Questions tagged [ios]
iOS is Apple's operating system for the iPhone, iPad and iPod Touch.
397
questions
1
vote
0answers
87 views
Stop smartphone microphone from listening in background
Recently it has come to light that tech companies such as Facebook and Microsoft use humans to listen and transcribe audio conversations on Facebook messenger and Skype to improve their AI. However ...
-1
votes
0answers
37 views
How to Scan iPhone Cell, appliances, running iOS with AV? [on hold]
Regarding iOS, appliances, and Cell Phones/Watches, iPads, etc.
How do I scan them with an AV?
2
votes
1answer
83 views
Obfuscating “sensitive” strings in mobile client
We have a client that runs some native (C++) code on both Android and iOS, to mitigate MITM attacks we use certificate pinning.
This means that the binary includes some strings (const char * const ...
0
votes
0answers
69 views
Should I hash responses from server?
I am hashing all requests to my server with a secret token known by only the server and my mobile app to prevent malicious apps from using my servers.
Should I also do this on the responses from the ...
-3
votes
0answers
38 views
How to be sure that my app is my app? [duplicate]
I want to protect my server against someone who would have replicate my iOS application and used the internal http calls, by decompiling or just by some way obtained my source code. I guess It would ...
0
votes
2answers
43 views
CSRF on inter-app communication iOS
How can I make a request from one app to another on iOS and verify the origin of the app request?
Apple used to have an applicationSource sent along with deeplinks, but it's now being deprecated. ...
2
votes
0answers
56 views
Is it a privacy issue that iOS persists private keys between app installs of the same bundle ID?
In iOS apps, Apple goes to a lot of trouble to keep applications from creating a stable identifier for a specific device. For example, in iOS >= 5 they no longer allow apps to get the hardware-tied ...
2
votes
1answer
157 views
Can my G Suite admin see my browsing history if: I am in incognito mode on iPad Chrome?
Can my G suite admin see by browsing history if: I am in incognito mode on iPad Chrome?
iPadOS beta 3.
I'm signed in with a G Suite account.
If they are monitoring me, is it visible? Is there any way ...
0
votes
0answers
46 views
Cycript (Killed: 9 error) on jailbroken ios 11.4
I am doing security research on a jailbroken ios 11.4 using cycript. When attempting to attach to a process using cycript -p <pid>, I get a Killed: 9 error in the console.
Searching online ...
0
votes
0answers
19 views
capturing web-sockets packets from IOS using fiddler
I am using latest Fiddler version trying to capture web-sockets requests from an IOS application.
I am able to see only HTTP and HTTPS requests.
Laptop(Running fiddler on port 8888) and mobile both ...
1
vote
0answers
56 views
Is AWS Cognito vulnerable to MITM when using iOS with Lambda and RDS
I'm a bit new to coding backend services. And I'm not sure how to solve this problem.
So users in an iOS app can be authenticated with Cognito and afterwards gain the rights to invoke lambda ...
0
votes
0answers
48 views
How does Google restrict API access by mobile App ID?
Google Cloud Platform API service has an option to restrict API access to specified iOS bundle identifiers.
How is Google able to accomplish that since any mobile clients can easily spoof the bundle ...
0
votes
0answers
49 views
Would iCloud data “cross-contaminate” Google account?
Sorry for asking such “wild” sounding question.
Basically, iCloud can be allowed to sync bookmarks to Google Chrome browser through iCloud Windows application. And most of the time, your Chrome ...
-1
votes
1answer
82 views
Is Spyzie a scam that allows people to pull data from iCloud?
Came across a iOS tracking software called “Spyzie” which allows parents to monitor kids’ data usage including call logs, messages, browsing and many more.
One of the key feature this software raises ...
2
votes
1answer
89 views
Encrypting mobile user data in event of PIN/device compromise
As I understand it, modern mobile OS's often encrypt app data when a device is locked with a pin or password. However, how do I protect users if their device or pin has been compromised?
If I ...
1
vote
2answers
191 views
How to completely destroyed all data from an iPhone before reselling it?
I would wish to know more about how to erase 100% data of a used iPhone.
Basically, technician from Apple Store only said “Erase & Clear” within the iPhone setting could do all the work perfectly ...
0
votes
0answers
48 views
Are there any known instances of Apple iOS exploits that can remotely install malware on a device unauthenticated?
Title.
Are there any known instances of exploits targeting iOS (versions 11 and later) with the following characteristics?:
Allows remote, unauthenticated installation of malware on the device. ...
0
votes
0answers
31 views
What to tamper the universal links in iOS? is possible to do?
I have created my app and website with universal links implementation such as /apple-app-site-association and applinks:<domainname>.
Now I would like to ensure security param tampering and ...
3
votes
1answer
226 views
What unique device fingerprinting information can an iOS 12 or iOS 13 app collect?
As a follow-on to these questions:
What unique fingerprinting information can an iOS7 app collect?
What unique device fingerprinting information can an iOS8 app collect?
What unique device ...
0
votes
0answers
42 views
Checking authenticity of a mobile app (digital staff card) [duplicate]
I've been asked to implement a digital card for member's of our organisation, to replace the old plastic ones. Members would install our app on their phone and setup a "card" with their photo on it ...
0
votes
1answer
26 views
BundleID of an iOS Application installed on iOS 10.2.1
I'm fairly new to iOS Security and was trying to obtain the BundleID of the applications installed on my jailbroken iOS Device (10.2.1).
I tried using both Appster and BundleIDs but both failed to ...
3
votes
1answer
111 views
Is copying passwords to iOS clipboard secure?
Since apps on iOS can access the clipboard should I worry about it when copying passwords from the keychain?
I do that when AutoFill feature doesn't work so I would not have to manually retype ...
1
vote
0answers
51 views
How can Apple allow all my devices to use iMessages without the key leaving my phone?
This question is related but different to this question.
Apple says that all iMessages are end-to-end encrypted, but how can a newly enrolled apple laptop read my phone's iMessages that were sent ...
0
votes
0answers
105 views
How to create an anonymous user account like the app Day-One does?
A new iOS app should be able to connect to a web service to sync data across devices. I like the way the diary app Day One solved this by offering "real" user accounts and automatically generated "...
1
vote
1answer
208 views
Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?
I'm analysing an iOS application and its communications through Charles.
I have access to most of SSL communications but not all, due to certificate pinning.
I know that there are many different ways ...
0
votes
0answers
62 views
iOS Security Architecture-Encryption Keys
As per iOS Security 12.1 documentation(Page-15), there are individual UID and GID for each processing unit i.e AP(Application Processor) and Secure Enclave.
The application processor and Secure ...
0
votes
1answer
63 views
Can a self-root certificate spy on me without a vpn or proxy on iOS?
Can a self-root certificate (implemented via mobile configuration) spy on me without a VPN or proxy on iOS?
4
votes
1answer
179 views
How should I use Facebook while giving as little information as possible?
As a college student, Facebook and Messenger are virtually necessary to have in my life for communicating with clubs, classmates, finding housing, and more. As much as I want to get rid of them, it's ...
1
vote
0answers
104 views
Can mobile service providers use my iPhone's microphone to listen even when I'm not on a call?
So is this technically possible? Basically can the service provider somehow hack into my phone and use the microphone to hear the surrounding of my phone if they somehow have a backdoor/malicious code ...
11
votes
2answers
229 views
Is there always a user notification when smartphones record audio?
Background: With microphones being embedded in all sorts of consumer electronics, there is widespread concern that certain actors (e.g. device manufacturers, ecosystem providers, third-party apps) ...
0
votes
1answer
58 views
Is it safe to just forget OAuth tokens, and not invalidate them in a mobile app?
I have a mobile application that a user signs into using OpenId Connect and OAuth 2.0. Currently when the user logs out, I open up a webpage to the end_session_endpoint (http://docs.identityserver.io/...
1
vote
1answer
140 views
What is a spinner (empty while loop) doing, and why?
I've seen that in the latest iOS jailbreak, they use so called "spinners". What exactly is a spinner doing? And why?
Apparently it's "blocking the thread execution", but why does the exploit need ...
0
votes
0answers
91 views
Store Credit Card data in memory for using with native payment SDKs (iOS, Android)
I am implementing a Credit Card processing in mobile apps for iOS (Swift) and Android (Kotlin) using native SDK (SAQ A EP compliance level)
We thought about:
disabling clipboard for CC field
...
3
votes
1answer
156 views
Is storing information in RAM more secure than on Disk?
I realize neither is foolproof, of course. I would just like to confirm my thought that it's harder for an attacker to get a memory dump than to copy from disk/flash-storage or that malware just tends ...
1
vote
3answers
303 views
How can I detect spyware on a smartphone
I'm pretty sure there is spyware on my friend's phone deployed there by her ex. She asked me to find a proof and detect it. I usually sniff my network card with Wireshark to detect such spyware and ...
0
votes
0answers
34 views
Enterprise Mobile Application Security Options?
Background: Recently we've joined one of the biggest data-driven company. Till now we do not have any mobile developer/architect within company. Now business wants to develop mobile applications for ...
1
vote
0answers
151 views
Fuzzing of Mobile Applications
I have used AFL recently for fuzzing of OpenSSL and it worked great. Now I am interesting in fuzzing mobile applications like I have got some .apk and .ipa files which I need to fuzz.
I searched on ...
1
vote
0answers
44 views
Is there a way to refuse Process Hooking on jailbroken iOS devices
I want to find a way to prevent apps from Cycript attaching. So far I know Cycript works as below, but I can not find a way to stop Cycript.
One method to stop injection is to add -Wl,-sectcreate,...
1
vote
2answers
142 views
What is technically different from iPhone/iOS to Android phones when it comes to data privacy?
Historically Apple never shows up at CES, and this year they put up the following ad close to the convention center:
There is always this argument that Apple has better privacy policies in it's ...
3
votes
1answer
158 views
Is there any way for server side to verify the application integrity during OAuth2 workflow
During OAuth2 PKCE workflow, the native application (installed on Android/iOS device) issues the authorize request to server and exchange the OAuthtokens.
For server side, is there any way that we ...
0
votes
1answer
98 views
Can a 3rd-party iOS 12 app use any of the cameras without the user being aware?
Now with iOS devices having Face ID, there are potentially 3 cameras. But there is only 1 access permission for "Camera" in the Privacy settings.
Well-Behaved apps use the camera in conjunction with ...
1
vote
1answer
71 views
Read NTFS / EFS encrypted files on iOS with saved certificate
I have data saved on old NTFS-format hard disks which were encrypted on Windows machines, using EFS (the native file encryption system built into Windows). I encrypted selected files/folders, only, ...
0
votes
1answer
78 views
Whether cross cookie sharing between the android apps is potential threat to privacy?
Recently I wanted to buy the particular product from an online website and was just searching that product during my leisure time. after some time suddenly I saw the ad of that product on Instagram ...
2
votes
1answer
92 views
How to Manage Public Key with Asymmetric Cryptography
I'm working on an iOS chat project using Firebase RealTime Database.
I want to use asymmetric cryptography for the management of messages between two users ..
Browsing the net I found an excellent ...
0
votes
2answers
74 views
Should I back up automatic strong passwords of iCloud?
I’ve recently started to use iCloud’s automatic strong passwords. I feel like that if iCloud were down for some reason, the passwords would be lost. Considering it, should I back them up on other ...
1
vote
1answer
142 views
Photo vault security
I moved pictures from my stock iOS photos app to an old photo vault app. I used my LTE to move the pictures and was wondering if whenever I opened the app on WiFi, if my school could potentially see ...
10
votes
1answer
159 views
How can faulty version of an iOS app (such as WhatsApp) expose the whole device to crashes or take-over
There was a lot of recent, prominent news about a security vulnerability in WhatsApp that affects also iOS versions of the app. The volnerability has been described as carrying the risk of an attacker ...
1
vote
0answers
59 views
What are the security implications of using an iPhone purchased in China
I recently bought an iPhone off Craigslist, but It's come to my attention that the phone was purchased by it's original owner in China (The model no is: A1528). Are there any security implications if ...
1
vote
1answer
827 views
iOS 12 built in password manager vs third party apps like Keepass
On my personal computers I have always used Keepass2, which however was a bit of a pain to set up with my browser. On my iPhone I have now started to use the built-in password manager (iOS 12 -> ...
2
votes
0answers
351 views
Can an iPhone run two operating systems?
I'm looking for something similar to Virtualbox, but in iOS where each system would be isolated. The content in the virtual environment shouldn't be detectable by the host. (Not restricting answers to ...
