Skip to main content

Questions tagged [ios]

iOS is Apple's operating system for the iPhone, iPad and iPod Touch.

Filter by
Sorted by
Tagged with
3 votes
1 answer
461 views

How does Signal protect data on the device from unauthorized access?

Signal has moved to always store all data AES-encrypted on the device a few years ago. So, it is reasonable to assume that reading conversation data from a device at rest should be impossible. However,...
bitmask's user avatar
  • 615
0 votes
1 answer
37 views

How do regular software updates to Apple’s secure enclave remain secure?

The Secure Enclave is isolated from the main processor to provide an extra layer of security and is designed to keep sensitive user data secure even when the Application Processor kernel becomes ...
security_paranoid's user avatar
0 votes
1 answer
48 views

Keychain iOS: info on other users

I am analyzing an iOS mobile application. I discovered that the app saves all logged-in users in the keychain, specifically saving their first name, last name, email, and id_token. This id_token, ...
moskino11's user avatar
  • 127
0 votes
0 answers
10 views

How can I determine which IOS application on my iPhone is scanning my local network? [migrated]

My router (Unifi UDM-SE) has a honeypot configured which is capturing a scan from the iPhone about twice per day. I would like to figure out which App is doing this. I have followed the instructions ...
globaltechsoul's user avatar
0 votes
0 answers
54 views

Storing APFS password in Apple's Keychain for Time Machine

If you are using an encrypted APFS container, for example, to encrypt the Time Machine, whenever the physical disk is plugged in, MacOS asks for a decryption password with an option to store it ("...
Alexander K.'s user avatar
0 votes
1 answer
248 views

Is malware less prevalent in the Apple App Store compared to the Google Play Store?

I was searching for reports about malware on the Apple App Store and only found minor ones (at least from a user's perspective) on the first few Google search results. Doing the same search for the ...
Martin Thoma's user avatar
  • 3,932
0 votes
1 answer
111 views

Are Apple TOTP verification codes the HOTP secret?

Apple provided the capability of using TOTP within iOS itself and I noticed there was a section for Use a verification code on a website or in an app which bypasses the QR Code. My question is whether ...
Archimedes Trajano's user avatar
0 votes
0 answers
115 views

What NOT to do if I am recovering messages from Signal messenger on damaged iPhone

I have an iPhone SE 2020 running ios 16 that got water damaged and now doesn't even switch on. It has some Signal messenger messages on it that I want to recover. Signal ios app version was up to date ...
Judy D's user avatar
  • 101
0 votes
1 answer
127 views

Can an earpiece transfer virus from one phone to another? [duplicate]

I gave a friend my earpiece and her phone had audio issues prior to that, I took it back and connected it to my phone and ever since I did, my audio stopped working. Now if I try to do anything that ...
Benita Patrick's user avatar
2 votes
1 answer
893 views

Capturing packets in an android application or ios application?

I've an android and ios app. They run on the same application server on Linux. I want to capture the packets when users are trying to log in to the app. How do I proceed? I'm thinking of doing it with ...
Team B.I's user avatar
  • 141
0 votes
1 answer
322 views

Why does iOS allow using passkey without biometric? [closed]

One of the touted features of passkeys is that they depend on a biometric in order to use them. However, on an iPhone, if the finger-print scanner isn’t successful, it offers you the option of using ...
Ian Warburton's user avatar
0 votes
1 answer
86 views

Discovering already encrypted REQUEST key AES128 and sending already encrypted REQUEST with other data

I'm working on a college project to understand how the IOS application sends the password in the REQUEST already encrypted in AES128, what is its key, and send a REQUEST with our string transformed ...
nav4rro's user avatar
0 votes
1 answer
168 views

Connect to corporate wifi with personal phone - decrypt https?

Someone asked regarding wifi yesterday but can't find the post anymore. When connecting to corporate wifi with my personal iPhone for first time, I am asked to trust a "Root CA". However, I ...
IT_newbie213's user avatar
1 vote
0 answers
21 views

How do end-to-end encryption (E2EE) IM apps implementing push notifications? [duplicate]

Say WhatsApp and Signal on Android devices, how do they keep the E2EE not be broken? Some answers claimed that WhatsApp uses VoIP background mode on iOS to make the push notification invoke the app to ...
Xiangyi Meng's user avatar
26 votes
6 answers
13k views

Spying on a smartphone remotely by the authorities: feasibility and operation

French lawmakers agreed to a justice reform bill that includes a provision granting police the power to remotely activate suspects' geolocation, microphone and camera (source). Following the senators, ...
Yann Rimbaud's user avatar
1 vote
0 answers
143 views

How to know if my iPhone has spyware [duplicate]

Is there a way I can check if my phone is being tapped or monitored by a spy app? I’ve updated security patches but I am still not ok with that. Any advice?
Quietude's user avatar
0 votes
1 answer
182 views

SymmetricKey vs SecRandomCopyBytes

Can SymmetricKey be used as substitute for SecRandomCopyBytes? I found this code snippet in WWDC19 video var key = Array(repeating: 0, count: 32) let err = SecRandomCopyBytes(kSecRandomDefault, ...
Артур Мурадянц's user avatar
2 votes
0 answers
157 views

Storing encrypted data in iOS keychain

In my Unity app in C# I am using a 3rd party script which allows me store and retrieve data using iOS keychain. The stored data is a private user generated key which is used to encrypt data before ...
Ando's user avatar
  • 133
2 votes
1 answer
224 views

Do VPNs log and analyze OCSP requests?

I am a privacy-conscious user currently living in Russia where the Internet is censored and monitored by the Russian state. Russian ISPs are legally required to log and store all users’ Internet ...
Gilgamesh's user avatar
1 vote
1 answer
373 views

Will it ever be possible to functionally get the encrypted data off of an iphone in recovery mode?

Apparently the data encrypts until the passcode is entered, but my phone (close to 3,500 recordings of my original music) won't boot up. I dropped it and it went into a boot loop then went into ...
SoftserveSodium's user avatar
2 votes
1 answer
191 views

PC to iOS, USB storage Malware?

I have a laptop, with Windows 7, no internet (with the wifi adapter physically removed). I want to use that machine for stuff like old abandonware, and don’t want to risk any type of malware or virus ...
ButterKnife's user avatar
0 votes
0 answers
263 views

client side certificate installed on ios 16 are not being sent by browsers on that device when a server requests for a identity cert

I have a client side certificate from cloudflare (non-root) that i install on our devices in order to gain access to our sites that ask for a client side certificate from browsers. This works ...
Muhammad Ebrahym's user avatar
0 votes
1 answer
158 views

What security reviews are done on apps in mobile app stores? [closed]

What checks (static analysis, dynamic analysis etc.) does Google, Apple, Amazon etc. do on their app stores with each app developer submit? Are they automatic or manual? Does any app store review ...
maskin's user avatar
  • 129
2 votes
2 answers
292 views

Is it plausible that NSO Group's 0-click attacks are actually bugdoors?

By bugdoors, I mean OS/app devs deliberately introducing vulnerabilities & sharing with front orgs like the NSO Group which then develops and markets the spyware? Would this process be easier ...
TheReal_Skywalker's user avatar
-4 votes
1 answer
346 views

How do non technical users tell which App stores are safe enough & remain safe using an app store as their quality/vetting varies?

Further to my previous question. I'm now asking for the 'so what' for all app stores... Which app store performs better checks so non-technical users can trust the protection? Including 3rd party app ...
maskin's user avatar
  • 129
0 votes
1 answer
216 views

Privacy related to company VPN

Last week my employer sent me a root cert to access the company’s VPN on my personal iMac. When I am connected to the VPN, I’m aware the VPN server can encrypt/decrypt the traffic, but I have some ...
Peter's user avatar
  • 9
0 votes
1 answer
2k views

How to create PKCS12 container with no password

I have set up 802.1x authentication on my wireless network with EAP-TLS. The use case here is that I would like the presence of a certificate to be both necessary and sufficient for connecting to the ...
matoro's user avatar
  • 186
0 votes
1 answer
5k views

Im get hacked? Why my Iphone opened port 49152 [closed]

i dont understand why my iphone opened port 49152 apple said this port for dynamic i searched on google for several days but i found nothing about this i also factory reset for my iphone but this port ...
jabbawockeezzz99999's user avatar
1 vote
0 answers
94 views

How to send secure api requests? [closed]

When a user pays on the iOS app I want to let the node js backend know. What’s a secure way to authenticate the iOS app with the backend? Is it send a secret key and if so how do I keep this safe from
Chris Hansen's user avatar
0 votes
1 answer
639 views

How to harden the browser on an old iPad Air 1st Gen on iOS 12.5.5?

I have an old iPad Air 1st Generation with the latest supported iOS 12.5.5. How may I maximize its safety against system and browser vulnerabilities? I guess I should not use Safari? So is Brave a ...
Fals's user avatar
  • 1
3 votes
1 answer
134 views

Mobile Application Security

Do we need to carry out separate pentest for apps that are written in language that supports multi platform compilation like fultter? How much value it will bring since backend and major chunk of code ...
Syed Anas's user avatar
  • 131
0 votes
0 answers
164 views

When I visit an http://gofile.me/ link, how much information to I provide to the NAS server owner?

There are files I need from a heavy NAS user and they've given me a link of the form http://gofile.me/xxxxx/xxxxxxxxx If my laptop running the Chrome browser in macOS is connected to the internet via ...
uhoh's user avatar
  • 1,409
3 votes
0 answers
664 views

Can "Dylib Hijacking" happen on iOS app?

I'm told that Dylib Hijacking vulnerability exists on Mac applications. And he told me that, in theory, it can also happen on iOS apps. I googled a lot for any discussion about it, but nothing was ...
Toru's user avatar
  • 131
3 votes
2 answers
2k views

Should I be worried about an "untrusted enterprise developer" on iOS?

I have to install some apps on my personal iPhone developed by a large company. My phone warns me that they're "untrusted enterprise developer" and not the "App Store" I must give ...
Ink's user avatar
  • 131
-2 votes
1 answer
399 views

Why are mobile phones OS easily hackable (Pegaus & Co)

Every now and then, you here a story about misuses of mobile OS' spyware softwares, developed by technology firms which usually sell their products to governments or groups with similar power. You ...
Johnny's user avatar
  • 1
0 votes
0 answers
977 views

Storing a private key in android/ios keychain encrypted or not

In my app, the user must use a private key to sign a transaction (on a blockchain). (It is quite common) I am facing questions regarding how to store my user's private key on the device. I am to use a ...
Raphael St's user avatar
0 votes
1 answer
739 views

What happens when app have access to your photos?

These days I see many apps request access to photos on iPhone. I understand app request access to photos to iOS which then request access to me, that sounds ok. In that context I can allow access to ...
KcFnMi's user avatar
  • 141
0 votes
1 answer
795 views

How could someone hack/take control of an iPhone?

I'm interested to know how someone would be able to hack (i.e. gain remote access) to an iPhone. Would knowing the iCloud password tied to the device be sufficient? Or would they also need to have ...
Albert Kinterman's user avatar
0 votes
1 answer
242 views

Submitting password over untrusted VPN

Hi,I do not work in IT security and hence am asking some general questions here. I read https://security.stackexchange.com/a/172821/266785 and have questions that would appreciate answers. Is my ...
user266785's user avatar
1 vote
1 answer
332 views

Custom PKI for TLS in iOS vs. Android

The scenario An app on iOS has to perform an HTTPS connection, validating the server's TLS certificate against a root CA of a custom PKI. The target Android seems to have best-practice procedures to ...
just-a-user's user avatar
9 votes
3 answers
9k views

Can we prevent SSL Pinning Bypass by pinning key instead of certificate?

I have certificate pinning implemented in my iOS and Android apps. But when apps were pen-tested, we got the report from the pentester saying SSL implementation is weak in both the apps and can be ...
HAK's user avatar
  • 201
0 votes
1 answer
1k views

Man-in-the-Middle Mobile (e.g. Android) Application Tool

I'm trying to MITM an Android application but I cannot get it to work properly. Usually, I'm using Burp for those kind of attacks, which allows me to intercept and decrypt HTTPS traffic. (Assuming the ...
Azulath's user avatar
1 vote
1 answer
596 views

Are updated iOS devices vulnerable to NSO Pegasus?

The Trident memory zero-day, zero-click vulnerabilities (exploits critical to NSO Pegasus success) were supposedly patched on iOS by Apple: CVE-2016-4657 CVE-2016-4655 CVE-2016-4656 Android phones ...
hobs's user avatar
  • 161
6 votes
1 answer
935 views

How do VPN kill switches in mobile apps actually work?

From my understanding, a VPN kill switch modifies routing to make sure that all traffic must be sent through the VPN's tunnel interface, and otherwise internet access is restricted. On desktop ...
Letal1s's user avatar
  • 109
0 votes
0 answers
2k views

Site "Not Secure" warning on Safari iOS, only on one device

Summary We are running a web site (https only) and have a single bug report from a user that says the site gets warned as "Not secure". The user gets this warning only when accessing it from ...
Stan Portland's user avatar
0 votes
1 answer
177 views

What are the risks to an app in supporting older iOS versions?

I'm a developer working on an application that supports minimum iOS 10. It concerns me that we are supporting such an old version of iOS but the client wishes to support customers with older iPhones ...
user avatar
0 votes
1 answer
2k views

Nmap Scan Shows Filtered Ports for VNC, RDP, SAMBA & SSH on iOS - is this normal?

I ran an nmap scan on my iPad’s IP address and the results showed the following ports listed below available in a filtered state. See screenshot for the actual terminal results. SSH Netbios-ssn ms-...
petergibbons's user avatar
3 votes
0 answers
603 views

Alternatives to OAuth 2 for first-party native applications

I am currently thinking about alternative ways for my native iOS Application (written in Swift) to receive access- & refresh-tokens. As of now, user sessions are established using revokable JWTs, ...
linus_hologram's user avatar
13 votes
5 answers
6k views

Why are there more research papers on Android malware than iOS malware?

Based on this question. Why are there more research papers on Android malware than iOS malware?
Marcus's user avatar
  • 1,155
0 votes
1 answer
594 views

Why don't researchers care about iOS malware? [closed]

I see Android malware being mentioned when reading peer reviewed papers about malware detection for smartphones, but iOS is never mentioned. Even Malwarebytes says: Historically, iOS has never been ...
Marcus's user avatar
  • 1,155

1
2 3 4 5
10