Questions tagged [ios]
iOS is Apple's operating system for the iPhone, iPad and iPod Touch.
433
questions
0
votes
0answers
38 views
Integrating 2FA app into main app
We currently have two distinct apps, one for generating a 2FA token and the other one is the main app. Business is now considering to have only one app left and integrating the authenticator app into ...
0
votes
0answers
71 views
(Re)Hacked Instagram accout even if Two Factor authentication was enabled
A friend of mine, let's call her Alice, had an Instagram account that was hacked. She uses an iPhone. The scenario looks like this:
Alice gets a link from a Business Account via WhatsApp, and clicks ...
0
votes
0answers
39 views
How secure is the apple cross device copy and paste feature? [duplicate]
I can copy and paste between my iPhone and MacBook Pro it's a great feature that I find myself using frequently. I am frequently copy and pasting from my password manager to log in to different sites....
1
vote
0answers
86 views
Insecure Binary protection iOS Pentest Report
Thirdparty pentest company reported their findings in our iOS app.
In the report explanation for this vulnerability is
Apple provides default encryption for applications; however, the encryption ...
0
votes
0answers
41 views
FIDO2 - Where do Android and IOS platform authenticators store private key credentials?
I'm new to FIDO2 specification.
I'm aware that Android and IOS devices support FIDO2 protocols (even Android phones could act as a physical key for FIDO2 authentication).
However, Could anyone let me ...
0
votes
0answers
48 views
Sign-in with Apple user verification
I want to enable "Sign-in with apple" in my application.
As you can see here App sends Token authorization code to the backend, and then backend needs to talk with Apple ID to verify the ...
0
votes
0answers
44 views
Are last access time and location of connected devices recorded in iCloud?
During a Forensic investigation, I parsed the sysdiagnose log file /brctl/Brctl-dump.txt and I discovered 50 devices connected to the same iCloud account.
Is it possible to retrieve from Apple the ...
1
vote
1answer
71 views
Can an iOS backup be compromised?
I originally posted this on the Apple Stack Exchange but it was suggested that it was off topic, so I’m posting it here in hopes that this is a more relevant place for it.
Say that an iOS device has ...
1
vote
0answers
39 views
Strange Proxy Application Behavior on iOS 13.5.1
Background: My buddy is a freelance journalist working on a story on one of the bigger software companies (a household name, starts with an A). Anyway, he asked me to take a look at his iPad because ...
0
votes
0answers
34 views
How safe is the built in browser on the iOS Facebook app?
There is no option in the iOS Facebook app to open URLs in an external browser by default (although you can open a link, and then choose to open it in Safari).
How safe (mainly from a privacy ...
3
votes
2answers
137 views
What is the reason for iOS per-file key encryption?
I know that apple provides per-file key encryption .i.e. a separate encryption key for each file exists on the apple device. The Hardware Key and the Passcode are required to generate these random ...
0
votes
1answer
149 views
Can deleted snapchat messages be recovered?
If there are chats that have been deleted, is there a way to recover these with any recovery tools, or are they gone forever?
3
votes
0answers
60 views
Can Apple and Google bypass the decentralised COVID-19 tracing approach (DP-3T)?
Many thoughts have been spent on creating the decentralised, minimum-knowledge contact tracing approach DP-3T. This has been implemented in contact tracing apps of several countries, e. g. the German ...
0
votes
1answer
120 views
Can people hack your iPhone Via Bluetooth if you leave it on?
I live in an apartment complex with lots of people, and oftentimes I would be able to see Bluetooth devices that do not belong to me on my iPhone or MacBook when I search for my Bluetooth device.
...
0
votes
0answers
53 views
Architecture of smartphone security: why FBI needed apple's help? [duplicate]
I want to focus on technical aspects, not on the fact that they wanted to make a precedence.
i assume the smartphone security architecture is following:
cryptography chip. it's read only and ...
1
vote
0answers
30 views
Risks of choosing yes for remembering password for iPads, iPhones not having iCloud Keychain
Our mobile devices(iPhones, iPads) don't have iCloud Keychain which seems to have AES 256 bit encryption for storing credentials. The mobile browsers in those devices like Safari, Firefox, Chrome ask ...
0
votes
0answers
12 views
Session Hijacking with remote server [duplicate]
Session cookie can help to bypass 2FA.
Suppose victim and attacker are on same network without firewall.
Attacker wants to steal victims login session.
So attacker sends original login page over ...
0
votes
0answers
77 views
Does iOS 13.4.1 fix the VPN vulnerability?
It was found by ProtonVPN that there is a vulnerability in previous versions of iOS which causes internet connections not reestablished under the VPN tunnel:
https://protonvpn.com/blog/apple-ios-...
0
votes
0answers
24 views
iOS 11+ settings migration to a second-hand device
When you receive a new iPhone running iOS 11+, the setup process allows you to migrate settings and content from your old phone (assuming it is also running iOS 11+). The migration is initiated by a ...
0
votes
0answers
42 views
How does iOS device management work?
Under Settings -> Device Management I notice there are at least 3 different categories of items:
Mobile Device Management
Configuration Profile
Enterprise App
But documentation online seems sparse ...
0
votes
0answers
61 views
How to ensure your own native app is talking to your own API [duplicate]
I'm developing an API and different apps to access to it, each with different scopes, including a native mobile app, and I'm wondering what would be a good strategy to authenticate my own native app ...
1
vote
1answer
55 views
Is using numeric passwords on Macs reasonable for average users?
Is using a numeric password (similar to a PIN code on a phone) on Macs reasonable for regular users, considering they are the norm for passcodes on iOS devices?
Traditionally user accounts on Macs ...
0
votes
1answer
89 views
Can MDM on an iPhone restrict custom keyboard usage?
I have an iPhone that runs 13.3.1 (latest at this time). It's a corporate phone and has an MDM profile installed. I've been using the phone for almost 2 years now with a custom keyboard (Google ...
0
votes
2answers
54 views
What difference to privacy will I get if i change my workplace wifi DNS to static ones on my iPad? [duplicate]
I access internet at my workplace with an iPad that has workplace profile installed on it. This allows me to automatically connect to the company wifi, along with their own DNS settings. If I change ...
1
vote
0answers
78 views
Does Apple leak iCloud usernames?
I've just set up my first iPad, and first Apple device. To be extra cautious when setting it up, I created a brand new @icloud.com username, to use as the Apple ID. The username was 10 characters long,...
1
vote
0answers
46 views
How does HTTP Catcher (iOS app) work on SSL/TLS? [duplicate]
From the official description:
HTTP Catcher is a web debugging proxy. It can be used to intercept, inspect, modify and replay web traffic.
Can someone explain to me how HTTP Catcher manages to do ...
3
votes
1answer
312 views
Do mobile apps have their own certificate store?
When a mobile app is sending HTTPS requests, it verifies the server certificate against some kind of certificate store. My question is, would that certificate store be provided by the phone's OS, or ...
0
votes
1answer
141 views
Are cell towers basically routers? If so, could one be hacked to spread malware to all connected devices?
Just listened to a bit of the Darknet Diaries podcast episode on NotPetya. It’s insane just the damage it was able to cause even if it was only able to infect one machine initially. Which got me ...
1
vote
0answers
42 views
Export IOS Certificates and Configuration Profiles
Is there anyway to export a configuration profile from an IOS device that you have root on? So I have a device with an MDM profile with login credentials for a wifi network, VPN, and email ...
3
votes
0answers
69 views
Capture macOS/IOS system HTTPS packets
I tried to analyze the https traffic of apps on my MacBook and iPhone with Charles with SSL proxy (I use HTTP proxy for IOS and installed and trusted Charles certificate). I managed to decrypt most ...
1
vote
1answer
153 views
Using mitmproxy to analyze mobile application and iOS network data
I followed a guide where the author connected Windows PC and iPhone to his home WiFi network. He installed mitmproxy and ran mitmweb.exe on PC. On iPhone he went to wifi settings and set a manual ...
3
votes
0answers
1k views
CORS Trusting Arbitrary Origin on Mobile App
I am testing a mobile app that makes calls to a REST API. The API is only used by Android and iOS apps. Apps are native apps and they do not use web views. API trusts arbitrary Origins and Access-...
2
votes
1answer
88 views
Reason to generate encryption keypair server side rather than on device?
I want my native applications (android/ios) to have a keypair (RSA or ECIES) so that certain data on requests to my API can be encrypted. I want each client to have a unique keypair. The device will ...
1
vote
2answers
790 views
How an ISP can detect if someone having a WhatsApp call or video call? without detecting or blocking the rest of the app [duplicate]
I am asking the questions because of the latest news: https://www.bbc.com/news/world-middle-east-50095448
I wonder how the ISP can detect the use of call and video calls, without detecting or ...
0
votes
0answers
57 views
Mobile Code Scanning
I know that MobSF is generally well recommended as the OSS solution for code scanning of mobile devices.
To my knowledge though, it only performs dynamic analysis of android applications (and you ...
0
votes
0answers
63 views
Safest way to open PDFs on Android and iOS?
I was checking out Qubes' way of creating safe PDFs, but unless you use Qubes as a daily driver (and use DispVMs to open PDFs) it's still not viable to just use it to create image-based PDFs if you ...
0
votes
1answer
150 views
Can one iOS app read the data of another iOS app maliciously?
I'm writing an iOS app that will store some information. Though not too confidential, I'd like to prevent other apps from reading the data, since a malicious app can then "phone home". If the user has ...
2
votes
0answers
337 views
iOS secure enclave and jailbreak
If an iOS device is jailbroken, I understand an attacker cannot extricate key material from the secure enclave. But would they be able to use keys using CryptoKit within the enclave to encrypt a ...
1
vote
0answers
63 views
Does Telegram official client encrypt its local storage on iOS with app-specific passcode?
I failed to find any proofs for / against the question in the subject.
My end-user question is: if I set up a long paraphrase on official Telegram client, can I be sure that history of chats (...
1
vote
2answers
300 views
Is Objective C (really) affected by buffer overflows?
I'm trying to find a buffer overflow sample code in Objective-C but the only samples I found are written in C (without "bracket style").
I understand that Objective-C is based on C, but are there any ...
1
vote
0answers
71 views
How much entropy does Apple Touch ID sensor read fingerprint has?
Iphone uses by default 6-digit PIN that has an entropy of 19.93 bits
When iPhone processes the fingerprint, how much entropy does it have?
How long should standard passphrase be until it is as ...
1
vote
1answer
200 views
Is using a third party browser in iOS more secure than Safari?
I have read that many iOS exploits target the Safari browser. Would using another browser on my iOS device be safer? Does Safari being a system app give it more access to the OS than a third party ...
0
votes
1answer
102 views
Can data be uploaded to iCloud without your consent? [closed]
I have been a loyal iPhone user for years. I did have two Apple IDs previously. The other one has already been deleted by Apple formally.
The current Apple ID I am using was set up years ago when ...
2
votes
1answer
300 views
OAuth Authorization Flow without external user agent for iOS application
We are developing an iOS application and server where a user will be able to store some personal information and top up money.
I have been reading about the OAuth Authorization flow using PKCE and ...
1
vote
0answers
42 views
Is it possible to bypass the iOS dialogue for taking pictures to upload existing files?
Scenario: An iOS application that prompts the users to take a picture with their iPhone camera. These pictures (e.g. of documents) will then be uploaded to our server.
Is there a possible way for an ...
3
votes
0answers
192 views
Do modern operating systems still send targeted or directed Wi-Fi probe requests that contain SSIDs?
Do modern (versions of) operating systems, primarily Android and iOS on mobile, still send targeted or directed probe requests when searching for Wi-Fi networks to connect to?
Such targeted or ...
0
votes
0answers
87 views
Can phone apps edit my clipboard?
This is a question similar to this one but it is all about editing the clipboard contents.
Can phone apps read my clipboard?
Is this actually a case on latest API of Android an iOS? I mean ...
1
vote
0answers
132 views
Stop smartphone microphone from listening in background [duplicate]
Recently it has come to light that tech companies such as Facebook and Microsoft use humans to listen and transcribe audio conversations on Facebook messenger and Skype to improve their AI. However ...
2
votes
1answer
105 views
Obfuscating “sensitive” strings in mobile client
We have a client that runs some native (C++) code on both Android and iOS, to mitigate MITM attacks we use certificate pinning.
This means that the binary includes some strings (const char * const ...
0
votes
2answers
213 views
CSRF on inter-app communication iOS
How can I make a request from one app to another on iOS and verify the origin of the app request?
Apple used to have an applicationSource sent along with deeplinks, but it's now being deprecated. ...
