iOS is Apple's operating system for the iPhone, iPad and iPod Touch.
0
votes
1answer
32 views
Protecting the remote database against tampering in a mobile app
This is the first time I face a mobile app deployment at big scale. This app needs to connect to a remote server where to store and retrieve data.
I discarded connecting directly to the MySQL ...
1
vote
1answer
31 views
Is Google API Key a sensitive information that needs to be protected?
I'm making use of google API for location (in Android, iOS apps).. Can the key be hardcoded? Or should it be protected? If It's sensitive, why is it sensitive and how can attackers exploit this?
1
vote
1answer
54 views
Does using Chrome bypass the Apple iOS gotofail bug ?
Does the recent certificate gotofail bug affect me if I'm running version 6 of iOS, but only use Chrome as my browser?
0
votes
3answers
37 views
Restrict request to Android and Iphone App only?
I have a ASP.NET/IIS server. I want to restrict my server to only accept request from Android and Iphone(IOS) applications. I have heard about HMAC. Can HMAC help me?
-2
votes
1answer
43 views
Cross-checking Driver's License Against DMV Using MySQL DB or PHP Script? [closed]
Ok, so I am coming into this a little blind on how to go about allowing this app to store and check one's driver's license ID against the DMV or some other government agency. Basically, everything ...
0
votes
1answer
49 views
Zeus for iOS devices
Is there a known variant of Zeus which attacks iOS based mobile devices?
I have read about versions for Android and Symbian , wondering if iOS is vulnerable to it as well.
1
vote
1answer
56 views
What unique fingerprinting information can an iOS7 app collect?
I'm interested in unique information that is beyond typical user knowledge or control.
As of iOS 7, users can easily protect local physical tracking by controlling radios (cell, WiFi, Bluetooth) in ...
2
votes
1answer
85 views
Detection of function hooking in iOS
So far as I know, in iOS there are three techniques of function hooking:
preload library using DYLD_INSERT_LIBRARIES
imported symbol table redirection using fishhook
patch the functions when they ...
0
votes
0answers
76 views
Implementation of different BCrypt versions
I'm fairly new to encryption, and I am investigating the different kind of encryptions. I want to encrypt passwords in a secure way. I discussed this with my colleague, and he said that BCrypt is the ...
0
votes
1answer
221 views
iOS: sandbox of an iphone app
I am new to iOS so I do have only limited knowledge about iOS in general. For self learning purposes, I would like to know several things as I am quite confused after searching the web.
I do know ...
3
votes
2answers
158 views
How secure is the private storage of a mobile app
Are there any know security flaws/hacks to gain access to the private storage(file system or SQLite database) of Android and iOS applications?
What measures do Google and Apple take to "prevent" ...
0
votes
1answer
155 views
Security: Oauth and Mobile apps
This is what I believe are the security implications of integrating Oauth using embedded webview vs browser in mobile application.
Embedded Webview
* Keep UI for mobile app
Security implications
...
3
votes
2answers
444 views
How reliable are device IDs provided by PhoneGap on Android and iOS?
I have a web application that allows users to add mobile devices to their accounts (using mobile app).
Each device is uniquely referenced by its UUID. Mobile client is developed using PhoneGap, so ...
1
vote
1answer
134 views
How is the iOS KeyChain master key derived?
I'm no expert but I'm assuming that on OSX it's derived from the user account password. I'm more than open to the possibility of that being incorrect.
On iOS there is no user account password, only a ...
3
votes
1answer
175 views
How Secure Rooted or Jailbroken Devices are?
I am just wondering, but how can I harden the security of jailbroken or rooted devices? I understand that SD Card can be still accessible, but how could potential adversaries compromise for example ...
2
votes
1answer
345 views
How safe is the new iOS Keychain that stores credit card numbers?
iOS7 includes iCloud Keychain which syncs your stored passwords across devices. Not only that but it also syncs credit card numbers.
The only information I can find about encryption is that they are ...
5
votes
2answers
871 views
How effective is the iOS “Send All Traffic to VPN” setting at deterring Wifi-based attacks?
iOS version 5 and newer has a setting for VPNs to "Send All Traffic" over that VPN. I think that sending all data to a trusted VPN target would ensure privacy of all communication sent over that WiFi ...
2
votes
1answer
2k views
How does Activesync security policy affect the usage of the iOS fingerprint scanner?
An Activesync IT administrator has the ability to choose if the phone should require a password, and also how complex it should be.
Since the fingerprint scanner appears to replace the traditional ...
3
votes
2answers
345 views
Are kiosk-style, full screen apps possible on iOS, Android, or Windows phone?
A popular car insurance company in the US has an app that displays "digital car insurance" papers. In the commercials, these apps are opened, and the user gives the unlocked phone to police officers. ...
4
votes
1answer
293 views
What iOS apps use data protection?
The iOS data protection API and its implementation are fairly well documented, but it is only really useful if apps actually use some level other than NSFileProtectionNone for their files.
Is there ...
-1
votes
1answer
50 views
Level of Data Security in iOS [closed]
How secure is the data stored on iOS devices, specifically app data like notes, pictures, etc.? Are there any ways to make it more secure?
2
votes
0answers
152 views
iCloud backup - which keys are transferred to Apple?
The iOS data protection implementation and the implementation of iTunes backups are both reasonably well documented, on a high level by by apple, and much more detailed by third parties.
However, I'm ...
4
votes
1answer
222 views
iOS data protection: Who decrypts files transferred over USB?
I'm trying to understand an implementation detail of Apple's data protection in iOS: I know about the per-file encryption and the various key encryption classes and keybags; however, I don't ...
3
votes
0answers
270 views
Storing session key for iOS app
For an iOS app that communicates with a RESTful service over HTTPS, should the session key be stored in Keychain or NSUserDefaults? Username and password are stored in Keychain, and it would seem ...
9
votes
2answers
146 views
Does Centralisation Decrease the Probability but Increase the Damage of Exploits?
This question is, perhaps, a tad too abstract for a Q&A site. But it's been playing on my mind for a while, so I'm throwing it out there.
Modern systems seem to be increasingly centralised. An ...
1
vote
1answer
209 views
Using Apple NSKeyedArchiver class without encryption to save score data locally
first of all I'm sorry for my bad English!
I have a question about the security of NSKeyedArchiver, a subclass of NSCoder of Apple Foundation.framework ...
0
votes
1answer
174 views
What process on my jail broken iPhone is listening on port 80 [closed]
I can access it via telnet from the internet once I get the IP of my phone
Probably an HTTP server
telnet XXXX 80
Trying XXXX...
Connected to XXXX.
Escape character is '^]'.
HELP
...
1
vote
1answer
60 views
Starting point for Mobile Device Security particularly in a MDM setting?
I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
6
votes
2answers
169 views
Security precautions for shared iPads in a customer facing corporate environment
Most tablets, and iPads in particular, are typically single user devices.
Scenario: A service business that interacts directly with customers in person and wants to use iPads while interacting with ...
5
votes
1answer
310 views
Distributing API Keys to Mobile Apps
I'm currently developing a mobile app (iOS based initially) that consumes multiple APIs. Currently we're storing API keys as strings in the the prefix header file, and initializing most of the APIs ...
3
votes
1answer
699 views
Secure erase iOS devices
All iOS devices from the iPhone 3GS have a hardware encryption chip, right?
When you erase an iOS device with the "Erase All Content and Settings" menu item or via Remote Wipe the encryption keys are ...
7
votes
2answers
354 views
Is it safe to sync private keys between iOS devices using iCloud?
My iOS app has to handle storing private keys for the user. Normally I would just use Keychain Services for this as I would a password, but it would be great if I could sync the keys between the ...
9
votes
1answer
596 views
List of methods in iOS that have been deprecated for security reasons?
Is anybody on the nets keeping track of iOS methods that have been deprecated by Apple for security reasons? I have searched around but with no luck.
Going through all the deprecated methods and ...
-1
votes
1answer
101 views
Possible ways to test security for Windows Phone 7 or iOS devices [closed]
I'm trying to test the security features of different types of OSs available, and I decided to narrow this down to the Windows Phone 7 and iOS operating systems. I will be testing both my Nokia 800 ...
15
votes
4answers
1k views
What measures should be taken when losing an iPad
When losing a tablet that has been used to access email accounts , beside changing the passwords, is there anything more can be done?
What are the most common problems that might occur if the iPad ...
2
votes
2answers
3k views
HTTPS verification failed - get certificate information iPad/iPhone
I went to log onto my bank's internet banking website this morning using Google Chrome browser on my iPad. I get the red error message of death. I can't figure out why. It's happening on both my ...
4
votes
1answer
701 views
Is there cryptographic material in a phone's SIM card that can be used with RSA encryption?
Given that a smart card stores a private key that can't be extracted, it appears that a SIM card is similar to a smart card in these respects.
I need to store (or use an existing) private key on a ...
2
votes
3answers
4k views
Encrypt data within mobile app and send to web service
I'm developing a mobile application for Android and iOs. What is best practice when it comes to data encryption within the mobile application which will be sent to a web service?
Basically I will ...
2
votes
2answers
1k views
Why is this SSL handshake failing with iPad? [closed]
I do have a tomcat server that listen on an SSL socket with TLS protocol. When connecting with all desktop browser everything work right. When connecting with Safari on iPad, the SSL handshake fails.
...
1
vote
3answers
785 views
Sending secure information from app with ssl
I'm a web developer, but I occasionally step over into doing some mobile app development here and there. A client recently asked me to help them develop a very simple app. The app is essentially just ...
2
votes
1answer
232 views
Data remanence on mobile devices
The methods in which data should be deleted is strictly enforced by the DoD as well as others security sensitive organizations. However, there are complications with deleting data on an SSD.
Given ...
-2
votes
1answer
306 views
Foolproof Jailbreak detection? [closed]
I went through various posts which talks about jailbreak detection mechanisms. Whatever I came across is either something that apple would reject during the vetting process or something that could be ...
2
votes
1answer
1k views
Is there any way to list the contents of the iPhone/OSX Keychain and their security level?
I have a few apps that I purchased from the app store that probably store information in my keychain on OSX and on the iPhone.
Since it's possible for keychain items to be bound to a device (and ...
2
votes
3answers
138 views
Is possible to know if increased marketshare means more viruses?
I'm having an argument with other developers about why more "viruses" exist (including all forms of external attacks, exploits, etc) in Android vs iOS. Like with Windows vs *nix, the main idea is that ...
5
votes
2answers
159 views
How much should I care about the iOS/Android version when pentesting mobile app?
Lets say I am performing penetration testing on mobile application, How significant is the version of operating system I am using while running the application?
I.e. if I test mobile application ...
4
votes
4answers
1k views
iOS app - hash user password in-app or on-server?
I'm working on an iOS app that will also have a web component. When a user creates an account, their password will be salted and hashed. I already have the hashing algorithm working on the web-side.
...
3
votes
2answers
1k views
Security analysis tools for iOS 6 [closed]
Searched over web, however could not find much info on security analysis tools for iOS6.
Can somebody point me to the security analysis (Static Code Analysis & Pen Testing) tools for iOS6?
2
votes
1answer
406 views
How to verify the signature in an iOS Passbook pass?
The Passbook application in the new iOS6 keeps track of movie tickets, coupons, and other 'passes' for you, and the passes themselves are loaded onto the user's device via file packages with the ...
3
votes
2answers
4k views
Privacy implications of IDFA/IDFV? (iPhone/iOS)
Apparently, iOS 6 introduced IDFA, "identifier for advertisers", which identifies your device so that advertisers can track you and send you ads. It appears they also introduced IDFV, "identifier for ...
4
votes
2answers
3k views
iPhone full disk encryption and theft protection?
Is it possible to fully encrypt an iPhone? What cipher does it use and are there any weaknesses?
How can I protect my valuable data, such as email, when my iPhone gets stolen?
