iOS is Apple's operating system for the iPhone, iPad and iPod Touch.

learn more… | top users | synonyms (1)

1
vote
0answers
15 views

Does NSURLConnection on iOS support HSTS?

I have an app for iOS that uses NSURLConnection to retrieve things from a server. Will enabling HTTP Strict Transport Security (HSTS) on the server have any impact on the app? Will it refuse to ...
-1
votes
0answers
5 views

What's the preferred way to deal with the security surrounding creating new users in an iOS app? [closed]

I'm trying to get my client side talking to my server for app I'm making and I want to start with signing up new users. I'm not exactly sure, even through some research online, which is the best way ...
0
votes
0answers
22 views

Renewal of ssl client certificate on iOS app

I'm a bit confused on how ssl renewal would work on an iOS app. I've gotten a LetsEncrypt certificate for my domain name to secure data transfer between my iOS app and my web server. In the ...
1
vote
0answers
36 views

iOS keychain - who or what can access it

I have an iOS app that needs to be able to upload data in the background, and so also when the device is locked. To achieve background uploading I use information stored in the key chain. Therefore I ...
4
votes
2answers
79 views

Is there a security benefit in knowing if my iPhone is jailbroken?

There is an app for the iPhone supposedly detects if your smartphone has a jailbreak installed. Is there a security benefit in knowing whether your phone has a jailbreak or not?
2
votes
1answer
90 views

Viewing HTTPs Traffic - ZAP Proxy / MacOS / iOS App

I've noticed a curious oddity with some traffic sniffing from my Apps on my iPhone. I've installed the ZAP Proxy CA Cert on the device, but I've noticed I can sniff some App traffic, and others I ...
0
votes
0answers
29 views

SQLCipher and PRAGMA key on iOS

I'm a bit confused as to how SQLCipher handles the PRAGMA key provided for encrypting the SQLite database For background: I'm looking at options for encrypting application data at rest. From the ...
0
votes
0answers
5 views

Mobile Security and Vulnerability Analysis tool [migrated]

What tools should I use to test the security of my iOS application? What are the open source tools available to make vulnerability assessment of an iOS and android application? Any online tool which ...
0
votes
0answers
81 views

Should I blur the cached snapshot of my app?

I recently ran a security scan on one of my iOS apps that suggested I modify my apps display as it enters the background so that the screenshot stored in the cache does not expose any sensitive data. ...
0
votes
1answer
93 views

Does non-persistent data ever need to be encrypted?

Does non-persistent data ever need to be encrypted? If I had a project with confidential data stored in non-persistent class variables should I be doing anything to protect this data? I am developing ...
2
votes
1answer
89 views

Can an attacker make in-app-purchases of my products in their app?

My iOS app needs to store a pre-shared secret. It cannot embedded within the App Bundle itself because it could be extracted by statically analysing the bundle. Apple's In-App-Purchase system allows ...
4
votes
1answer
40 views

Seamless authentication from an iPad to several enterprise apps - what are the options?

What are the options for authenticating users of corporate iPads which are MDM managed to access sensitive corporate web apps exposed over the internet? The issue here is there are several web apps ...
1
vote
0answers
33 views

What is leaked about devices connected to iOS personal hotspot?

This is the scenario: 1) I set up a personal hotspot using my iPhone 4S running iOS 5 (we call this device A) 2) I connect a mobile device (e.g. a smartphone) using WiFi to have it use the hotspot ...
5
votes
1answer
93 views

How was iMessage broken?

It was reported today that iMessage was broken (CVE-2016-1788) by a team from John Hopkins around Matthew Green. They said it was kinda to be expected after inspecting the security guide closely ...
-2
votes
1answer
86 views

How to legally jailbreak an iPhone? [closed]

I'm looking to jailbreak my work phone to pen test iOS applications. From a compliance point of view I've got the green light as long as I don't go on our companies intranet with it or put company ...
1
vote
2answers
88 views

encrypting data while in memory

What is the best way to protect sensitive text input and store it in memory until form submission is complete and then clear it out shortly thereafter? I'm looking to protect sensitive information ...
-2
votes
1answer
151 views

Are VPNs for iPhones vulnerable to hacking?

I use VPNs all the time on my iPhone to get around websites being blocked and sometimes just for privacy, but are they secure? In this video the guy installed a certificate on the lady's phone that ...
2
votes
0answers
72 views

Disk Decipher: iOS app with TrueCrypt and VeraCrypt functionality — Has there been any security review? Is it safe to use?

http://disk-decipher.hekkihek.nl/ I am having trouble finding information about source code, software license, and code review. Is there any way to know that once I decrypt a volume with this app ...
33
votes
4answers
2k views

How do I verify HTTPS connections in Mobile apps?

There are a lot of mobile apps nowadays with payment gateways support. However, unlike desktop browsers, these mobile apps do not show us an 'Address bar' by which we can identify a HTTPS connection. ...
-2
votes
1answer
86 views

How to clean-up an iPhone

Suppose that an iPhone has been rooted and a back-door installed on the firmware and that this was done in a way that the factory re-start cannot clear out the problems. How does one clean up this ...
2
votes
1answer
42 views

What are the security implications of installing an iPhone configuration profile?

What are the security risks of installing a "configuration profile" on iOS from www.vshare.com? I don't know what a configuration profile is or what it does. They are found in Settings > General > ...
2
votes
1answer
206 views

T-Mobile WWAN IP address is DoD Network Information Center? [closed]

I wrote an app that grabs the IP address of my Wifi as well as the WWAN i.e. the data part of my Tmobile plan. I have an iPhone. Here is what my app prints. I use pretty standard code to obtain the ...
0
votes
1answer
30 views

How can I secure the state of a compromised iPhone for evidence of evil before resetting it?

I'm a web developer and generalist programmer with a bit of mobile experience. A friend of my wife is being stalked by a guy she was dating briefly and dumped over a month ago. He has somehow (not to ...
6
votes
1answer
248 views

John McAfee's Explanation of iOS Hack

I'm referring to this YouTube video, and further comment from John: I hope everyone knows that the Apple explanation was VASTLY dumbed down for the press. I know the A7 system chip well, ...
7
votes
2answers
54 views

Are any inherently insecure AES-CBC keys or key-IV combos known for properly generated random values?

This is mostly a theoretical question. I am using AES128 CBC to encrypt small files. Both my keys and my IVs are randomly generated per file using iOS's secure random value generation ...
-4
votes
1answer
118 views

How is it technically possible for Apple to unlock the San Bernardino shooter's iPhone? [duplicate]

If the iPhone of the San Bernadino shooters is locked, how would it even be possible for Apple to acquiesce to the FBI's request for them to unlock the phone? Does that mean Apple has some kind of ...
3
votes
2answers
239 views

How to secure JSON data that is shown on web service page?

I have an iOS app that uses a web service to get data from my server. It grabs the data and echoes a JSON feed to the web page, and the iOS app interprets it. I have SSL so I am not worried about the ...
0
votes
1answer
186 views

Why IOS on IPhone cannot be brute-forced programatically? [duplicate]

I am interested in the recent Apple case where FBI wants to get access, but they say it's not technically possible other than creating a new OS (or I guess just modifying the existing one). More ...
3
votes
2answers
225 views

Is Apple’s latest encryption considered to be munitions grade?

According to U.S. Export and Import laws, any device that has a minimum level of encryption is considered as falling under munitions type laws. Does Apple’s latest OS contain that level? And if it ...
5
votes
3answers
249 views

Can someone read a iOS class variable from outside the app?

a class variable like this: @property (strong, nonatomic) NSString *privateValue; Can someone read the value of that variable while it´s in memory? I can´t find anything about this on the apple ...
2
votes
1answer
56 views

iOS: intercepting passcode before it reaches secure enclave

From what little I read about Apple's "Secure enclave", I understand that it's a coprocessor which encrypts/decrypts data based on the user's passcode. So here's the scenario: I somehow get root ...
11
votes
3answers
1k views

Why can't apple simply add the backdoor now and then remove it after the FBI is done?

Summary of the current situation by @TTT Apple released an open letter to the public outlining their reasons for not complying with the FBI's demands to modify the iPhone's security mechanism. ...
0
votes
0answers
847 views

Is it possible to intercept ssl with burp on iOS 8.3

I have tried to intercept SSL connection on iOS 8.3 using BURP Proxy. I receive the error "There was a problem communicating with the secure web proxy server (HTTPS)." Is it because of some ...
1
vote
1answer
108 views

Could the FBI dump the drive contents of an iOS device, and then somehow run Virtual CPU's with different keys?

This seems like the most logical answer that would prevent wiping the data. Dump Contents of Drive. SetUp Virtual CPU with different keys. Use existing firmware and hardware for ios x Profit Is ...
157
votes
6answers
18k views

Apple's open letter - they can't or won't backdoor iOS?

Apple released an open letter to the public outlining their reasons for not complying with the FBI's demands to modify the iPhone's security mechanism. Here's a summary: The FBI has an iPhone in ...
1
vote
1answer
99 views

My iTunes account got hacked and someone used it to buy in-app purchase. How could that happen? [closed]

The account was hacked, I found out in my credit card statement and Apple support gave me refund which is nice. I wonder how it happened, and if there are even more serious risks that I don't know. ...
1
vote
1answer
75 views

Is there any way or tool to check whether a particular iOS app is implementing SSL Pinning functionality?

I'm just learning the iOS security. This is completely a beginner question. I'm trying to figure out whether there is any particular way to check if an iOS app is implementing SSL Pinning ...
2
votes
1answer
57 views

Is it completely safe to store the unencrypted credentials within a variable in the ios device

Overview is we encrypt the credentials using the pincode as the passphrase that the user also sets. One of the requirements is to NEVER SAVE THE PINCODE anytime anywhere. Everytime the user goes out ...
3
votes
1answer
953 views

What can an iOS app tell about you?

We all know while using a new iOS app it might ask for information like location or access to the camera. Those are both features we can deny to the app. There are, however, features apps can access ...
0
votes
0answers
27 views

SpriteKit Level Data Security Handling

I have been reading many different posts, threads, etc. regarding the best practices to store level data to be used throughout a game application (level boundary data, images, characters, time, etc.). ...
1
vote
1answer
45 views

Can I use a TLS certificate (first generated for a Windows Server) on a Linux Server?

I don't have any experience on this kind of things, so please bear with me. And I apologise if this has been asked before, but I couldn't find it in this site. My situation: I have a Windows ...
6
votes
2answers
117 views

Why should you clear your pasteboard when exiting your app?

I've been scanning an iOS application of mine and the highest risk vulnerability appears to be that the pasteboard is not getting cleared when I terminate the application. I don't want the user to ...
6
votes
1answer
71 views

Why isn't there a FROST-like cold boot exploit for iOS?

I know there's a cold boot attack for Android called FROST (Forensic Recovery Of Scrambled Phones). But there doesn't seem to be one for iOs. Why is this? Is it because iOS is inherently more ...
1
vote
0answers
34 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
3
votes
2answers
141 views

Can I store a pair of keys on iOS secure element?

I would like to know if I can use the iPhone's secure element to store a pair of keys. I need to store them in the safest emplacement, and I can't think of a better one than the secure element.
4
votes
0answers
70 views

How to encrypt data using the iOS secure element?

I would like to know if there's a way to encrypt/decrypt data using the iOS secure element chip (Java card). Or does the keychain already use it?
0
votes
0answers
96 views

iSniff-GPS: Certificate Verification

iSniff-GPS I came across an interesting sounding project on GitHub, called iSniff-GPS. I decided to check it out, but i experienced some issues when trying to use the web interface. Instructions ...
1
vote
0answers
84 views

Sensitive Information Disclosure via plist on iOS, does this affect security at all?

The security team has found sensitive information which is disclosed in info.plist, API keys were also exposed. Fabric is being used and Fabric API key is the way to authenticate the users or their ...
2
votes
1answer
94 views

Securing APIs from Rogue/Fake iOS or Android apps?

How do you protect a non-public web API from a malicious app where a developer has discovered how to perform some requests? Take Instagram's app as an example: Instagram does not have a public API ...
0
votes
1answer
98 views

Can an iOS/android app encrypt data without the user entering a password?

I found an iOS app that claims to save all user data only encrypted. But the app never asks me for a password. Is it even possible that the app encrypts the data in a useful way? I do need see what ...