iOS is Apple's operating system for the iPhone, iPad and iPod Touch.
0
votes
1answer
61 views
Apple iPhone Security
How difficult it would be to install an application that could record users keystrokes on an Apple device, for example, an iPhone X, and send it online without the knowledge of the user.
1
vote
2answers
42 views
At What Point Does A Device Correspond/Link to its Owner?
I am aware that governments, organizations and hackers can do a plethora of things to your device (i.e. track your location, tap calls, etc.), but I can only assume that they can only do these things ...
2
votes
1answer
53 views
Can Apple Devices Give Away Location to Hackers?
In a hypothetical scenario, I am travelling with my iPhone to, let's say, New Zealand. I stop at some random hotel and simply stay there doing nothing but staring at a wall for days with no ...
3
votes
1answer
75 views
Optimal way to capture HTTP(S) traffic on proxy-unaware iOS applications
I am trying to capture HTTP(S) traffic from a proxy-unaware Xamarin iOS application. The current tools I have available is a Mac with a Linux Mint VM, Xcode and iOS developer tools, Burp Suite ...
2
votes
1answer
114 views
Is it secure to use UUID as authentication? [duplicate]
I have an application which uses UUID as an authentication. The UUID is stored as KeyChain inside my iOS application. When I post the UUID, I use https. Is there any way to obtain the password, unless ...
1
vote
0answers
17 views
Does any MDM provide privacy assurances to the end user?
I'm a former network admin who deployed and configured MDM solutions. I recall being able to do things like
List all the applications on a device (including 3rd party apps)
Get device IP information,...
1
vote
1answer
88 views
Feasibility of persistent iOS malware which survives factory reset
Generally speaking, when an iOS device is purchased, it will be a couple of security updates behind the latest version of iOS. This means that in many cases, out of the box an iOS device will be ...
1
vote
1answer
83 views
Is showing the package name(Android)/bundle ID(ios) a security risk?
Suppose I release an app and accidentally publish the package name/bundle ID of the app which is suppose to be shown in development only, in a page. Is there any security concern that arises from this?...
1
vote
1answer
47 views
Is it possible to get infected by malware from running a foreign Xcode project?
An entrepreneur hired me to build out his mobile app and passed me the Xcode project files. From what I've read and heard about the development agency that built out his beta they're sketchy to say ...
1
vote
0answers
70 views
iOS traffic not shown in proxy when SSL pinning enabled
I have and iOS application to test. As per the latest security fix SSL pinning is enabled in the app. But now I am not able to see any traffic related to the application in my proxy tool. But ...
0
votes
0answers
72 views
Securing mobile app API Using UDID and Argon2
I'm trying to build an iOS app, I have wrote the code and all, and now I am implementing the APIs to communicate with the database.
The app will be using HTTPS and POST Requests to communicate with ...
1
vote
1answer
80 views
Shoulder surfing prevention or mitigation for unlocking mobile devices
How can shoulder surfing be prevented or mitigated when unlocking mobile devices?
I found other questions about shoulder surfing that focus more on desktop machines, but I believe the issue is much ...
1
vote
2answers
202 views
What is the use of EXE and DLL files on iOS device
I have a doubt regarding iOS application pentest.
I am pentesting one iOS application. The application is protected by MDM software.
Installation Process - Once I install the MDM on iPhone device ...
0
votes
0answers
18 views
Mobile apps AUTH flow
When the user enters username and password into an mobile app( iOS ,Android or windows app)it calls a thirds party oAuth login web service which responds back with oAuth access token and refresh token....
1
vote
1answer
568 views
How to prevent “JailBreak detection bypass” by Cydia tools such as “Flex 3” etc?
For sensitive mobile apps such as banking applications, it is recommended to detect if the device is JailBroken and prevent the application from working on that device.
But there are tools such as "...
2
votes
0answers
77 views
Apple iOS and KRACK
KRACK consist of several vulnerabilities (https://www.kb.cert.org/vuls/id/228519). Apple released patches against CVE-2017-13077, CVE-2017-13078 and CVE-2017-13080 from what I could find in their ...
3
votes
0answers
229 views
What unique device fingerprinting information can an iOS 11 app collect?
As a follow-on to these questions:
What unique fingerprinting information can an iOS7 app collect?
What unique device fingerprinting information can an iOS8 app collect?
What unique device ...
-1
votes
1answer
331 views
How to avoid silent SMS attack?
I am worried about silent SMS being used incorrectly by people. What are the ways on which it can be avoided on Android and iOS?
0
votes
0answers
16 views
Pegasus Stage 1 confusion
I am reading the analysis of pagasus-exploits report and on page 9 where it says after garbage collector deallocates the original arr and the program reallocates a number of uint32Array, it occurs ...
2
votes
1answer
130 views
How can Telegram find my phone number on iOS 11 after uninstall?
I wanted to sign in Telegram on my iPod Touch running iOS 11 with another account.
I deleted the app and install it again. On the sign up screen Telegram filled the phone number field with the number ...
2
votes
3answers
444 views
iPhone passcode security
With iOS 11 I was compelled to switch from two-step-verification to two-factor-authentication. This has the implication that somewhere at Apple there is some blackbox that can decide, using my AppleID ...
3
votes
0answers
55 views
Does Apple have access to the cryptographic keys to decrypt Safari Sync Data?
I was reading over iOS's security guide, and it is unclear to me whether Apple can accessed synced Safari data. For example, if Apple received a FISA Order for all information on iCloud on all ...
0
votes
1answer
904 views
How secure is Keepass when using mobile apps
Keepass appears to be very secure, because it is open-source and the code is examined by a lot of independent people. Furthermore the database which holds all passwords is stored wherever the user ...
1
vote
0answers
55 views
How to secure sip/voip server? [closed]
For registration on voip server the standard port is 5060. For security reasons, iptables rules forbade requests for port 5060 from any addresses except one static (customer support).
Now the problem ...
0
votes
0answers
170 views
MSF payloads that work for iOS (32 and 64 bit)
I have been using MetaSploit a lot lately, and I know how to make and use pretty much every payload.
There is one exception... iOS payloads.
I've tried using osx/armle/* payloads, but whenever I do ...
0
votes
2answers
1k views
What does Encryption at REST and HTTPS mean?
What does it mean when apps claim they encrypt at REST and HTTPS? I find this a little difficult to understand how different they are from the rest of the encryption-based Apps.
0
votes
2answers
230 views
VPN profile working in Iphone
I am using a VPN on my iphone https://itunes.apple.com/us/app/hotspot-vpn-free-secure-fast-internet/id1121846465?mt=8
Their privacy policy states that they can get data but doesn't says that will ...
4
votes
0answers
387 views
Should the Payload of Push Notification also be encrypted?
If you have a fully end-end encrypted app, should the push messages sent to the APNS or GCM also be encrypted.
The payload only contains message ids, from uid n conversation gid. Is there a major ...
-1
votes
1answer
478 views
How does iOS screenshot prevention (ScreenShield by Confide) work under the hood?
Official blog: https://blog.getconfide.com/introducing-screenshield-ios-screenshot-prevention-for-confide-and-beyond-692bbae2c31d
More coverage: https://9to5mac.com/2018/01/10/confide-messenger-...
7
votes
1answer
198 views
Why do Android and iOS not let users view wifi passwords?
On Windows, admin users can view saved wifi passwords. I know that by rooting the device, it is possible to view them on Android and iOS, but usually, rooting is simply not an option. So, why don't ...
3
votes
1answer
403 views
iOS : Possible cache DB security issue?
I currently found something interesting when browsing my iPhone app's cache.db file.
There is a table called cfurl_cache_receiver_data and there is a column called receiver_data. This contains all ...
0
votes
0answers
59 views
iOS mobile hotspot (tethering) redirected
I've recently started receiving a notification about connecting to 'iCloudDNSBypass.com' when tethering my computer (a MacBook) to an iPhone. The notice appears on the MacBook when first tethering to ...
6
votes
3answers
256 views
Why does Apple require your passcode when you restart? [duplicate]
On an iPhone or iPad, you can set up "Touch ID", which is a way to unlock your device using your fingerprint. I don't see why this wouldn't be much more secure than a passcode lock, as anyone can ...
5
votes
2answers
712 views
Preventing users from bypassing root/jailbreak detection measures
A pentest was made to our mobile app (Android and iOS version) and we received feedback stating that jailbreak/root detection was ineffective because it was relatively easy to reverse engineer the ...
7
votes
1answer
1k views
Did iOS 11.1 fix KRACK for only iPhone 7 and newer?
This security article from Apple says that 11.1 fixes the KRACK vulnerability for iPhone 7 and newer devices. But what about the older devices? Has Apple not fixed them or does the vulnerability not ...
1
vote
0answers
261 views
iOS hardware-backed key attestation [closed]
In android there is a way of knowing if the public key from a key pair was generated inside TEE and is, therefore, hardware-backed (https://source.android.com/security/keystore/attestation). I cannot ...
2
votes
2answers
160 views
Why doesn't Apple prevent iPhone jailbreaking by encrypting iOS and installing it on an independent chip?
Why doesn't Apple prevent iPhone jailbreaking by encrypting iOS and installing it on an independent chip?
With this I mean iOS will be encrypted with AES or any other very strong encryption algorith ...
2
votes
1answer
162 views
Should I wait for Apple to fix the recent WPA2 KRACK exploit before downloading new apps over Wi-Fi?
Monday of this week: researchers announced the WPA2 KRACK exploit that effectively voids the protection of WPA2. Supposedly Microsoft already fixed it, Apple's working on patching it for Mac OS and ...
10
votes
1answer
536 views
Consequences of the WPA2 KRACK attack on older Windows and iOS clients
What are the real-world consequences of the WPA2 KRACK attacks on older Windows systems (XP/Vista) and iOS devices (10 and older) that will not be patched?
I am aware of another question on this site ...
3
votes
1answer
291 views
Privacy concerns with the iOS Freedom app
Could the owners of the iOS Freedom app be snooping on its users, seeing what sites they browse or even what info they send or receive?
I would really like to use this productivity enhancing app, ...
1
vote
1answer
91 views
How do iOS 11 apps identify me despite app reinstalls?
I've recently reinstalled Pinterest on my iPhone and noticed I was logged in right from the start without even asking me for my username/password, so it must've somehow kept some data on my phone ...
1
vote
1answer
180 views
Can apps read other apps' RAM content on iOS?
Can iOS apps read the RAM contents/cache/data of any other arbitrary app? Assume that the following conditions applies:
The device is using only official iOS (no hacks or "jailbreaking")
Obviously (...
2
votes
0answers
677 views
iOS & Android Certificate Pinning with Lets Encrypt
We use cert pinning when developing for iOS and Android. We use regular 12 month certs that are paid for.
We recently switched to Lets Encrypt (LE) for our general website certificates and would like ...
-2
votes
3answers
229 views
Is it possible to jail break a iphone without knowing passcode/touchid?
If a hacker steals my phone and does not know my passcode/touch id.. will it be possible for him to jailbreak my device and access all my data? particularly data in keychain?
0
votes
0answers
159 views
What is the risk of turning on NSAllowsArbitraryLoads but certificate pinning turned on
If an iOS app has 'NSAllowsArbitraryLoads' turned on but uses certificate pinning. Does this give risks?
Can an attacker for instance influence the negotiation to go to unsecure ciphers?
And as a ...
0
votes
1answer
147 views
What kind of attack vectors are made possible as a result of Java being hopelessly intertwined with Android? [closed]
"All the security of Linux … plus Java! “Java: The malware compatibility layer of choice” Android can be engineered for security, but when you’re done you have a hermetically sealed self contained ...
4
votes
2answers
922 views
Is my data secure if my iPhone is locked?
I've probably a simple question, but could not find a (detailed) answer on the internet yet.
If my iPhone is locked (i.e. with TouchID or a PIN), is my data secure? So, can hackers or law enforcement ...
8
votes
1answer
506 views
Is Apple Face ID a good security feature?
This paper demonstrates how face liveness detection could be easily defeated by virtual models built from your public photos.
If you consider the instagram/snapchat phenomenon where users post ...
0
votes
0answers
391 views
Public key pinning in iOS with AFNetworking
We are implementing public key pinning in iOS app using AFNetworking framework using below code
- (BOOL)evaluateServerTrust:(SecTrustRef)serverTrust
forDomain:(NSString *)domain
...
6
votes
3answers
259 views
Is it safe to connect a random USB battery from a bin to my phone without stopping data transfer in some way?
I've asked the question Power-only USB connection to charge my phone - as simple as cutting the data lines? in electronics SE. In order to bypass the "Why do you want to do this?" request for ...
