’s automatic strong passwords. I feel like that if iCloud were down for some reason, the passwords would be lost. Considering it, should I back them up on other ...
1
vote
1answer
121 views
Photo vault security
I moved pictures from my stock iOS photos app to an old photo vault app. I used my LTE to move the pictures and was wondering if whenever I opened the app on WiFi, if my school could potentially see ...
10
votes
1answer
152 views
How can faulty version of an iOS app (such as WhatsApp) expose the whole device to crashes or take-over
There was a lot of recent, prominent news about a security vulnerability in WhatsApp that affects also iOS versions of the app. The volnerability has been described as carrying the risk of an attacker ...
1
vote
0answers
52 views
What are the security implications of using an iPhone purchased in China
I recently bought an iPhone off Craigslist, but It's come to my attention that the phone was purchased by it's original owner in China (The model no is: A1528). Are there any security implications if ...
1
vote
1answer
669 views
iOS 12 built in password manager vs third party apps like Keepass
On my personal computers I have always used Keepass2, which however was a bit of a pain to set up with my browser. On my iPhone I have now started to use the built-in password manager (iOS 12 -> ...
1
vote
0answers
276 views
Can an iPhone run two operating systems?
I'm looking for something similar to Virtualbox, but in iOS where each system would be isolated. The content in the virtual environment shouldn't be detectable by the host. (Not restricting answers to ...
0
votes
2answers
100 views
What tests can be performed on mobile apps to determine if they are secure?
My company is looking to work with a potential client's backend provider in order to make an app for them. To do this, we need to use their API. We've spoken to this company and they are worried about ...
3
votes
2answers
347 views
Authenticate user based on mobile device identifier
I have a hypothetical mobile game where players don't necessarily need to create accounts to play. Their data is keyed off of a device identifier like an advertising identifier (IDFA) or Apple's ...
0
votes
1answer
406 views
Is there a way to secure an API key on iOS?
When a user logs in the App, they are given a unique API key (each user's API key will be different). The user uses this API key to make HTTP requests. Currently, the API key is saved in an SQLite ...
2
votes
1answer
69 views
How safe is it to give a device that has malfunctioned to just anyone?
My friend's iPad 2 Air fell to the ground and something malfunctioned and the device stopped working. She took it to a repair shop where they looked at what they could do to fix it. They said if they ...
0
votes
1answer
134 views
Apple iPhone Security
How difficult it would be to install an application that could record users keystrokes on an Apple device, for example, an iPhone X, and send it online without the knowledge of the user.
1
vote
2answers
62 views
At What Point Does A Device Correspond/Link to its Owner?
I am aware that governments, organizations and hackers can do a plethora of things to your device (i.e. track your location, tap calls, etc.), but I can only assume that they can only do these things ...
2
votes
1answer
77 views
Can Apple Devices Give Away Location to Hackers?
In a hypothetical scenario, I am travelling with my iPhone to, let's say, New Zealand. I stop at some random hotel and simply stay there doing nothing but staring at a wall for days with no ...
3
votes
1answer
1k views
Optimal way to capture HTTP(S) traffic on proxy-unaware iOS applications
I am trying to capture HTTP(S) traffic from a proxy-unaware Xamarin iOS application. The current tools I have available is a Mac with a Linux Mint VM, Xcode and iOS developer tools, Burp Suite ...
2
votes
1answer
1k views
Is it secure to use UUID as authentication? [duplicate]
I have an application which uses UUID as an authentication. The UUID is stored as KeyChain inside my iOS application. When I post the UUID, I use https. Is there any way to obtain the password, unless ...
1
vote
0answers
20 views
Does any MDM provide privacy assurances to the end user?
I'm a former network admin who deployed and configured MDM solutions. I recall being able to do things like
List all the applications on a device (including 3rd party apps)
Get device IP information,...
1
vote
1answer
188 views
Feasibility of persistent iOS malware which survives factory reset
Generally speaking, when an iOS device is purchased, it will be a couple of security updates behind the latest version of iOS. This means that in many cases, out of the box an iOS device will be ...
1
vote
1answer
132 views
Is showing the package name(Android)/bundle ID(ios) a security risk?
Suppose I release an app and accidentally publish the package name/bundle ID of the app which is suppose to be shown in development only, in a page. Is there any security concern that arises from this?...
1
vote
1answer
68 views
Is it possible to get infected by malware from running a foreign Xcode project?
An entrepreneur hired me to build out his mobile app and passed me the Xcode project files. From what I've read and heard about the development agency that built out his beta they're sketchy to say ...
1
vote
1answer
217 views
iOS traffic not shown in proxy when SSL pinning enabled
I have and iOS application to test. As per the latest security fix SSL pinning is enabled in the app. But now I am not able to see any traffic related to the application in my proxy tool. But ...
0
votes
0answers
136 views
Securing mobile app API Using UDID and Argon2
I'm trying to build an iOS app, I have wrote the code and all, and now I am implementing the APIs to communicate with the database.
The app will be using HTTPS and POST Requests to communicate with ...
1
vote
1answer
135 views
Shoulder surfing prevention or mitigation for unlocking mobile devices
How can shoulder surfing be prevented or mitigated when unlocking mobile devices?
I found other questions about shoulder surfing that focus more on desktop machines, but I believe the issue is much ...
1
vote
2answers
336 views
What is the use of EXE and DLL files on iOS device
I have a doubt regarding iOS application pentest.
I am pentesting one iOS application. The application is protected by MDM software.
Installation Process - Once I install the MDM on iPhone device ...
1
vote
1answer
3k views
How to prevent “JailBreak detection bypass” by Cydia tools such as “Flex 3” etc?
For sensitive mobile apps such as banking applications, it is recommended to detect if the device is JailBroken and prevent the application from working on that device.
But there are tools such as "...
2
votes
0answers
87 views
Apple iOS and KRACK
KRACK consist of several vulnerabilities (https://www.kb.cert.org/vuls/id/228519). Apple released patches against CVE-2017-13077, CVE-2017-13078 and CVE-2017-13080 from what I could find in their ...
4
votes
0answers
1k views
What unique device fingerprinting information can an iOS 11 app collect?
As a follow-on to these questions:
What unique fingerprinting information can an iOS7 app collect?
What unique device fingerprinting information can an iOS8 app collect?
What unique device ...
-1
votes
1answer
608 views
How to avoid silent SMS attack?
I am worried about silent SMS being used incorrectly by people. What are the ways on which it can be avoided on Android and iOS?
