Questions tagged [ios]
iOS is Apple's operating system for the iPhone, iPad and iPod Touch.
418
questions
1
vote
0answers
68 views
Does Apple leak iCloud usernames?
I've just set up my first iPad, and first Apple device. To be extra cautious when setting it up, I created a brand new @icloud.com username, to use as the Apple ID. The username was 10 characters long,...
0
votes
1answer
51 views
Logging into IOS applications Secure?
The IOS App Store has very high standards in regards to what goes on their App Store.
Do applications like Gmail, Outlook, banking Apps, and LastPass send your password securely when logging into ...
1
vote
0answers
24 views
How does HTTP Catcher (iOS app) work on SSL/TLS? [duplicate]
From the official description:
HTTP Catcher is a web debugging proxy. It can be used to intercept, inspect, modify and replay web traffic.
Can someone explain to me how HTTP Catcher manages to do ...
3
votes
1answer
116 views
Do mobile apps have their own certificate store?
When a mobile app is sending HTTPS requests, it verifies the server certificate against some kind of certificate store. My question is, would that certificate store be provided by the phone's OS, or ...
0
votes
1answer
122 views
Are cell towers basically routers? If so, could one be hacked to spread malware to all connected devices?
Just listened to a bit of the Darknet Diaries podcast episode on NotPetya. It’s insane just the damage it was able to cause even if it was only able to infect one machine initially. Which got me ...
1
vote
0answers
36 views
Export IOS Certificates and Configuration Profiles
Is there anyway to export a configuration profile from an IOS device that you have root on? So I have a device with an MDM profile with login credentials for a wifi network, VPN, and email ...
3
votes
0answers
53 views
Capture macOS/IOS system HTTPS packets
I tried to analyze the https traffic of apps on my MacBook and iPhone with Charles with SSL proxy (I use HTTP proxy for IOS and installed and trusted Charles certificate). I managed to decrypt most ...
1
vote
1answer
87 views
Using mitmproxy to analyze mobile application and iOS network data
I followed a guide where the author connected Windows PC and iPhone to his home WiFi network. He installed mitmproxy and ran mitmweb.exe on PC. On iPhone he went to wifi settings and set a manual ...
3
votes
0answers
242 views
CORS Trusting Arbitrary Origin on Mobile App
I am testing a mobile app that makes calls to a REST API. The API is only used by Android and iOS apps. Apps are native apps and they do not use web views. API trusts arbitrary Origins and Access-...
2
votes
1answer
73 views
Reason to generate encryption keypair server side rather than on device?
I want my native applications (android/ios) to have a keypair (RSA or ECIES) so that certain data on requests to my API can be encrypted. I want each client to have a unique keypair. The device will ...
1
vote
2answers
299 views
How an ISP can detect if someone having a WhatsApp call or video call? without detecting or blocking the rest of the app [duplicate]
I am asking the questions because of the latest news: https://www.bbc.com/news/world-middle-east-50095448
I wonder how the ISP can detect the use of call and video calls, without detecting or ...
0
votes
0answers
50 views
Mobile Code Scanning
I know that MobSF is generally well recommended as the OSS solution for code scanning of mobile devices.
To my knowledge though, it only performs dynamic analysis of android applications (and you ...
0
votes
0answers
50 views
Safest way to open PDFs on Android and iOS?
I was checking out Qubes' way of creating safe PDFs, but unless you use Qubes as a daily driver (and use DispVMs to open PDFs) it's still not viable to just use it to create image-based PDFs if you ...
0
votes
1answer
82 views
Can one iOS app read the data of another iOS app maliciously?
I'm writing an iOS app that will store some information. Though not too confidential, I'd like to prevent other apps from reading the data, since a malicious app can then "phone home". If the user has ...
2
votes
0answers
274 views
iOS secure enclave and jailbreak
If an iOS device is jailbroken, I understand an attacker cannot extricate key material from the secure enclave. But would they be able to use keys using CryptoKit within the enclave to encrypt a ...
1
vote
0answers
47 views
Does Telegram official client encrypt its local storage on iOS with app-specific passcode?
I failed to find any proofs for / against the question in the subject.
My end-user question is: if I set up a long paraphrase on official Telegram client, can I be sure that history of chats (...
1
vote
2answers
200 views
Is Objective C (really) affected by buffer overflows?
I'm trying to find a buffer overflow sample code in Objective-C but the only samples I found are written in C (without "bracket style").
I understand that Objective-C is based on C, but are there any ...
1
vote
0answers
55 views
How much entropy does Apple Touch ID sensor read fingerprint has?
Iphone uses by default 6-digit PIN that has an entropy of 19.93 bits
When iPhone processes the fingerprint, how much entropy does it have?
How long should standard passphrase be until it is as ...
1
vote
1answer
144 views
Is using a third party browser in iOS more secure than Safari?
I have read that many iOS exploits target the Safari browser. Would using another browser on my iOS device be safer? Does Safari being a system app give it more access to the OS than a third party ...
0
votes
1answer
80 views
Can data be uploaded to iCloud without your consent? [closed]
I have been a loyal iPhone user for years. I did have two Apple IDs previously. The other one has already been deleted by Apple formally.
The current Apple ID I am using was set up years ago when ...
0
votes
0answers
71 views
Is it possible to run jailbroken iPhone simulator to research iOS security?
I've read the Google ProjectZero's series of iOS exploits:
https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html
I wish to try and replicate some of their work. ...
2
votes
1answer
143 views
OAuth Authorization Flow without external user agent for iOS application
We are developing an iOS application and server where a user will be able to store some personal information and top up money.
I have been reading about the OAuth Authorization flow using PKCE and ...
1
vote
0answers
42 views
Is it possible to bypass the iOS dialogue for taking pictures to upload existing files?
Scenario: An iOS application that prompts the users to take a picture with their iPhone camera. These pictures (e.g. of documents) will then be uploaded to our server.
Is there a possible way for an ...
3
votes
0answers
140 views
Do modern operating systems still send targeted or directed Wi-Fi probe requests that contain SSIDs?
Do modern (versions of) operating systems, primarily Android and iOS on mobile, still send targeted or directed probe requests when searching for Wi-Fi networks to connect to?
Such targeted or ...
0
votes
0answers
70 views
Can phone apps edit my clipboard?
This is a question similar to this one but it is all about editing the clipboard contents.
Can phone apps read my clipboard?
Is this actually a case on latest API of Android an iOS? I mean ...
1
vote
0answers
128 views
Stop smartphone microphone from listening in background [duplicate]
Recently it has come to light that tech companies such as Facebook and Microsoft use humans to listen and transcribe audio conversations on Facebook messenger and Skype to improve their AI. However ...
2
votes
1answer
98 views
Obfuscating “sensitive” strings in mobile client
We have a client that runs some native (C++) code on both Android and iOS, to mitigate MITM attacks we use certificate pinning.
This means that the binary includes some strings (const char * const ...
0
votes
0answers
72 views
Should I hash responses from server?
I am hashing all requests to my server with a secret token known by only the server and my mobile app to prevent malicious apps from using my servers.
Should I also do this on the responses from the ...
0
votes
2answers
148 views
CSRF on inter-app communication iOS
How can I make a request from one app to another on iOS and verify the origin of the app request?
Apple used to have an applicationSource sent along with deeplinks, but it's now being deprecated. ...
2
votes
0answers
140 views
Is it a privacy issue that iOS persists private keys between app installs of the same bundle ID?
In iOS apps, Apple goes to a lot of trouble to keep applications from creating a stable identifier for a specific device. For example, in iOS >= 5 they no longer allow apps to get the hardware-tied ...
3
votes
1answer
450 views
Can my G Suite admin see my browsing history if: I am in incognito mode on iPad Chrome?
Can my G suite admin see by browsing history if: I am in incognito mode on iPad Chrome?
iPadOS beta 3.
I'm signed in with a G Suite account.
If they are monitoring me, is it visible? Is there any way ...
0
votes
0answers
177 views
Cycript (Killed: 9 error) on jailbroken ios 11.4
I am doing security research on a jailbroken ios 11.4 using cycript. When attempting to attach to a process using cycript -p <pid>, I get a Killed: 9 error in the console.
Searching online ...
0
votes
0answers
27 views
capturing web-sockets packets from IOS using fiddler
I am using latest Fiddler version trying to capture web-sockets requests from an IOS application.
I am able to see only HTTP and HTTPS requests.
Laptop(Running fiddler on port 8888) and mobile both ...
1
vote
0answers
87 views
Is AWS Cognito vulnerable to MITM when using iOS with Lambda and RDS
I'm a bit new to coding backend services. And I'm not sure how to solve this problem.
So users in an iOS app can be authenticated with Cognito and afterwards gain the rights to invoke lambda ...
0
votes
0answers
54 views
How does Google restrict API access by mobile App ID?
Google Cloud Platform API service has an option to restrict API access to specified iOS bundle identifiers.
How is Google able to accomplish that since any mobile clients can easily spoof the bundle ...
0
votes
0answers
49 views
Would iCloud data “cross-contaminate” Google account?
Sorry for asking such “wild” sounding question.
Basically, iCloud can be allowed to sync bookmarks to Google Chrome browser through iCloud Windows application. And most of the time, your Chrome ...
-2
votes
2answers
823 views
Is Spyzie a scam that allows people to pull data from iCloud?
Came across a iOS tracking software called “Spyzie” which allows parents to monitor kids’ data usage including call logs, messages, browsing and many more.
One of the key feature this software raises ...
2
votes
1answer
95 views
Encrypting mobile user data in event of PIN/device compromise
As I understand it, modern mobile OS's often encrypt app data when a device is locked with a pin or password. However, how do I protect users if their device or pin has been compromised?
If I ...
1
vote
2answers
291 views
How to completely destroyed all data from an iPhone before reselling it?
I would wish to know more about how to erase 100% data of a used iPhone.
Basically, technician from Apple Store only said “Erase & Clear” within the iPhone setting could do all the work perfectly ...
0
votes
0answers
54 views
Are there any known instances of Apple iOS exploits that can remotely install malware on a device unauthenticated?
Title.
Are there any known instances of exploits targeting iOS (versions 11 and later) with the following characteristics?:
Allows remote, unauthenticated installation of malware on the device. ...
0
votes
0answers
34 views
What to tamper the universal links in iOS? is possible to do?
I have created my app and website with universal links implementation such as /apple-app-site-association and applinks:<domainname>.
Now I would like to ensure security param tampering and ...
6
votes
2answers
714 views
What unique device fingerprinting information can an iOS 12 or iOS 13 app collect?
As a follow-on to these questions:
What unique fingerprinting information can an iOS7 app collect?
What unique device fingerprinting information can an iOS8 app collect?
What unique device ...
0
votes
0answers
46 views
Checking authenticity of a mobile app (digital staff card) [duplicate]
I've been asked to implement a digital card for member's of our organisation, to replace the old plastic ones. Members would install our app on their phone and setup a "card" with their photo on it ...
0
votes
1answer
33 views
BundleID of an iOS Application installed on iOS 10.2.1
I'm fairly new to iOS Security and was trying to obtain the BundleID of the applications installed on my jailbroken iOS Device (10.2.1).
I tried using both Appster and BundleIDs but both failed to ...
3
votes
1answer
218 views
Is copying passwords to iOS clipboard secure?
Since apps on iOS can access the clipboard should I worry about it when copying passwords from the keychain?
I do that when AutoFill feature doesn't work so I would not have to manually retype ...
1
vote
0answers
52 views
How can Apple allow all my devices to use iMessages without the key leaving my phone?
This question is related but different to this question.
Apple says that all iMessages are end-to-end encrypted, but how can a newly enrolled apple laptop read my phone's iMessages that were sent ...
0
votes
0answers
274 views
How to create an anonymous user account like the app Day-One does?
A new iOS app should be able to connect to a web service to sync data across devices. I like the way the diary app Day One solved this by offering "real" user accounts and automatically generated "...
1
vote
1answer
310 views
Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?
I'm analysing an iOS application and its communications through Charles.
I have access to most of SSL communications but not all, due to certificate pinning.
I know that there are many different ways ...
0
votes
0answers
70 views
iOS Security Architecture-Encryption Keys
As per iOS Security 12.1 documentation(Page-15), there are individual UID and GID for each processing unit i.e AP(Application Processor) and Secure Enclave.
The application processor and Secure ...
0
votes
1answer
75 views
Can a self-root certificate spy on me without a vpn or proxy on iOS?
Can a self-root certificate (implemented via mobile configuration) spy on me without a VPN or proxy on iOS?
