Questions tagged [ios]
iOS is Apple's operating system for the iPhone, iPad and iPod Touch.
414
questions
0
votes
0answers
7 views
How do you install UAT builds of IPA files on iPhone? [on hold]
What process do you follow to install UAT IPA files on iPhone.
-1
votes
0answers
35 views
Anyone know a good way to bypass MAC filtering on IPhone? [on hold]
My phones MAC is blocked at work so I can’t connect to the WIF. Anyone got a good way to bypass?
0
votes
0answers
29 views
What unique identifiers I should use for android and ios application to have proper mobile device identification? [on hold]
I read about some android malware that can basically get info about user mobile device, but when trying to make sure the intended user using the application from the onboarded mobile device, what are ...
1
vote
2answers
136 views
How an ISP can detect if someone having a WhatsApp call or video call? without detecting or blocking the rest of the app
I am asking the questions because of the latest news: https://www.bbc.com/news/world-middle-east-50095448
I wonder how the ISP can detect the use of call and video calls, without detecting or ...
0
votes
0answers
35 views
Mobile Code Scanning
I know that MobSF is generally well recommended as the OSS solution for code scanning of mobile devices.
To my knowledge though, it only performs dynamic analysis of android applications (and you ...
0
votes
0answers
42 views
Safest way to open PDFs on Android and iOS?
I was checking out Qubes' way of creating safe PDFs, but unless you use Qubes as a daily driver (and use DispVMs to open PDFs) it's still not viable to just use it to create image-based PDFs if you ...
0
votes
1answer
67 views
Can one iOS app read the data of another iOS app maliciously?
I'm writing an iOS app that will store some information. Though not too confidential, I'd like to prevent other apps from reading the data, since a malicious app can then "phone home". If the user has ...
2
votes
0answers
196 views
iOS secure enclave and jailbreak
If an iOS device is jailbroken, I understand an attacker cannot extricate key material from the secure enclave. But would they be able to use keys using CryptoKit within the enclave to encrypt a ...
1
vote
0answers
39 views
Does Telegram official client encrypt its local storage on iOS with app-specific passcode?
I failed to find any proofs for / against the question in the subject.
My end-user question is: if I set up a long paraphrase on official Telegram client, can I be sure that history of chats (...
1
vote
2answers
158 views
Is Objective C (really) affected by buffer overflows?
I'm trying to find a buffer overflow sample code in Objective-C but the only samples I found are written in C (without "bracket style").
I understand that Objective-C is based on C, but are there any ...
1
vote
0answers
33 views
How much entropy does Apple Touch ID sensor read fingerprint has?
Iphone uses by default 6-digit PIN that has an entropy of 19.93 bits
When iPhone processes the fingerprint, how much entropy does it have?
How long should standard passphrase be until it is as ...
1
vote
1answer
108 views
Is using a third party browser in iOS more secure than Safari?
I have read that many iOS exploits target the Safari browser. Would using another browser on my iOS device be safer? Does Safari being a system app give it more access to the OS than a third party ...
0
votes
1answer
71 views
Can data be uploaded to iCloud without your consent? [closed]
I have been a loyal iPhone user for years. I did have two Apple IDs previously. The other one has already been deleted by Apple formally.
The current Apple ID I am using was set up years ago when ...
0
votes
0answers
63 views
Is it possible to run jailbroken iPhone simulator to research iOS security?
I've read the Google ProjectZero's series of iOS exploits:
https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html
I wish to try and replicate some of their work. ...
2
votes
1answer
55 views
OAuth Authorization Flow without external user agent for iOS application
We are developing an iOS application and server where a user will be able to store some personal information and top up money.
I have been reading about the OAuth Authorization flow using PKCE and ...
0
votes
0answers
44 views
Hacking iOS 12.4 using code for iOS 12.2
In the original iOS 12.4, Apple accidentally unpatched a bug that allows for a remote hack when paired with a browser exploit. This bug could exploit iOS 12.2, and was patched in iOS 12.3.
If ...
1
vote
0answers
37 views
Is it possible to bypass the iOS dialogue for taking pictures to upload existing files?
Scenario: An iOS application that prompts the users to take a picture with their iPhone camera. These pictures (e.g. of documents) will then be uploaded to our server.
Is there a possible way for an ...
3
votes
0answers
105 views
Do modern operating systems still send targeted or directed Wi-Fi probe requests that contain SSIDs?
Do modern (versions of) operating systems, primarily Android and iOS on mobile, still send targeted or directed probe requests when searching for Wi-Fi networks to connect to?
Such targeted or ...
0
votes
0answers
65 views
Can phone apps edit my clipboard?
This is a question similar to this one but it is all about editing the clipboard contents.
Can phone apps read my clipboard?
Is this actually a case on latest API of Android an iOS? I mean ...
1
vote
0answers
117 views
Stop smartphone microphone from listening in background [duplicate]
Recently it has come to light that tech companies such as Facebook and Microsoft use humans to listen and transcribe audio conversations on Facebook messenger and Skype to improve their AI. However ...
2
votes
1answer
91 views
Obfuscating “sensitive” strings in mobile client
We have a client that runs some native (C++) code on both Android and iOS, to mitigate MITM attacks we use certificate pinning.
This means that the binary includes some strings (const char * const ...
0
votes
0answers
70 views
Should I hash responses from server?
I am hashing all requests to my server with a secret token known by only the server and my mobile app to prevent malicious apps from using my servers.
Should I also do this on the responses from the ...
0
votes
2answers
89 views
CSRF on inter-app communication iOS
How can I make a request from one app to another on iOS and verify the origin of the app request?
Apple used to have an applicationSource sent along with deeplinks, but it's now being deprecated. ...
2
votes
0answers
118 views
Is it a privacy issue that iOS persists private keys between app installs of the same bundle ID?
In iOS apps, Apple goes to a lot of trouble to keep applications from creating a stable identifier for a specific device. For example, in iOS >= 5 they no longer allow apps to get the hardware-tied ...
3
votes
1answer
279 views
Can my G Suite admin see my browsing history if: I am in incognito mode on iPad Chrome?
Can my G suite admin see by browsing history if: I am in incognito mode on iPad Chrome?
iPadOS beta 3.
I'm signed in with a G Suite account.
If they are monitoring me, is it visible? Is there any way ...
0
votes
0answers
100 views
Cycript (Killed: 9 error) on jailbroken ios 11.4
I am doing security research on a jailbroken ios 11.4 using cycript. When attempting to attach to a process using cycript -p <pid>, I get a Killed: 9 error in the console.
Searching online ...
0
votes
0answers
21 views
capturing web-sockets packets from IOS using fiddler
I am using latest Fiddler version trying to capture web-sockets requests from an IOS application.
I am able to see only HTTP and HTTPS requests.
Laptop(Running fiddler on port 8888) and mobile both ...
1
vote
0answers
72 views
Is AWS Cognito vulnerable to MITM when using iOS with Lambda and RDS
I'm a bit new to coding backend services. And I'm not sure how to solve this problem.
So users in an iOS app can be authenticated with Cognito and afterwards gain the rights to invoke lambda ...
0
votes
0answers
53 views
How does Google restrict API access by mobile App ID?
Google Cloud Platform API service has an option to restrict API access to specified iOS bundle identifiers.
How is Google able to accomplish that since any mobile clients can easily spoof the bundle ...
0
votes
0answers
49 views
Would iCloud data “cross-contaminate” Google account?
Sorry for asking such “wild” sounding question.
Basically, iCloud can be allowed to sync bookmarks to Google Chrome browser through iCloud Windows application. And most of the time, your Chrome ...
-1
votes
2answers
216 views
Is Spyzie a scam that allows people to pull data from iCloud?
Came across a iOS tracking software called “Spyzie” which allows parents to monitor kids’ data usage including call logs, messages, browsing and many more.
One of the key feature this software raises ...
2
votes
1answer
93 views
Encrypting mobile user data in event of PIN/device compromise
As I understand it, modern mobile OS's often encrypt app data when a device is locked with a pin or password. However, how do I protect users if their device or pin has been compromised?
If I ...
1
vote
2answers
211 views
How to completely destroyed all data from an iPhone before reselling it?
I would wish to know more about how to erase 100% data of a used iPhone.
Basically, technician from Apple Store only said “Erase & Clear” within the iPhone setting could do all the work perfectly ...
0
votes
0answers
51 views
Are there any known instances of Apple iOS exploits that can remotely install malware on a device unauthenticated?
Title.
Are there any known instances of exploits targeting iOS (versions 11 and later) with the following characteristics?:
Allows remote, unauthenticated installation of malware on the device. ...
0
votes
0answers
31 views
What to tamper the universal links in iOS? is possible to do?
I have created my app and website with universal links implementation such as /apple-app-site-association and applinks:<domainname>.
Now I would like to ensure security param tampering and ...
5
votes
2answers
394 views
What unique device fingerprinting information can an iOS 12 or iOS 13 app collect?
As a follow-on to these questions:
What unique fingerprinting information can an iOS7 app collect?
What unique device fingerprinting information can an iOS8 app collect?
What unique device ...
0
votes
0answers
43 views
Checking authenticity of a mobile app (digital staff card) [duplicate]
I've been asked to implement a digital card for member's of our organisation, to replace the old plastic ones. Members would install our app on their phone and setup a "card" with their photo on it ...
0
votes
1answer
27 views
BundleID of an iOS Application installed on iOS 10.2.1
I'm fairly new to iOS Security and was trying to obtain the BundleID of the applications installed on my jailbroken iOS Device (10.2.1).
I tried using both Appster and BundleIDs but both failed to ...
3
votes
1answer
150 views
Is copying passwords to iOS clipboard secure?
Since apps on iOS can access the clipboard should I worry about it when copying passwords from the keychain?
I do that when AutoFill feature doesn't work so I would not have to manually retype ...
1
vote
0answers
51 views
How can Apple allow all my devices to use iMessages without the key leaving my phone?
This question is related but different to this question.
Apple says that all iMessages are end-to-end encrypted, but how can a newly enrolled apple laptop read my phone's iMessages that were sent ...
0
votes
0answers
169 views
How to create an anonymous user account like the app Day-One does?
A new iOS app should be able to connect to a web service to sync data across devices. I like the way the diary app Day One solved this by offering "real" user accounts and automatically generated "...
1
vote
1answer
250 views
Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?
I'm analysing an iOS application and its communications through Charles.
I have access to most of SSL communications but not all, due to certificate pinning.
I know that there are many different ways ...
0
votes
0answers
66 views
iOS Security Architecture-Encryption Keys
As per iOS Security 12.1 documentation(Page-15), there are individual UID and GID for each processing unit i.e AP(Application Processor) and Secure Enclave.
The application processor and Secure ...
0
votes
1answer
71 views
Can a self-root certificate spy on me without a vpn or proxy on iOS?
Can a self-root certificate (implemented via mobile configuration) spy on me without a VPN or proxy on iOS?
4
votes
1answer
183 views
How should I use Facebook while giving as little information as possible?
As a college student, Facebook and Messenger are virtually necessary to have in my life for communicating with clubs, classmates, finding housing, and more. As much as I want to get rid of them, it's ...
1
vote
0answers
119 views
Can mobile service providers use my iPhone's microphone to listen even when I'm not on a call?
So is this technically possible? Basically can the service provider somehow hack into my phone and use the microphone to hear the surrounding of my phone if they somehow have a backdoor/malicious code ...
11
votes
2answers
241 views
Is there always a user notification when smartphones record audio?
Background: With microphones being embedded in all sorts of consumer electronics, there is widespread concern that certain actors (e.g. device manufacturers, ecosystem providers, third-party apps) ...
0
votes
1answer
58 views
Is it safe to just forget OAuth tokens, and not invalidate them in a mobile app?
I have a mobile application that a user signs into using OpenId Connect and OAuth 2.0. Currently when the user logs out, I open up a webpage to the end_session_endpoint (http://docs.identityserver.io/...
1
vote
1answer
141 views
What is a spinner (empty while loop) doing, and why?
I've seen that in the latest iOS jailbreak, they use so called "spinners". What exactly is a spinner doing? And why?
Apparently it's "blocking the thread execution", but why does the exploit need ...
0
votes
0answers
103 views
Store Credit Card data in memory for using with native payment SDKs (iOS, Android)
I am implementing a Credit Card processing in mobile apps for iOS (Swift) and Android (Kotlin) using native SDK (SAQ A EP compliance level)
We thought about:
disabling clipboard for CC field
...
