iOS is Apple's operating system for the iPhone, iPad and iPod Touch.

learn more… | top users | synonyms (1)

0
votes
0answers
8 views

SQLCipher and PRAGMA key on iOS

I'm a bit confused as to how SQLCipher handles the PRAGMA key provided for encrypting the SQLite database For background: I'm looking at options for encrypting application data at rest. From the ...
0
votes
0answers
5 views

Mobile Security and Vulnerability Analysis tool [migrated]

What tools should I use to test the security of my iOS application? What are the open source tools available to make vulnerability assessment of an iOS and android application? Any online tool which ...
0
votes
0answers
72 views

Should I blur the cached snapshot of my app?

I recently ran a security scan on one of my iOS apps that suggested I modify my apps display as it enters the background so that the screenshot stored in the cache does not expose any sensitive data. ...
0
votes
1answer
87 views

Does non-persistent data ever need to be encrypted?

Does non-persistent data ever need to be encrypted? If I had a project with confidential data stored in non-persistent class variables should I be doing anything to protect this data? I am developing ...
2
votes
1answer
64 views

Can an attacker make in-app-purchases of my products in their app?

My iOS app needs to store a pre-shared secret. It cannot embedded within the App Bundle itself because it could be extracted by statically analysing the bundle. Apple's In-App-Purchase system allows ...
4
votes
1answer
36 views

Seamless authentication from an iPad to several enterprise apps - what are the options?

What are the options for authenticating users of corporate iPads which are MDM managed to access sensitive corporate web apps exposed over the internet? The issue here is there are several web apps ...
1
vote
0answers
33 views

What is leaked about devices connected to iOS personal hotspot?

This is the scenario: 1) I set up a personal hotspot using my iPhone 4S running iOS 5 (we call this device A) 2) I connect a mobile device (e.g. a smartphone) using WiFi to have it use the hotspot ...
5
votes
1answer
93 views

How was iMessage broken?

It was reported today that iMessage was broken (CVE-2016-1788) by a team from John Hopkins around Matthew Green. They said it was kinda to be expected after inspecting the security guide closely ...
-2
votes
1answer
85 views

How to legally jailbreak an iPhone? [closed]

I'm looking to jailbreak my work phone to pen test iOS applications. From a compliance point of view I've got the green light as long as I don't go on our companies intranet with it or put company ...
1
vote
2answers
85 views

encrypting data while in memory

What is the best way to protect sensitive text input and store it in memory until form submission is complete and then clear it out shortly thereafter? I'm looking to protect sensitive information ...
-2
votes
1answer
145 views

Are VPNs for iPhones vulnerable to hacking?

I use VPNs all the time on my iPhone to get around websites being blocked and sometimes just for privacy, but are they secure? In this video the guy installed a certificate on the lady's phone that ...
2
votes
0answers
51 views

Disk Decipher: iOS app with TrueCrypt and VeraCrypt functionality — Has there been any security review? Is it safe to use?

http://disk-decipher.hekkihek.nl/ I am having trouble finding information about source code, software license, and code review. Is there any way to know that once I decrypt a volume with this app ...
31
votes
4answers
2k views

How do I verify HTTPS connections in Mobile apps?

There are a lot of mobile apps nowadays with payment gateways support. However, unlike desktop browsers, these mobile apps do not show us an 'Address bar' by which we can identify a HTTPS connection. ...
-2
votes
1answer
77 views

How to clean-up an iPhone

Suppose that an iPhone has been rooted and a back-door installed on the firmware and that this was done in a way that the factory re-start cannot clear out the problems. How does one clean up this ...
2
votes
1answer
38 views

What are the security implications of installing an iPhone configuration profile?

What are the security risks of installing a "configuration profile" on iOS from www.vshare.com? I don't know what a configuration profile is or what it does. They are found in Settings > General > ...
2
votes
1answer
111 views

T-Mobile WWAN IP address is DoD Network Information Center? [closed]

I wrote an app that grabs the IP address of my Wifi as well as the WWAN i.e. the data part of my Tmobile plan. I have an iPhone. Here is what my app prints. I use pretty standard code to obtain the ...
0
votes
1answer
30 views

How can I secure the state of a compromised iPhone for evidence of evil before resetting it?

I'm a web developer and generalist programmer with a bit of mobile experience. A friend of my wife is being stalked by a guy she was dating briefly and dumped over a month ago. He has somehow (not to ...
6
votes
1answer
248 views

John McAfee's Explanation of iOS Hack

I'm referring to this YouTube video, and further comment from John: I hope everyone knows that the Apple explanation was VASTLY dumbed down for the press. I know the A7 system chip well, ...
7
votes
2answers
50 views

Are any inherently insecure AES-CBC keys or key-IV combos known for properly generated random values?

This is mostly a theoretical question. I am using AES128 CBC to encrypt small files. Both my keys and my IVs are randomly generated per file using iOS's secure random value generation ...
-4
votes
1answer
111 views

How is it technically possible for Apple to unlock the San Bernardino shooter's iPhone? [duplicate]

If the iPhone of the San Bernadino shooters is locked, how would it even be possible for Apple to acquiesce to the FBI's request for them to unlock the phone? Does that mean Apple has some kind of ...
3
votes
2answers
171 views

How to secure JSON data that is shown on web service page?

I have an iOS app that uses a web service to get data from my server. It grabs the data and echoes a JSON feed to the web page, and the iOS app interprets it. I have SSL so I am not worried about the ...
0
votes
1answer
184 views

Why IOS on IPhone cannot be brute-forced programatically? [duplicate]

I am interested in the recent Apple case where FBI wants to get access, but they say it's not technically possible other than creating a new OS (or I guess just modifying the existing one). More ...
3
votes
2answers
222 views

Is Apple’s latest encryption considered to be munitions grade?

According to U.S. Export and Import laws, any device that has a minimum level of encryption is considered as falling under munitions type laws. Does Apple’s latest OS contain that level? And if it ...
5
votes
3answers
214 views

Can someone read a iOS class variable from outside the app?

a class variable like this: @property (strong, nonatomic) NSString *privateValue; Can someone read the value of that variable while it´s in memory? I can´t find anything about this on the apple ...
2
votes
1answer
52 views

iOS: intercepting passcode before it reaches secure enclave

From what little I read about Apple's "Secure enclave", I understand that it's a coprocessor which encrypts/decrypts data based on the user's passcode. So here's the scenario: I somehow get root ...
11
votes
3answers
1k views

Why can't apple simply add the backdoor now and then remove it after the FBI is done?

Summary of the current situation by @TTT Apple released an open letter to the public outlining their reasons for not complying with the FBI's demands to modify the iPhone's security mechanism. ...
0
votes
0answers
818 views

Is it possible to intercept ssl with burp on iOS 8.3

I have tried to intercept SSL connection on iOS 8.3 using BURP Proxy. I receive the error "There was a problem communicating with the secure web proxy server (HTTPS)." Is it because of some ...
1
vote
1answer
105 views

Could the FBI dump the drive contents of an iOS device, and then somehow run Virtual CPU's with different keys?

This seems like the most logical answer that would prevent wiping the data. Dump Contents of Drive. SetUp Virtual CPU with different keys. Use existing firmware and hardware for ios x Profit Is ...
157
votes
6answers
18k views

Apple's open letter - they can't or won't backdoor iOS?

Apple released an open letter to the public outlining their reasons for not complying with the FBI's demands to modify the iPhone's security mechanism. Here's a summary: The FBI has an iPhone in ...
1
vote
1answer
88 views

My iTunes account got hacked and someone used it to buy in-app purchase. How could that happen? [closed]

The account was hacked, I found out in my credit card statement and Apple support gave me refund which is nice. I wonder how it happened, and if there are even more serious risks that I don't know. ...
1
vote
1answer
50 views

Is there any way or tool to check whether a particular iOS app is implementing SSL Pinning functionality?

I'm just learning the iOS security. This is completely a beginner question. I'm trying to figure out whether there is any particular way to check if an iOS app is implementing SSL Pinning ...
2
votes
1answer
56 views

Is it completely safe to store the unencrypted credentials within a variable in the ios device

Overview is we encrypt the credentials using the pincode as the passphrase that the user also sets. One of the requirements is to NEVER SAVE THE PINCODE anytime anywhere. Everytime the user goes out ...
3
votes
1answer
937 views

What can an iOS app tell about you?

We all know while using a new iOS app it might ask for information like location or access to the camera. Those are both features we can deny to the app. There are, however, features apps can access ...
0
votes
0answers
27 views

SpriteKit Level Data Security Handling

I have been reading many different posts, threads, etc. regarding the best practices to store level data to be used throughout a game application (level boundary data, images, characters, time, etc.). ...
1
vote
1answer
45 views

Can I use a TLS certificate (first generated for a Windows Server) on a Linux Server?

I don't have any experience on this kind of things, so please bear with me. And I apologise if this has been asked before, but I couldn't find it in this site. My situation: I have a Windows ...
6
votes
2answers
111 views

Why should you clear your pasteboard when exiting your app?

I've been scanning an iOS application of mine and the highest risk vulnerability appears to be that the pasteboard is not getting cleared when I terminate the application. I don't want the user to ...
6
votes
1answer
67 views

Why isn't there a FROST-like cold boot exploit for iOS?

I know there's a cold boot attack for Android called FROST (Forensic Recovery Of Scrambled Phones). But there doesn't seem to be one for iOs. Why is this? Is it because iOS is inherently more ...
1
vote
0answers
30 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
3
votes
2answers
120 views

Can I store a pair of keys on iOS secure element?

I would like to know if I can use the iPhone's secure element to store a pair of keys. I need to store them in the safest emplacement, and I can't think of a better one than the secure element.
4
votes
0answers
61 views

How to encrypt data using the iOS secure element?

I would like to know if there's a way to encrypt/decrypt data using the iOS secure element chip (Java card). Or does the keychain already use it?
0
votes
0answers
83 views

iSniff-GPS: Certificate Verification

iSniff-GPS I came across an interesting sounding project on GitHub, called iSniff-GPS. I decided to check it out, but i experienced some issues when trying to use the web interface. Instructions ...
1
vote
0answers
71 views

Sensitive Information Disclosure via plist on iOS, does this affect security at all?

The security team has found sensitive information which is disclosed in info.plist, API keys were also exposed. Fabric is being used and Fabric API key is the way to authenticate the users or their ...
2
votes
1answer
83 views

Securing APIs from Rogue/Fake iOS or Android apps?

How do you protect a non-public web API from a malicious app where a developer has discovered how to perform some requests? Take Instagram's app as an example: Instagram does not have a public API ...
0
votes
1answer
89 views

Can an iOS/android app encrypt data without the user entering a password?

I found an iOS app that claims to save all user data only encrypted. But the app never asks me for a password. Is it even possible that the app encrypts the data in a useful way? I do need see what ...
3
votes
2answers
72 views

How protect mobile website against encapsulating into rogue native mobile app?

We are developping a mobile application (m.website.com). Is there a way to prevent a rogue developper to build an IOS / Android native app that simply encapsulate our website into the app using ...
6
votes
1answer
2k views

iOS Mail App Security

I have my own domain name and I had some issues with the delivery time. So, I started looking at the mail header to see where my mail was stuck and why. That is not the issue.. While messing around ...
0
votes
0answers
62 views

iOS Real Money Game Security [duplicate]

I am developing an iOS game that will be played with real money. The problem that I am facing is the security behind the game. First of all, the game is client-side. When the player buys into a game, ...
1
vote
4answers
360 views

iPad infected with virus (popup - admobinew.com)

This morning I was reading some news on some websites (I think one of them was haaretz.com) using my iPad (ios 9.0.1), I clicked on a news and I was redirected to some dodgy website and I started ...
2
votes
2answers
96 views

Data security implications of using Android over iOS [closed]

What are the security implications of using Android as opposed to iOS? Many sources say Android is much less secure and much less capable of handing a user's data in a secure manner. What are the main ...
2
votes
1answer
199 views

iOS encryption and performance

iOS file encryption deploys many layers of encryption; There is the AES-256 accelerator encrypting general flash memory with the per-file-, UID-, and GID keys. There is Data Protection on the software ...