Positive Hack Days, profile picture
Uploaded byPositive Hack Days
PPTX, PDF3,479 views

iOS Application Exploitation

An iOS application penetration testing training covers various topics including: - Setting up an iOS pen testing environment and understanding the iOS filesystem. - Understanding the Objective-C runtime and performing runtime analysis and manipulation. - Analyzing insecure data storage in plist files, NSUserDefaults, CoreData, and the keychain. - Identifying side channel data leakage through device logs, application snapshots, and the pasteboard.

Downloaded 90 times
1 / 139
2 / 139
3 / 139
4 / 139
5 / 139
6 / 139
7 / 139
8 / 139
9 / 139
10 / 139
11 / 139
12 / 139
13 / 139
14 / 139
15 / 139
16 / 139
17 / 139
18 / 139
19 / 139
20 / 139
21 / 139
22 / 139
23 / 139
24 / 139
25 / 139
26 / 139
27 / 139
28 / 139
29 / 139
30 / 139
31 / 139
32 / 139
33 / 139
34 / 139
35 / 139
36 / 139
37 / 139
38 / 139
39 / 139
40 / 139
41 / 139
42 / 139
43 / 139
44 / 139
45 / 139
46 / 139
47 / 139
48 / 139
49 / 139
50 / 139
51 / 139
52 / 139
53 / 139
54 / 139
55 / 139
56 / 139
57 / 139
58 / 139
59 / 139
60 / 139
61 / 139
62 / 139
63 / 139
64 / 139
65 / 139
66 / 139
67 / 139
68 / 139
69 / 139
70 / 139
71 / 139
72 / 139
73 / 139
74 / 139
75 / 139
76 / 139
77 / 139
78 / 139
79 / 139
80 / 139
81 / 139
82 / 139
83 / 139
84 / 139
85 / 139
86 / 139
87 / 139
88 / 139
89 / 139
90 / 139
91 / 139
92 / 139
93 / 139
94 / 139
95 / 139
96 / 139
97 / 139
98 / 139
99 / 139
100 / 139
101 / 139
102 / 139
103 / 139
104 / 139
105 / 139
106 / 139
107 / 139
108 / 139
109 / 139
110 / 139
111 / 139
112 / 139
113 / 139
114 / 139
115 / 139
116 / 139
117 / 139
118 / 139
119 / 139
120 / 139
121 / 139
122 / 139
123 / 139
124 / 139
125 / 139
126 / 139
127 / 139
128 / 139
129 / 139
130 / 139
131 / 139
132 / 139
133 / 139
134 / 139
135 / 139
136 / 139
137 / 139
138 / 139
139 / 139
PRATEEK GIANCHANDANI 1 iOS Application Penetration testing Twitter:@prateekg147 EGOR TOLSTOY Twitter:@igrekde
• Intro to iOS applications • Setting up an iOS pen testing environment • Understanding the iOS filesystem • Understanding the Objective-C runtime • Runtime analysis and manipulation • Insecure Data storage • Side channel data leakage • URL schemes • Analyzing network traffic over HTTP/HTTPs/Cert pinning • Jailbreak detection • Broken cryptography • Secure coding guidelines • Patching iOS applications • Automated testing AGENDA
Intro to iOS applications WHAT DO iOS apps look like ? • Developed using Apple’s SDK Xcode. • Distributed as .ipa files through the App store. • Compiled for ARM architecture. • Requires a provisioing profile to sign the application. • Encrypted with FairPlay DRM and signed with Apple’s signature.
Intro to iOS applications Types of iOS applications • Native applications – Developed in Objective-C. Deliver much better performance than web applications. • Web applications – Developed in Html, CSS and javascript. Run using Webkit. • Hybrid applications – Combination of a web and native application.
Intro to iOS applications iOS app specific terms • AppDelegate • ViewController • UIView • Properties, instance variables • NSString, NSNumber, NSInteger etc • Categories, protocols
Intro to iOS applications What is Objective-C ? Objective-C is a general-purpose, object-oriented programming language that adds Smalltalk-style messaging to the C programming language. It is the main programming language used by Apple for the OS X and iOS operating systems, and their respective application programming interfaces (APIs), Cocoa and Cocoa Touch. Source: Wikipedia
Intro to iOS applications Objective C continued Instantiation MyObject *o = [[MyObject alloc] init]; MyObject *o = [[MyObject alloc] initWithString:myString]; NSArray *myArray = [NSArray arrayWithObjects:object1,object2,object3,nil]; Calling Methods [self doSomething]; [MainViewController performTaskWithID:[NSNumber numberWithInt:1]];
Intro to iOS applications Header files have the extension .h while implementation files have the extension .m A sample implementation file Objective-C continued
Intro to iOS applications Simple Hello World !
• Swift is a brand new native programming language for iOS, introduced at WWDC’14 for the first time. • Even when written without a single line of Objective-C code, every Swift app executes inside the Objective-C runtime. • This may not always be the case – with the release of Swift-only system frameworks a full Swift runtime may appear. Introduction to Swift
• The important thing is that instead of objc_msgSend() method call, Swift classes operate with vtable (which contains the table of available methods). • vtables are created at compile time (when objc dispatch tables are generated dynamically). • This table contains functions pointers accessed by index, so it doesn’t need to bind selector to implementation. Introduction to Swift
• Another interesting Swift feature is Name Mangling. Prepare to see something like __TFCCC4test1a1b1c1dfS2_FTS0_1xS1_1vFT1xSi_Si_OVS_1e1f when analysing Swift apps. • This string holds not only the exact function name, but also information about it’s type, parameters, nested classes etc. This is made for holding all the necessary method information in one string in the vtable. • The same thing goes for Class names. • You can use the function _stdlib_demangleName() for demangling. Introduction to Swift
Setting up an iOS pen testing environment WHAT YOU NEED ? • A jailbroken iOS device (up to iOS 8.2) • Xcode installed on your system • Some tools that need to be installed on your jailbroken device
• Jailbreak your device by downloading the pangu software from pangu.io • Click on “Start Jailbreak”and follow the process to jailbreak your device
• For iOS 8.2 and iOS 8.3 you can make “Semi Jailbreak” using Safari – just visit the page http://pangu8.com/82.html • You’ll have to visit this page each time after rebooting your device
• Big boss recommended tools from cydia • Open SSH • class-dump or class-dump-z (https://code.google.com/p/networkpx/wiki/class_dump_z) • cycript (http://www.cycript.org/) • clutch (https://dl.dropboxusercontent.com/u/34557464/clutch) • gdb (https://dl.dropboxusercontent.com/u/34557464/gdb) • For iOS 8, make sure you tap on Refresh the first time you open up Cydia. Also install the following on your device
iOS File system Ref: File system programming guide
• Download a good file explorer utility like iExplorer or iFunbox Understanding the iOS filesystem
• Download a good file explorer utility like iExplorer. Understanding the iOS filesystem
• All the applications installed by Apple by default go inside the /Applications directory and run with the user root • All the applications downloaded from the app store go inside /var/mobile/applications and run with the user mobile (iOS 7) • Every application runs in its own environment known as the application sandbox, thereby preventing it to access resources from other applications. This is done to enforce additional security. • For iOS 8, the applications downloaded from App store reside in /var/mobile/Containers/Bundle/Application
• Downloaded applications bundles reside in /var/mobile/Containers/Bundle/Application/<ID>/. Here you can find the *.app file with all the resources included. • Their /Documents and /Library data reside in /var/mobile/Containers/Data/Application/<ID>/. Here you can found writable application data, such as *.sqlite dbs or plist files. • Starting from iOS 8.0 many applications have different extensions (widgets). Their shared data can be found in /var/mobile/Containers/Shared/AppGroup/<ID>.
Here is how a typical application directory looks like The *.app folder contains the application binary.
Here is how a typical shared application directory looks like
Xcode IDE for developing native iOS applications https://developer.apple.com/xcode/
Understanding the Objective-C runtime • All native iOS applications are Objective-C, which is a runtime oriented language. • Objective-C defers decisions from compile time and link time to the time when the code in the application is actually being executed. • Gives rise to a category of attacks knows as runtime manipulation. • Variables and properties can be analyzed and modified at runtime. • Messages aren’t bound to method implementations until runtime, thereby allowing us to modify the method implementations. • The functions are implemented in the shared library found at /usr/lib/libobjc.A.dylib.
Usage: otool -l [binaryName]
• Command line utility. Extremely helpful tool in iOS pentesting. • Extracts class information from unencrypted Mach-O binaries. • Helps in finding out the method names, properties, protocols being used in any class. • Tells a lot about the design of the application. • Information is presented in a readable format. class-dump-z
Usage: class-dump-z [binaryName]
• Application that are installed by default on iOS device won’t be encrypted, and hence class information can be dumped without any issues. • For applications downloaded from the App store, you must decrypt the application first using clutch. class-dump-z
Usage: clutch [App Name] • Just using the clutch command will display a list of applications that can be decrypted. • Use “clutch [App Name]” to decrypt the application. The decrypted ipa file will be stored in the location as shown below.
{
• Unzip the ipa file to a new folder. • Dump the class information from the binary inside this folder.
• According to cycript.org - Cycript allows developers to explore and modify running applications on either iOS or Mac OS X using a hybrid of Objective-C++ and JavaScript syntax through an interactive console that features syntax highlighting and tab completion. • Allows the user to hook into a running process during runtime and modify the values of instance variables, global variables, swizzle method implementations, call a particular method etc. • Complete documentation can be found at http://www.cycript.org/ Cycript
Setting up Cycript
Runtime analysis using Cycript • You can hook into the runtime of an application by using the command “cycript -p [PID]” • Some cool things that you can do with Cycript can be found here http://iphonedevwiki.net/index.php/Cycript_Tricks
• For the case below, you can define a method named printMethods that takes input as a class and prints out all its methods. • This method has been taken from http://iphonedevwiki.net/index.php/Cycript_Tricks • For e.g, you can define your own methods.
• You can also use the messages property of a class to print out all its messages, for e.g “AppDelegate.messages”. This will only print out the instance methods.
• If you want to print out the class methods as well, use the isa pointer and print out its messages. The isa pointer for any object is a pointer to its class structure. For e.g “AppDelegate->isa.messages” • This will print out the class methods as well.
• Similarly, you can also print out the instance methods of any view controller, class etc. In the example below, i am printing out the instance methods for the class RuntimeManipulationVC.
Runtime manipulation using Cycript • With cycript, you can manipulate the values of instance variables, global variables for a particular class. • You can also modify method implementations.
Runtime manipulation demo • In this case, we are manipulating the instance variable “urlToLoad” in the view controller RuntimeManipulationDetailsVC for DamnVulnerableiOSApp (http://damnvulnerableiosapp.com) • The first step is to get a reference to the view controller. • Once you get the reference, you can modify any of it’s variables. • For e.g UIApp.keyWindow.rootViewController.topViewController.topViewCont roller.urlToLoad = [NSString stringWithFormat:@"http://google.com"];
• We can also swizzle method implementations and replace the method implementation with our own. • Let’s assume you find a method with the name isLoginValidated in a particular view controller that returns a YES or NO depending on whether the login information is correct or not. • To try this demo, download Damn Vulnerable iOS app from http://damnvulnerableiosapp.com Runtime manipulation demo (Method Swizzling)
• We can modify this method’s implementation to always return TRUE. • As you can see, the code on the R.H.S is actually Javascript, this is the beauty about Cycript, it can related both Objective-C and javascript syntax. Runtime manipulation demo (Method Swizzling) • RuntimeManipulationDetailsVC.messages['isLoginValidated'] = function() {return TRUE;}
• Plist • NSUserDefaults • CoreData (Sqlite) • Keychain Insecure Local Data Storage There are many ways of storing data locally on an iOS device. Some of these techniques are …
• Data stored in plist files is stored unencrypted in the application sandbox. • An attacker doesn’t even need to have a jailbroken device to access the contents of the plist file. It can be accessed using simple file explorer utilities like iExplorer. • Most often, developers make the mistake of storing confidential data in Plist files. Plist
Plist • Sample code for storing data in plist files.
Plist • These files can be easily found using any simple file explorer utility like iExplorer in the application folder.
Plist • On inspecting these files, you can find the information being saved in the plist file.
Plist • Do not use plist files to store confidential information like username/passwords. • Do not store session ID’s , important properties etc in a plist file. • Plist files should only be used to store information that is not important, for e.g, a list of image names, the last launch date of the application etc.
NSUserDefaults • Used for storing properties, objects that can persist even after an application restart. • Information is saved unencrypted inside the application sandbox in a plist file with the name [BUNDLE_ID].plist inside the folder Library -> preferences . • Developers make a common mistake of storing critical data using NSUserDefaults.
NSUserDefaults • All the information stored using NSUserDefaults can be found inside the file [BUNDLE_ID].plist inside the folder Library -> Preferences.
NSUserDefaults • All the key/value pairs stored using NSUserDefaults can be found in this file.
Core Data • Core Data framework is used to store persistent data, manage relationships between objects etc. • Information is again saved unencrypted on the device in .db or .sqlite files. • An attacker can gather information about Core data objects by using a sqlite client.
• Navigate to your application directory and look for files with the extension .db or .sqlite. • Use an sqlite client to access these files. Core Data
• Navigate to your application directory and look for files with the extension .db or .sqlite. • Use an sqlite client to access these files. • You can dump information from the tables in the database using the commands as shown in the image below. Core Data
Core Data Sqlite browser can be used for quick analysis of sqlite databases
Core Data • Core data framework should not be used to store confidential information as the information is stored unencrypted on the device. • If you want to use some confidential informaiton, encrypt it before saving locally or use some wrappers over core data that store encrypted information on the device.
Keychain • It is the most secure way of storing information locally on the device. • Used by most of the popular application like Gmail, Facebook to store confidential information like passwords, authentication tokens etc. • Common database for all apps. Data is stored outside of the application sandbox. • Currently, information stored in the keychain can only be dumped from a jailbroken device using a tool named Keychain Dumper. • https://github.com/ptoomey3/Keychain-Dumper
Keychain • One line implementation. • Access group allows applications to share keychain data. KeychainItemWrapper *wrapper = [[KeychainItemWrapper alloc] initWithIdentifier:@“Identifier” accessGroup:nil]; The same access group has to be given from both the apps and both the app ID’s have to be mentioned in the plist file for both the applications.
Storing Data in Keychain • Using Keychain is quite simple (especially with third-party wrappers). One of them is SSKeychain (https://github.com/soffes/sskeychain): • [SSKeychain setPassword:@”secretkey” forService:@”DVIA” account:@”Admin”]; • NSString *pass = [SSKeychain passwordForService:@”DVIA” account:@”Admin”];
Keychain dumper demo
Keychain dumper demo • Keychain information dumped for the application Damn Vulnerable iOS app can be clearly found in the image below. • Even though keychain is one of the most secure places to store information, consider adding an extra layer of encryption before saving data in the application to make the job for the attacker more difficult.
Realm • Realm is a popular third-party cross-platform built on a custom C++ core. • Just like in all other cases information is stored unencrypted in the /Documents folder, in the *.realm files. • An attacker can gather information using the default Realm Browser: https://github.com/realm/realm- cocoa/tree/master/tools/RealmBrowser
Realm
Apple Watch • Apple Watch is the new wearable device from Apple. • All the Apple Watch apps are simply extensions of native iOS applications.
Apple Watch • The running app extension and containing app have no direct access to each other’s containers, so they use a shared data directory for data syncing. • Their shared data can be found in /var/mobile/Containers/Shared/AppGroup/<ID>. • So, all the Insecure Data Storage vulnerabilities can be applied to Apple Watch extensions.
Side Channel Data leakage • There are many different ways in which data can be leaked from the application without the awareness of the developer. • Device Logs • Application snapshots • Pasteboard • Keystroke logging • Cookies
Device Logs • Some developer use logs while debugging their applications but forget to remove them while releasing the application. • To see the device logs while you are running an application, make sure that the device is connected to your computer. • In Xcode, go to Window -> Organizer -> Device -> Your Device -> Console
Device Logs • Device logs should only be enabled for DEBUG mode in the application, this will ensure that the logs are disabled when the application is downloaded from the App store and run on a user’s device.
Application Snapshots • iOS by default takes a screenshot of your application when you take the application to background by pressing the home button. • This screenshot is shown to the user when he opens the app again while the app is loaded in the background. • Provides a seamless experience. • The problem is that the screenshot is stored without any protection in the application folder. • Sometimes, these screenshots can contain confidential information that might be leaked to an attacker.
Application Snapshots • The following image shows the application snapshot stored in the application folder
Pasteboard • Data copied using the cut/copy features in iOS goes inside a buffer known inside a pasteboard item. • It is possible for other applications to access the content of this pasteboard. • If the pasteboard item contains some confidential information, it might lead to information leakage.
Pasteboard • Data can be copied using the Copy feature in iOS. • Once it is copied, it remains in the buffer.
Pasteboard • Using the following command in Cycript or any other app can dump out the contents of the pasteboard. [UIPasteboard generalPasteboard].items[0]
Pasteboard • For text fields that might contain secure information, make sure the Secure property is set. • Clear pasteboard contents when the application enters background. [UIPasteboard generalPasteboard].items[0] 55544555555 • Use pasteboard with specific identifiers, this makes it difficult for other applications to fetch data from this pasteboard item.
Keystroke logging • iOS by default logs every input that you enter in any text field unless the secure flag is not set. • This helps in autocorrecting the user later. • All the keystroke logs can be easily fetched out from a device. • These logs might contain information that is important. • Logs remain stored on the device for a long time hence making it even more insecure. • Logs are stored in a file with the extension .dat in the location “/var/mobile/Library/Keyboard/“
Keystroke logging • The prefix of the file denotes the language in which the keystroke logs are stored. • Here is how a part of the logs file look like.
Cookies • Some applications create persistance cookies and store them in cookies.binarycookies file in application’s home directory. • The sample code for storing cookies: • [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookie:cookie]; • The path to cookies is: /Library/Cookies/Cookies.binarycookies [UIPasteboard generalPasteboard].items[0] 55544555555
Cookies • Revealing cookies is quite easy: • Download the python script BinaryCookieReader.py from http://securitylearn.net/wp- content/uploads/tools/iOS/BinaryCookieReader.py • Download the Cookies.binarycookies file from your device. • Run binarycookiereader.py /file-path-to-cookies
Cookies • This is the example from Aeroflot mobile application:
URL Schemes • Used for IPC between applications. • Every application can register for a particular URL scheme. • Any url starting with that particular URL scheme invokes the application that is registered to handle that url. • For e.g, the facebook iOS application registers for the URL scheme “fb” • Url’s starting with fb:// will invoke the facebook iOS application. • The Facebook iOS application will decide what to do with that particular url depending on its parameters. • For e.g fb://chat_text?name=Prateek&message=Hello
URL Schemes • Any application can call a url starting with a particular url scheme and invoke the registered application. • Attacker can also embed the url inside an iframe in a malicious page, when the user visits the page, the url will execute and the registered application will be called. • These URL schemes can be used to execute important operations, for e.g FaceTime iOS app allows other apps to call user via URL scheme. • The problem happens when the operation is executed without any validation from the user.
• A simple solution for this is to validate the action before performing it. • For critical apps, you can also set a list of whitelisted applications and only allow them to invoke an action. This can be checked by the sourceApplication property in the calling method. • Skype URL scheme vulnerability http://software-security.sans.org/blog/2010/11/08/insecure- handling-url-schemes-apples-ios/ URL Schemes
• How to find out the URL scheme used by a particular application ? • This info can be found from the Info.plist file. URL Schemes
• Look for the property CFBundleURLSchemes inside CFBundleURLTypes -> Item 0 • As we can see, the Facebook iOS app registers for quite a lot of URL schemes. URL Schemes
• Another important thing could be to find out the URL structure an application is expecting in order to perform a certain action. • This can be found by reverse engineering the application using tools like Hopper (hopperapp.com) and looking for strings that start with that particular URL scheme or looking at the disassembly of this method in the AppDelegate class. • Related article: http://highaltitudehacks.com/2014/03/07/ios- application-security-part-30-attacking-url-schemes URL Schemes
• It is important to analyze the network traffic that flows between the client/server in an application. • Look for credentials, authentication tokens, API keys being transmitted over unsecured http channel. • Check for the entropy in Session ID’s. • Traffic can be analyzed using a simple proxy tool like Burp proxy. • Try to manipulate the request/response using Burp and see how the client side application responds to it. Analyzing network traffic over HTTP/HTTPs
Analyzing traffic over HTTP • Configure Burp Proxy to start listening for traffic. Make sure it is listening on all interfaces.
Analyzing traffic over HTTP • Configure your iOS device to use your computer as a proxy.
Analyzing traffic over HTTP • You can now intercept the traffic as it goes to the server.
Analyzing traffic over HTTPs • This will require you to install Burp’s CA certificate as a trusted root on your device. • Configure your browser to relay traffic over Burp proxy.
Analyzing traffic over HTTPs You will get a warning, click on Add Exception.
Analyzing traffic over HTTPs • Click on View.
Analyzing traffic over HTTPs • Go to Details, select the topmost certificate, click on Export and save the file with extension as .crt
Analyzing traffic over HTTPs • Send this file to your device via email, click on it and Install it. Accept all the instructions and click on Done.
Analyzing traffic over HTTPs • Quit and restart the application you want to sniff traffic for. You will now be able to see the traffic even if it is over HTTPs
Certificate pinning • The server’s certificate is hardcoded in the application bundle and checked while exchanging data with the server. • Provides protection against MITM attacks. • Used by applications like Twitter, Square etc.
Certificate pinning • The server’s certificate is hardcoded in the application bundle and checked while exchanging data with the server. • Provides protection against MITM attacks. • Used by applications like Twitter, Square etc.
Certificate pinning bypass • Certificate pinning can be bypassed by hooking into some low level methods during runtime. • iOS SSL kill switch was released in Blackhat to demonstrate this. • https://github.com/iSECPartners/ios-ssl-kill-switch
Certificate pinning bypass • Once it is enabled, user can see the traffic through applications like Twitter as well.
• Most of modern applications use some third-party services for analytics, data storage, push-notifications, crash- reporting, social-auth and so on. • Besides different vulnerabilities in SDKs, this opens a couple of new attack vectors for penetration tester: • The unsecure storage of API keys, • The lack of security on the server-side. Attacking Third-Party Services
• Parse.com is a MBaaS which helps with setting up backend infrastructure for mobile applications. Some of its capabilities: • Cloud data storage • Push notifications • Cloud code hosting • Gathering usage statistics Attacking Parse.com
• All the data in Cloud Core is stored in Parse Classes (ordinary database tables). Attacking Parse.com
• There are different levels of access-permissions: class level and object level. We’re going to investigate CLA. • All of Class Level Access permissions are set to Public by default. Attacking Parse.com
• Using Hopper we can extract the API keys and Parse Classes names from target application: Attacking Parse.com
• Now you can query the Parse API using these keys: • [Parse setApplicationId:<APP_ID> clientKey:<CLIENT_KEY>] • PFQuery *query = [PFQuery queryWithClassName:@”Target”]; • NSArray *data = [query findObjects]; • You can perform all the CRUD operations on class with Public access permissions. Attacking Parse.com
• To simplify these tasks, you can use the Parse Revealer utility: https://github.com/igrekde/ParseRevealer • It automates the analysis of access permissions and structure of provided classes. Attacking Parse.com
• Flurry.com is the most popular mobile analytics service. • It uses the single API key to identify the application. This key can be retrieved using Hopper app. • With this key an attacker can build his own application, generating a large number of random events and pollute the target app’s statistics monitoring. It can lead to impossibility of statistics analysis, which is very crucial for popular applications. Attacking Flurry.com
• Starting session: [Flurry startSession:@”API_KEY”]; • Logging events: [Flurry logEvent:@”EVENT_NAME” withParameters:params]; • Logging page views: [Flurry logPageView]; Attacking Flurry.com
• For critical applications like banking applications etc, it is important that you ensure that the application doesn’t work on a jailbroken device. • With a copy of your app’s binary and tools like Cycript at his disposal, an attacker is in complete control. • It is therefore important to check for a jailbroken device and disable certain features of the application or quit the application in order to protect it. Jailbreak Detection
• There are many ways to check for a jailbroken device. • Checking for specific files that exist on a jailbroken device is one of the most common techniques being used. • Another way is to check if the application is able to modify a file outside it’s own sandbox. • Most than 80% of the jailbroken devices have Cydia installed, so check if you can open a url that starts with Cydia’s URL scheme, i.e cydia:// • It is important to note that no that there is no foolproof technique to detect a jailbroken device, however a combination of checks can make the job difficult for even a skilled hacker. Jailbreak Detection
• There are many ways to check for a jailbroken device. • Checking for specific files that exist on a jailbroken device is one of the most common techniques being used. • Another way is to check if the application is able to modify a file outside it’s own sandbox. • Most than 80% of the jailbroken devices have Cydia installed, so check if you can open a url that starts with Cydia’s URL scheme, i.e cydia:// • It is important to note that no that there is no foolproof technique to detect a jailbroken device, however a combination of checks can make the job difficult for even a skilled hacker. Jailbreak Detection
+(BOOL)isJailbroken{ #if !(TARGET_IPHONE_SIMULATOR) if ([[NSFileManager defaultManager] fileExistsAtPath:@"/Applications/Cydia.app"]){ return YES; }else if([[NSFileManager defaultManager] fileExistsAtPath:@"/Library/MobileSubstrate/MobileSubstrate.dylib"]){ return YES; }else if([[NSFileManager defaultManager] fileExistsAtPath:@"/bin/bash"]){ return YES; }else if([[NSFileManager defaultManager] fileExistsAtPath:@"/usr/sbin/sshd"]){ return YES; }else if([[NSFileManager defaultManager] fileExistsAtPath:@"/etc/apt"]){ return YES; } NSError *error; NSString *stringToBeWritten = @"This is a test."; [stringToBeWritten writeToFile:@"/private/jailbreak.txt" atomically:YES encoding:NSUTF8StringEncoding error:&error]; if(error==nil){ //Device is jailbroken return YES; } else { [[NSFileManager defaultManager] removeItemAtPath:@"/private/jailbreak.txt" error:nil]; } if([[UIApplication sharedApplication] canOpenURL:[NSURL URLWithString:@"cydia://package/com.example.package"]]){ //Device is jailbroken return YES; } #endif //All checks have failed. Most probably, the device is not jailbroken return NO; } Jailbreak Detection Combining all these techniques, we get this method.
Jailbreak Detection • The problem is that the signature of this method gives everything away. • Attacker can use Cycript to use bypass the check for jailbreak detection.
Jailbreak Detection • It is better to rename the method to something that doesn’t look important. • Something like +(BOOL)isDefaultColour • Yeah i know, we do ignore the coding guidelines, but in this case, the guidelines are something that gives everything away. • After analyzing the class-dump output of the application, the hacker is most likely to ignore this method. • He can always reverse engineer this method to see what’s going on inside, so this method is also not foolproof.
Broken Cryptography • Occurs when data stored on the device is not encrypted properly. • One of the most common vulnerabilities found in iOS applications. • Can occur by use of deprecated or weak algorithms. • Sometimes the key while encryption is hardcoded in the app thereby making it much easier for the attacker to break the application. • Related article: http://www.andreas-kurtz.de/2013/07/how- to-easily-spot-broken-cryptography.html
Secure coding guidelines • Do not store confidential data using NSUserDefaults, plist files or Core Data framework. Use keychain to store data like passwords, authentication tokens, API-keys etc. • Use proper encryption while storing data locally in any insecure place. Do not use hardcoded keys etc. • Validate incoming URLs using URL schemes and properly authorize the user before taking any action. • Add checks to detect jailbroken device for critical applications like banking applications etc. • Text fields that might contain important information should be marked Secure. This will prevent leaking of data via pasteboard, application snapshots etc. • Use libraries like SQLCipher to encrypt sqlite databases.
• Clear pasteboard data when the application enters into background. • Add checks to prevent debuggers from hooking into your application. Add the highlighted lines of code in your application. Secure coding guidelines
Patching iOS applications • Patching an application changes its login permanently. • This is better that making a change in cycript where you have to repeat the same process over and over again. • Often used to disable checks like Jailbreak detection, piracy check etc. • Tools used for patching iOS application: IDA Pro, Hexfiend and Hopper. • Once an application has been patched, it needs to be resigned using ldid before it can be deployed on the device.
Patching iOS applications • Hopper is one of the best tools available for patching iOS applications. • Not free, but the value for money is very good. • Patching iOS applications with Hopper: http://highaltitudehacks.com/2014/01/17/ios-application-security-part-28- patching-ios-application-with-hopper/ • Patching iOS applications with IDA Pro and Hex fiend:http://highaltitudehacks.com/2013/12/17/ios-application-security- part-26-patching-ios-applications-using-ida-pro-and-hex-fiend
Patching iOS applications • To modify any instruction in Hopper, click on it and click on Modify -> Assemble Instruction.
Patching iOS applications • Make the change and click on Assemble and Go Next
Patching iOS applications • Once the change has been made, click on File -> Produce new executable and overwrite the existing one.
Patching iOS applications • To deploy the application back to your device, resign the application binary first using ldid as shown in the image below. Then copy the .app file to the /Applications directory on the device using Scp. You can also use sftp or the utility iExplorer to upload this application.
Patching iOS applications Now login as the mobile user, use the command su to get root privileges and give the binary executable permissions. Then use the exit command to go back as the mobile user, and use the command uicache to install the application. If this doesn’t work, you can reboot the device or try this method again. You will see that the application has been successfully installed on your device.
Extracting Device Backups • It’s possible to extract the data from iOS device for further researches. • The first way is using libimobiledevice – a library to communicate with different services of iOS devices using native protocols. • You can download it from GitHub: https://github.com/libimobiledevice/libimobiledevice
Extracting Device Backups • Run idevice_id –l for the list of connected devices • Run idevicebackup2 backup --full --source <UDID>~/Documents to make the full backup of the specified device.
Extracting Device Backups • Download iBackupBot: http://www.icopybot.com/itunes-backup- manager.htm • Drag the backup folder to iBackupBot and enjoy browsing.
Extracting Device Backups • The developer can mark files and directories to exclude them from backups. • The backup can be protected by the passcode.
Extracting iCloud Device Backups • The other way of extracting backups is from iCloud. • You need to know the AppleID and password, linked with the target device. • Use iLoot: https://github.com/hackappcom/iloot • > python iloot.py email@icloud.com password
Automated testing • Automating tests while doing an iOS penetration test can help you save a lot of time. • Though not all tests can be automated, there are some tools that do a very good job at this. • Snoop-it - https://code.google.com/p/snoop-it/ • iNalyzer - https://appsec-labs.com/iNalyzer • iRET - https://blog.veracode.com/2014/03/introducing-the-ios- reverse-engineering-toolkit/ • idb - http://www.idbtool.com/ • iSpy - https://github.com/BishopFox/iSpy
Snoop-it • Source: https://code.google.com/p/snoop-it/ • For iOS 7, it currently supports only 32 bit devices. • Related article: http://highaltitudehacks.com/2013/08/20/ios-application- security-part-9-analyzing-security-of-ios-applications-using-snoop-it/
Snoop-it • Here is how the interface looks like.
iNalyzer • Related article: http://highaltitudehacks.com/2013/09/17/ios- application-security-part-15-static-analysis-of-ios-applications- using-inalyzer/
iRET Source: https://blog.veracode.com/2014/03/introducing-the-ios- reverse-engineering-toolkit/ • Related article: https://blog.veracode.com/2014/03/introducing-the-ios- reverse-engineering-toolkit/
idb • Related article: http://highaltitudehacks.com/2014/10/18/ios-application- security-part-35-auditing-ios-applications-with-idb/
iSpy • Related article: https://github.com/BishopFox/iSpy/wiki/Setup-iSpy-from- Source
Further practice Try out all the challenges in Damn Vulnerable iOS App (http://damnvulnerableiosapp.com)
THANK-YOU

More Related Content

PDF
iOS Application Security
byEgor Tolstoy
 
PPT
iOS Application Penetration Testing for Beginners
byRyanISI
 
PPTX
Pentesting iOS Applications
byjasonhaddix
 
PPTX
Vulnerabilities in modern web applications
byNiyas Nazar
 
PPTX
OSSIM Overview
byn|u - The Open Security Community
 
PPTX
Security Code Review 101
byPaul Ionescu
 
PPTX
XXE: How to become a Jedi
byYaroslav Babin
 
PPTX
Enterprise Integration Patterns
bySergey Podolsky
 
iOS Application Security
byEgor Tolstoy
 
iOS Application Penetration Testing for Beginners
byRyanISI
 
Pentesting iOS Applications
byjasonhaddix
 
Vulnerabilities in modern web applications
byNiyas Nazar
 
OSSIM Overview
byn|u - The Open Security Community
 
Security Code Review 101
byPaul Ionescu
 
XXE: How to become a Jedi
byYaroslav Babin
 
Enterprise Integration Patterns
bySergey Podolsky
 

What's hot

PPT
iOS Application Pentesting
byn|u - The Open Security Community
 
PPTX
Android Penetration testing - Day 2
byMohammed Adam
 
PPTX
Nikto
bypenetration Tester
 
PDF
"15 Technique to Exploit File Upload Pages", Ebrahim Hegazy
byHackIT Ukraine
 
PDF
CNIT 126: 10: Kernel Debugging with WinDbg
bySam Bowne
 
PDF
DevSecOpsMaturityModel.pdf
bycdsk335
 
PDF
Android application security testing
byMykhailo Antonishyn
 
PPTX
Introduction to Firebase
byMustafa Şenel
 
PDF
OWASP API Security Top 10 - API World
by42Crunch
 
PDF
DevSecOps: Taking a DevOps Approach to Security
byAlert Logic
 
PDF
WEBINAR: OWASP API Security Top 10
by42Crunch
 
PDF
No Easy Breach DerbyCon 2016
byMatthew Dunwoody
 
PDF
Nessus Software
byMegha Sahu
 
PPTX
Building APIs with Apigee Edge and Microsoft Azure
byApigee | Google Cloud
 
PDF
cert-manager로 let's encrypt 인증서 발급
bychoi sungwook
 
PPTX
OWASP Top 10 2021 Presentation (Jul 2022)
byTzahiArabov
 
PDF
Hunting for Credentials Dumping in Windows Environment
byTeymur Kheirkhabarov
 
PPTX
API Security : Patterns and Practices
byPrabath Siriwardena
 
PDF
The top 10 windows logs event id's used v1.0
byMichael Gough
 
PPTX
Api gateway in microservices
byKunal Hire
 
iOS Application Pentesting
byn|u - The Open Security Community
 
Android Penetration testing - Day 2
byMohammed Adam
 
Nikto
bypenetration Tester
 
"15 Technique to Exploit File Upload Pages", Ebrahim Hegazy
byHackIT Ukraine
 
CNIT 126: 10: Kernel Debugging with WinDbg
bySam Bowne
 
DevSecOpsMaturityModel.pdf
bycdsk335
 
Android application security testing
byMykhailo Antonishyn
 
Introduction to Firebase
byMustafa Şenel
 
OWASP API Security Top 10 - API World
by42Crunch
 
DevSecOps: Taking a DevOps Approach to Security
byAlert Logic
 
WEBINAR: OWASP API Security Top 10
by42Crunch
 
No Easy Breach DerbyCon 2016
byMatthew Dunwoody
 
Nessus Software
byMegha Sahu
 
Building APIs with Apigee Edge and Microsoft Azure
byApigee | Google Cloud
 
cert-manager로 let's encrypt 인증서 발급
bychoi sungwook
 
OWASP Top 10 2021 Presentation (Jul 2022)
byTzahiArabov
 
Hunting for Credentials Dumping in Windows Environment
byTeymur Kheirkhabarov
 
API Security : Patterns and Practices
byPrabath Siriwardena
 
The top 10 windows logs event id's used v1.0
byMichael Gough
 
Api gateway in microservices
byKunal Hire
 

Viewers also liked

PPTX
iOS-Application-Security-iAmPr3m
byPrem Kumar (OSCP)
 
PDF
Reverse Engineering iOS apps
byMax Bazaliy
 
PDF
DeathNote of Microsoft Windows Kernel
byPeter Hlavaty
 
PPTX
iOS Keychain 介紹
byShengWen Chiou
 
PPTX
Power of linked list
byPeter Hlavaty
 
PDF
iOS Application Penetation Test
byJongWon Kim
 
KEY
Security and Encryption on iOS
byGraham Lee
 
iOS-Application-Security-iAmPr3m
byPrem Kumar (OSCP)
 
Reverse Engineering iOS apps
byMax Bazaliy
 
DeathNote of Microsoft Windows Kernel
byPeter Hlavaty
 
iOS Keychain 介紹
byShengWen Chiou
 
Power of linked list
byPeter Hlavaty
 
iOS Application Penetation Test
byJongWon Kim
 
Security and Encryption on iOS
byGraham Lee
 

Similar to iOS Application Exploitation

PDF
Introduction to iOS Penetration Testing
byOWASP
 
PDF
Breaking iOS Apps using Cycript
byn|u - The Open Security Community
 
PDF
OWASP Melbourne - Introduction to iOS Application Penetration Testing
byeightbit
 
PDF
3. Attacking iOS Applications (Part 2)
bySam Bowne
 
PDF
Wahckon[2] - iOS Runtime Hacking Crash Course
byeightbit
 
PDF
CrikeyCon 2015 - iOS Runtime Hacking Crash Course
byeightbit
 
PDF
Ruxmon April 2014 - Introduction to iOS Penetration Testing
byeightbit
 
PPTX
Hacking & Securing of iOS Apps by Saurabh Mishra
byOWASP Delhi
 
PDF
[CONFidence 2016] Sławomir Kosowski - Introduction to iOS Application Securit...
byPROIDEA
 
PDF
Pentesting iOS Apps
byHerman Duarte
 
PDF
NCC Group 44Con Workshop: How to assess and secure ios apps
byNCC Group
 
PDF
Pentesting iOS Apps - Runtime Analysis and Manipulation
byAndreas Kurtz
 
PDF
OWASP for iOS
byPhineas Huang
 
PDF
CNIT 128 3. Attacking iOS Applications (Part 2)
bySam Bowne
 
PDF
CNIT 128: 3. Attacking iOS Applications (Part 2)
bySam Bowne
 
PDF
CNIT 128 2. Analyzing iOS Applications (Part 1)
bySam Bowne
 
PDF
2a Analyzing iOS Apps Part 1
bySam Bowne
 
PDF
Dark Side of iOS [SmartDevCon 2013]
byKuba Břečka
 
PDF
ASFWS 2012 - Audit d’applications iOS par Julien Bachmann
byCyber Security Alliance
 
PDF
Synack at AppSec California with Patrick Wardle
bySynack
 
Introduction to iOS Penetration Testing
byOWASP
 
Breaking iOS Apps using Cycript
byn|u - The Open Security Community
 
OWASP Melbourne - Introduction to iOS Application Penetration Testing
byeightbit
 
3. Attacking iOS Applications (Part 2)
bySam Bowne
 
Wahckon[2] - iOS Runtime Hacking Crash Course
byeightbit
 
CrikeyCon 2015 - iOS Runtime Hacking Crash Course
byeightbit
 
Ruxmon April 2014 - Introduction to iOS Penetration Testing
byeightbit
 
Hacking & Securing of iOS Apps by Saurabh Mishra
byOWASP Delhi
 
[CONFidence 2016] Sławomir Kosowski - Introduction to iOS Application Securit...
byPROIDEA
 
Pentesting iOS Apps
byHerman Duarte
 
NCC Group 44Con Workshop: How to assess and secure ios apps
byNCC Group
 
Pentesting iOS Apps - Runtime Analysis and Manipulation
byAndreas Kurtz
 
OWASP for iOS
byPhineas Huang
 
CNIT 128 3. Attacking iOS Applications (Part 2)
bySam Bowne
 
CNIT 128: 3. Attacking iOS Applications (Part 2)
bySam Bowne
 
CNIT 128 2. Analyzing iOS Applications (Part 1)
bySam Bowne
 
2a Analyzing iOS Apps Part 1
bySam Bowne
 
Dark Side of iOS [SmartDevCon 2013]
byKuba Břečka
 
ASFWS 2012 - Audit d’applications iOS par Julien Bachmann
byCyber Security Alliance
 
Synack at AppSec California with Patrick Wardle
bySynack
 

More from Positive Hack Days

PPTX
Развитие сообщества Open DevOps Community
byPositive Hack Days
 
PPTX
Типовая сборка и деплой продуктов в Positive Technologies
byPositive Hack Days
 
PPTX
Использование анализатора кода SonarQube
byPositive Hack Days
 
PPTX
Инструмент ChangelogBuilder для автоматической подготовки Release Notes
byPositive Hack Days
 
PDF
Уязвимое Android-приложение: N проверенных способов наступить на грабли
byPositive Hack Days
 
PDF
Мастер-класс «Трущобы Application Security»
byPositive Hack Days
 
PDF
Credential stuffing и брутфорс-атаки
byPositive Hack Days
 
PDF
SOC для КИИ: израильский опыт
byPositive Hack Days
 
PPTX
Методика определения неиспользуемых ресурсов виртуальных машин и автоматизаци...
byPositive Hack Days
 
PDF
Теоретические основы Application Security
byPositive Hack Days
 
PPTX
Как мы собираем проекты в выделенном окружении в Windows Docker
byPositive Hack Days
 
PPTX
От экспериментального программирования к промышленному: путь длиной в 10 лет
byPositive Hack Days
 
PPTX
Аналитика в проектах: TFS + Qlik
byPositive Hack Days
 
PDF
Формальная верификация кода на языке Си
byPositive Hack Days
 
PDF
Эвристические методы защиты приложений
byPositive Hack Days
 
PDF
Honeywell Industrial Cyber Security Lab & Services Center
byPositive Hack Days
 
PPTX
Механизмы предотвращения атак в ASP.NET Core
byPositive Hack Days
 
PPTX
Требования по безопасности в архитектуре ПО
byPositive Hack Days
 
PPTX
Автоматизация построения правил для Approof
byPositive Hack Days
 
PDF
Формальные методы защиты приложений
byPositive Hack Days
 
Развитие сообщества Open DevOps Community
byPositive Hack Days
 
Типовая сборка и деплой продуктов в Positive Technologies
byPositive Hack Days
 
Использование анализатора кода SonarQube
byPositive Hack Days
 
Инструмент ChangelogBuilder для автоматической подготовки Release Notes
byPositive Hack Days
 
Уязвимое Android-приложение: N проверенных способов наступить на грабли
byPositive Hack Days
 
Мастер-класс «Трущобы Application Security»
byPositive Hack Days
 
Credential stuffing и брутфорс-атаки
byPositive Hack Days
 
SOC для КИИ: израильский опыт
byPositive Hack Days
 
Методика определения неиспользуемых ресурсов виртуальных машин и автоматизаци...
byPositive Hack Days
 
Теоретические основы Application Security
byPositive Hack Days
 
Как мы собираем проекты в выделенном окружении в Windows Docker
byPositive Hack Days
 
От экспериментального программирования к промышленному: путь длиной в 10 лет
byPositive Hack Days
 
Аналитика в проектах: TFS + Qlik
byPositive Hack Days
 
Формальная верификация кода на языке Си
byPositive Hack Days
 
Эвристические методы защиты приложений
byPositive Hack Days
 
Honeywell Industrial Cyber Security Lab & Services Center
byPositive Hack Days
 
Механизмы предотвращения атак в ASP.NET Core
byPositive Hack Days
 
Требования по безопасности в архитектуре ПО
byPositive Hack Days
 
Автоматизация построения правил для Approof
byPositive Hack Days
 
Формальные методы защиты приложений
byPositive Hack Days
 

Recently uploaded

PDF
Supercharge Your JVM with Project Leyden
byAna-Maria Mihalceanu
 
PDF
AWS re:Invent 2025 Event Presentation Slides
byZilliz
 
PDF
Q8 DIGITAL IDENTITY HUB - WSO2 Oxygenate Italy 2025
byProfesia Srl, Lynx Group
 
PDF
Upskill to Agentic Automation - Working Smarter with AI: Real-World Tools for...
byDianaGray10
 
PDF
TrustArc Webinar - It’s Time to Rethink Privacy
byTrustArc
 
PDF
The Future-Ready PMO: Unlocking Project Success with Copilot and AI Innovatio...
byWellingtone
 
PPTX
Your First Deep Learning project With CNN (workshop).pptx
byMuhammad Fahad Bashir
 
PDF
Data Center Exit to Cloud _ Managed Datacenter Migration.pdf
byAstuteBusiness
 
PPSX
AppSec Role Based Training OWASP Global AppSec USA 2025-11-06
byRobert Grupe, CSSLP CISSP PE PMP
 
PDF
Writing GPU-Ready AI Models in Pure Java with Babylon
byAna-Maria Mihalceanu
 
PPTX
Expanding Your Toolbox: Beginners Guide to Controlling Kubernetes Logs
byEric D. Schabell
 
PDF
Transparency Exchange API: How Do You Find the SBOM for a Smart Light Bulb?
byPavel Shukhman
 
PPTX
Enhancing Web Security: Key Concepts & Strategies.pptx
byParham Abolghasemi
 
PPTX
Getting Started with MSP360 Backup for M365/Google
byMSP360
 
PDF
Analyze and Store Logs - RHCSA (RH124).pdf
byLinuxCert Guru
 
PPTX
GenAI GraphTalk - Kuala Lumpur - 4 Nov 2025
bygourisachdeva2
 
PDF
Cybersecurity in ASEAN and Singapore Columbia SIPA 2025.pdf
byBenjamin Ang
 
PDF
ENTSO-E's Response to the European Commission Call for Evidence on the Strate...
byReynir Orn Bachmann Gudmundsson
 
PDF
Private Governance: How Decentralized Mechanisms Can Regulate the Crypto Economy
byFederico Ast
 
PDF
"Visual Guide to DSA: Big O Notation, Data Structures, and Algorithms Fundame...
byNusrat Gulbarga
 
Supercharge Your JVM with Project Leyden
byAna-Maria Mihalceanu
 
AWS re:Invent 2025 Event Presentation Slides
byZilliz
 
Q8 DIGITAL IDENTITY HUB - WSO2 Oxygenate Italy 2025
byProfesia Srl, Lynx Group
 
Upskill to Agentic Automation - Working Smarter with AI: Real-World Tools for...
byDianaGray10
 
TrustArc Webinar - It’s Time to Rethink Privacy
byTrustArc
 
The Future-Ready PMO: Unlocking Project Success with Copilot and AI Innovatio...
byWellingtone
 
Your First Deep Learning project With CNN (workshop).pptx
byMuhammad Fahad Bashir
 
Data Center Exit to Cloud _ Managed Datacenter Migration.pdf
byAstuteBusiness
 
AppSec Role Based Training OWASP Global AppSec USA 2025-11-06
byRobert Grupe, CSSLP CISSP PE PMP
 
Writing GPU-Ready AI Models in Pure Java with Babylon
byAna-Maria Mihalceanu
 
Expanding Your Toolbox: Beginners Guide to Controlling Kubernetes Logs
byEric D. Schabell
 
Transparency Exchange API: How Do You Find the SBOM for a Smart Light Bulb?
byPavel Shukhman
 
Enhancing Web Security: Key Concepts & Strategies.pptx
byParham Abolghasemi
 
Getting Started with MSP360 Backup for M365/Google
byMSP360
 
Analyze and Store Logs - RHCSA (RH124).pdf
byLinuxCert Guru
 
GenAI GraphTalk - Kuala Lumpur - 4 Nov 2025
bygourisachdeva2
 
Cybersecurity in ASEAN and Singapore Columbia SIPA 2025.pdf
byBenjamin Ang
 
ENTSO-E's Response to the European Commission Call for Evidence on the Strate...
byReynir Orn Bachmann Gudmundsson
 
Private Governance: How Decentralized Mechanisms Can Regulate the Crypto Economy
byFederico Ast
 
"Visual Guide to DSA: Big O Notation, Data Structures, and Algorithms Fundame...
byNusrat Gulbarga
 

iOS Application Exploitation

  • 1.
    PRATEEK GIANCHANDANI 1 iOS ApplicationPenetration testing Twitter:@prateekg147 EGOR TOLSTOY Twitter:@igrekde
  • 2.
    • Intro toiOS applications • Setting up an iOS pen testing environment • Understanding the iOS filesystem • Understanding the Objective-C runtime • Runtime analysis and manipulation • Insecure Data storage • Side channel data leakage • URL schemes • Analyzing network traffic over HTTP/HTTPs/Cert pinning • Jailbreak detection • Broken cryptography • Secure coding guidelines • Patching iOS applications • Automated testing AGENDA
  • 3.
    Intro to iOSapplications WHAT DO iOS apps look like ? • Developed using Apple’s SDK Xcode. • Distributed as .ipa files through the App store. • Compiled for ARM architecture. • Requires a provisioing profile to sign the application. • Encrypted with FairPlay DRM and signed with Apple’s signature.
  • 4.
    Intro to iOSapplications Types of iOS applications • Native applications – Developed in Objective-C. Deliver much better performance than web applications. • Web applications – Developed in Html, CSS and javascript. Run using Webkit. • Hybrid applications – Combination of a web and native application.
  • 5.
    Intro to iOSapplications iOS app specific terms • AppDelegate • ViewController • UIView • Properties, instance variables • NSString, NSNumber, NSInteger etc • Categories, protocols
  • 6.
    Intro to iOSapplications What is Objective-C ? Objective-C is a general-purpose, object-oriented programming language that adds Smalltalk-style messaging to the C programming language. It is the main programming language used by Apple for the OS X and iOS operating systems, and their respective application programming interfaces (APIs), Cocoa and Cocoa Touch. Source: Wikipedia
  • 7.
    Intro to iOSapplications Objective C continued Instantiation MyObject *o = [[MyObject alloc] init]; MyObject *o = [[MyObject alloc] initWithString:myString]; NSArray *myArray = [NSArray arrayWithObjects:object1,object2,object3,nil]; Calling Methods [self doSomething]; [MainViewController performTaskWithID:[NSNumber numberWithInt:1]];
  • 8.
    Intro to iOSapplications Header files have the extension .h while implementation files have the extension .m A sample implementation file Objective-C continued
  • 9.
    Intro to iOSapplications Simple Hello World !
  • 10.
    • Swift isa brand new native programming language for iOS, introduced at WWDC’14 for the first time. • Even when written without a single line of Objective-C code, every Swift app executes inside the Objective-C runtime. • This may not always be the case – with the release of Swift-only system frameworks a full Swift runtime may appear. Introduction to Swift
  • 11.
    • The importantthing is that instead of objc_msgSend() method call, Swift classes operate with vtable (which contains the table of available methods). • vtables are created at compile time (when objc dispatch tables are generated dynamically). • This table contains functions pointers accessed by index, so it doesn’t need to bind selector to implementation. Introduction to Swift
  • 12.
    • Another interestingSwift feature is Name Mangling. Prepare to see something like __TFCCC4test1a1b1c1dfS2_FTS0_1xS1_1vFT1xSi_Si_OVS_1e1f when analysing Swift apps. • This string holds not only the exact function name, but also information about it’s type, parameters, nested classes etc. This is made for holding all the necessary method information in one string in the vtable. • The same thing goes for Class names. • You can use the function _stdlib_demangleName() for demangling. Introduction to Swift
  • 13.
    Setting up aniOS pen testing environment WHAT YOU NEED ? • A jailbroken iOS device (up to iOS 8.2) • Xcode installed on your system • Some tools that need to be installed on your jailbroken device
  • 14.
    • Jailbreak yourdevice by downloading the pangu software from pangu.io • Click on “Start Jailbreak”and follow the process to jailbreak your device
  • 15.
    • For iOS8.2 and iOS 8.3 you can make “Semi Jailbreak” using Safari – just visit the page http://pangu8.com/82.html • You’ll have to visit this page each time after rebooting your device
  • 16.
    • Big bossrecommended tools from cydia • Open SSH • class-dump or class-dump-z (https://code.google.com/p/networkpx/wiki/class_dump_z) • cycript (http://www.cycript.org/) • clutch (https://dl.dropboxusercontent.com/u/34557464/clutch) • gdb (https://dl.dropboxusercontent.com/u/34557464/gdb) • For iOS 8, make sure you tap on Refresh the first time you open up Cydia. Also install the following on your device
  • 17.
    iOS File system Ref:File system programming guide
  • 18.
    • Download agood file explorer utility like iExplorer or iFunbox Understanding the iOS filesystem
  • 19.
    • Download agood file explorer utility like iExplorer. Understanding the iOS filesystem
  • 20.
    • All theapplications installed by Apple by default go inside the /Applications directory and run with the user root • All the applications downloaded from the app store go inside /var/mobile/applications and run with the user mobile (iOS 7) • Every application runs in its own environment known as the application sandbox, thereby preventing it to access resources from other applications. This is done to enforce additional security. • For iOS 8, the applications downloaded from App store reside in /var/mobile/Containers/Bundle/Application
  • 21.
    • Downloaded applicationsbundles reside in /var/mobile/Containers/Bundle/Application/<ID>/. Here you can find the *.app file with all the resources included. • Their /Documents and /Library data reside in /var/mobile/Containers/Data/Application/<ID>/. Here you can found writable application data, such as *.sqlite dbs or plist files. • Starting from iOS 8.0 many applications have different extensions (widgets). Their shared data can be found in /var/mobile/Containers/Shared/AppGroup/<ID>.
  • 22.
    Here is howa typical application directory looks like The *.app folder contains the application binary.
  • 23.
    Here is howa typical shared application directory looks like
  • 24.
    Xcode IDE for developingnative iOS applications https://developer.apple.com/xcode/
  • 25.
    Understanding the Objective-Cruntime • All native iOS applications are Objective-C, which is a runtime oriented language. • Objective-C defers decisions from compile time and link time to the time when the code in the application is actually being executed. • Gives rise to a category of attacks knows as runtime manipulation. • Variables and properties can be analyzed and modified at runtime. • Messages aren’t bound to method implementations until runtime, thereby allowing us to modify the method implementations. • The functions are implemented in the shared library found at /usr/lib/libobjc.A.dylib.
  • 26.
    Usage: otool -l[binaryName]
  • 27.
    • Command lineutility. Extremely helpful tool in iOS pentesting. • Extracts class information from unencrypted Mach-O binaries. • Helps in finding out the method names, properties, protocols being used in any class. • Tells a lot about the design of the application. • Information is presented in a readable format. class-dump-z
  • 28.
  • 29.
    • Application thatare installed by default on iOS device won’t be encrypted, and hence class information can be dumped without any issues. • For applications downloaded from the App store, you must decrypt the application first using clutch. class-dump-z
  • 30.
    Usage: clutch [AppName] • Just using the clutch command will display a list of applications that can be decrypted. • Use “clutch [App Name]” to decrypt the application. The decrypted ipa file will be stored in the location as shown below.
  • 31.
  • 32.
    • Unzip theipa file to a new folder. • Dump the class information from the binary inside this folder.
  • 33.
    • According tocycript.org - Cycript allows developers to explore and modify running applications on either iOS or Mac OS X using a hybrid of Objective-C++ and JavaScript syntax through an interactive console that features syntax highlighting and tab completion. • Allows the user to hook into a running process during runtime and modify the values of instance variables, global variables, swizzle method implementations, call a particular method etc. • Complete documentation can be found at http://www.cycript.org/ Cycript
  • 34.
  • 35.
    Runtime analysis usingCycript • You can hook into the runtime of an application by using the command “cycript -p [PID]” • Some cool things that you can do with Cycript can be found here http://iphonedevwiki.net/index.php/Cycript_Tricks
  • 36.
    • For thecase below, you can define a method named printMethods that takes input as a class and prints out all its methods. • This method has been taken from http://iphonedevwiki.net/index.php/Cycript_Tricks • For e.g, you can define your own methods.
  • 37.
    • You canalso use the messages property of a class to print out all its messages, for e.g “AppDelegate.messages”. This will only print out the instance methods.
  • 38.
    • If youwant to print out the class methods as well, use the isa pointer and print out its messages. The isa pointer for any object is a pointer to its class structure. For e.g “AppDelegate->isa.messages” • This will print out the class methods as well.
  • 39.
    • Similarly, youcan also print out the instance methods of any view controller, class etc. In the example below, i am printing out the instance methods for the class RuntimeManipulationVC.
  • 40.
    Runtime manipulation usingCycript • With cycript, you can manipulate the values of instance variables, global variables for a particular class. • You can also modify method implementations.
  • 41.
    Runtime manipulation demo •In this case, we are manipulating the instance variable “urlToLoad” in the view controller RuntimeManipulationDetailsVC for DamnVulnerableiOSApp (http://damnvulnerableiosapp.com) • The first step is to get a reference to the view controller. • Once you get the reference, you can modify any of it’s variables. • For e.g UIApp.keyWindow.rootViewController.topViewController.topViewCont roller.urlToLoad = [NSString stringWithFormat:@"http://google.com"];
  • 42.
    • We canalso swizzle method implementations and replace the method implementation with our own. • Let’s assume you find a method with the name isLoginValidated in a particular view controller that returns a YES or NO depending on whether the login information is correct or not. • To try this demo, download Damn Vulnerable iOS app from http://damnvulnerableiosapp.com Runtime manipulation demo (Method Swizzling)
  • 43.
    • We canmodify this method’s implementation to always return TRUE. • As you can see, the code on the R.H.S is actually Javascript, this is the beauty about Cycript, it can related both Objective-C and javascript syntax. Runtime manipulation demo (Method Swizzling) • RuntimeManipulationDetailsVC.messages['isLoginValidated'] = function() {return TRUE;}
  • 44.
    • Plist • NSUserDefaults •CoreData (Sqlite) • Keychain Insecure Local Data Storage There are many ways of storing data locally on an iOS device. Some of these techniques are …
  • 45.
    • Data storedin plist files is stored unencrypted in the application sandbox. • An attacker doesn’t even need to have a jailbroken device to access the contents of the plist file. It can be accessed using simple file explorer utilities like iExplorer. • Most often, developers make the mistake of storing confidential data in Plist files. Plist
  • 46.
    Plist • Sample codefor storing data in plist files.
  • 47.
    Plist • These filescan be easily found using any simple file explorer utility like iExplorer in the application folder.
  • 48.
    Plist • On inspectingthese files, you can find the information being saved in the plist file.
  • 49.
    Plist • Do notuse plist files to store confidential information like username/passwords. • Do not store session ID’s , important properties etc in a plist file. • Plist files should only be used to store information that is not important, for e.g, a list of image names, the last launch date of the application etc.
  • 50.
    NSUserDefaults • Used forstoring properties, objects that can persist even after an application restart. • Information is saved unencrypted inside the application sandbox in a plist file with the name [BUNDLE_ID].plist inside the folder Library -> preferences . • Developers make a common mistake of storing critical data using NSUserDefaults.
  • 51.
    NSUserDefaults • All theinformation stored using NSUserDefaults can be found inside the file [BUNDLE_ID].plist inside the folder Library -> Preferences.
  • 52.
    NSUserDefaults • All thekey/value pairs stored using NSUserDefaults can be found in this file.
  • 53.
    Core Data • CoreData framework is used to store persistent data, manage relationships between objects etc. • Information is again saved unencrypted on the device in .db or .sqlite files. • An attacker can gather information about Core data objects by using a sqlite client.
  • 54.
    • Navigate toyour application directory and look for files with the extension .db or .sqlite. • Use an sqlite client to access these files. Core Data
  • 55.
    • Navigate toyour application directory and look for files with the extension .db or .sqlite. • Use an sqlite client to access these files. • You can dump information from the tables in the database using the commands as shown in the image below. Core Data
  • 56.
    Core Data Sqlite browsercan be used for quick analysis of sqlite databases
  • 57.
    Core Data • Coredata framework should not be used to store confidential information as the information is stored unencrypted on the device. • If you want to use some confidential informaiton, encrypt it before saving locally or use some wrappers over core data that store encrypted information on the device.
  • 58.
    Keychain • It isthe most secure way of storing information locally on the device. • Used by most of the popular application like Gmail, Facebook to store confidential information like passwords, authentication tokens etc. • Common database for all apps. Data is stored outside of the application sandbox. • Currently, information stored in the keychain can only be dumped from a jailbroken device using a tool named Keychain Dumper. • https://github.com/ptoomey3/Keychain-Dumper
  • 59.
    Keychain • One lineimplementation. • Access group allows applications to share keychain data. KeychainItemWrapper *wrapper = [[KeychainItemWrapper alloc] initWithIdentifier:@“Identifier” accessGroup:nil]; The same access group has to be given from both the apps and both the app ID’s have to be mentioned in the plist file for both the applications.
  • 60.
    Storing Data inKeychain • Using Keychain is quite simple (especially with third-party wrappers). One of them is SSKeychain (https://github.com/soffes/sskeychain): • [SSKeychain setPassword:@”secretkey” forService:@”DVIA” account:@”Admin”]; • NSString *pass = [SSKeychain passwordForService:@”DVIA” account:@”Admin”];
  • 61.
  • 62.
    Keychain dumper demo •Keychain information dumped for the application Damn Vulnerable iOS app can be clearly found in the image below. • Even though keychain is one of the most secure places to store information, consider adding an extra layer of encryption before saving data in the application to make the job for the attacker more difficult.
  • 63.
    Realm • Realm isa popular third-party cross-platform built on a custom C++ core. • Just like in all other cases information is stored unencrypted in the /Documents folder, in the *.realm files. • An attacker can gather information using the default Realm Browser: https://github.com/realm/realm- cocoa/tree/master/tools/RealmBrowser
  • 64.
  • 65.
    Apple Watch • AppleWatch is the new wearable device from Apple. • All the Apple Watch apps are simply extensions of native iOS applications.
  • 66.
    Apple Watch • Therunning app extension and containing app have no direct access to each other’s containers, so they use a shared data directory for data syncing. • Their shared data can be found in /var/mobile/Containers/Shared/AppGroup/<ID>. • So, all the Insecure Data Storage vulnerabilities can be applied to Apple Watch extensions.
  • 67.
    Side Channel Dataleakage • There are many different ways in which data can be leaked from the application without the awareness of the developer. • Device Logs • Application snapshots • Pasteboard • Keystroke logging • Cookies
  • 68.
    Device Logs • Somedeveloper use logs while debugging their applications but forget to remove them while releasing the application. • To see the device logs while you are running an application, make sure that the device is connected to your computer. • In Xcode, go to Window -> Organizer -> Device -> Your Device -> Console
  • 69.
    Device Logs • Devicelogs should only be enabled for DEBUG mode in the application, this will ensure that the logs are disabled when the application is downloaded from the App store and run on a user’s device.
  • 70.
    Application Snapshots • iOSby default takes a screenshot of your application when you take the application to background by pressing the home button. • This screenshot is shown to the user when he opens the app again while the app is loaded in the background. • Provides a seamless experience. • The problem is that the screenshot is stored without any protection in the application folder. • Sometimes, these screenshots can contain confidential information that might be leaked to an attacker.
  • 71.
    Application Snapshots • Thefollowing image shows the application snapshot stored in the application folder
  • 72.
    Pasteboard • Data copiedusing the cut/copy features in iOS goes inside a buffer known inside a pasteboard item. • It is possible for other applications to access the content of this pasteboard. • If the pasteboard item contains some confidential information, it might lead to information leakage.
  • 73.
    Pasteboard • Data canbe copied using the Copy feature in iOS. • Once it is copied, it remains in the buffer.
  • 74.
    Pasteboard • Using thefollowing command in Cycript or any other app can dump out the contents of the pasteboard. [UIPasteboard generalPasteboard].items[0]
  • 75.
    Pasteboard • For textfields that might contain secure information, make sure the Secure property is set. • Clear pasteboard contents when the application enters background. [UIPasteboard generalPasteboard].items[0] 55544555555 • Use pasteboard with specific identifiers, this makes it difficult for other applications to fetch data from this pasteboard item.
  • 76.
    Keystroke logging • iOSby default logs every input that you enter in any text field unless the secure flag is not set. • This helps in autocorrecting the user later. • All the keystroke logs can be easily fetched out from a device. • These logs might contain information that is important. • Logs remain stored on the device for a long time hence making it even more insecure. • Logs are stored in a file with the extension .dat in the location “/var/mobile/Library/Keyboard/“
  • 77.
    Keystroke logging • Theprefix of the file denotes the language in which the keystroke logs are stored. • Here is how a part of the logs file look like.
  • 78.
    Cookies • Some applicationscreate persistance cookies and store them in cookies.binarycookies file in application’s home directory. • The sample code for storing cookies: • [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookie:cookie]; • The path to cookies is: /Library/Cookies/Cookies.binarycookies [UIPasteboard generalPasteboard].items[0] 55544555555
  • 79.
    Cookies • Revealing cookiesis quite easy: • Download the python script BinaryCookieReader.py from http://securitylearn.net/wp- content/uploads/tools/iOS/BinaryCookieReader.py • Download the Cookies.binarycookies file from your device. • Run binarycookiereader.py /file-path-to-cookies
  • 80.
    Cookies • This isthe example from Aeroflot mobile application:
  • 81.
    URL Schemes • Used forIPC between applications. • Every application can register for a particular URL scheme. • Any url starting with that particular URL scheme invokes the application that is registered to handle that url. • For e.g, the facebook iOS application registers for the URL scheme “fb” • Url’s starting with fb:// will invoke the facebook iOS application. • The Facebook iOS application will decide what to do with that particular url depending on its parameters. • For e.g fb://chat_text?name=Prateek&message=Hello
  • 82.
    URL Schemes • Any applicationcan call a url starting with a particular url scheme and invoke the registered application. • Attacker can also embed the url inside an iframe in a malicious page, when the user visits the page, the url will execute and the registered application will be called. • These URL schemes can be used to execute important operations, for e.g FaceTime iOS app allows other apps to call user via URL scheme. • The problem happens when the operation is executed without any validation from the user.
  • 83.
    • A simplesolution for this is to validate the action before performing it. • For critical apps, you can also set a list of whitelisted applications and only allow them to invoke an action. This can be checked by the sourceApplication property in the calling method. • Skype URL scheme vulnerability http://software-security.sans.org/blog/2010/11/08/insecure- handling-url-schemes-apples-ios/ URL Schemes
  • 84.
    • How tofind out the URL scheme used by a particular application ? • This info can be found from the Info.plist file. URL Schemes
  • 85.
    • Look forthe property CFBundleURLSchemes inside CFBundleURLTypes -> Item 0 • As we can see, the Facebook iOS app registers for quite a lot of URL schemes. URL Schemes
  • 86.
    • Another importantthing could be to find out the URL structure an application is expecting in order to perform a certain action. • This can be found by reverse engineering the application using tools like Hopper (hopperapp.com) and looking for strings that start with that particular URL scheme or looking at the disassembly of this method in the AppDelegate class. • Related article: http://highaltitudehacks.com/2014/03/07/ios- application-security-part-30-attacking-url-schemes URL Schemes
  • 87.
    • It isimportant to analyze the network traffic that flows between the client/server in an application. • Look for credentials, authentication tokens, API keys being transmitted over unsecured http channel. • Check for the entropy in Session ID’s. • Traffic can be analyzed using a simple proxy tool like Burp proxy. • Try to manipulate the request/response using Burp and see how the client side application responds to it. Analyzing network traffic over HTTP/HTTPs
  • 88.
    Analyzing traffic overHTTP • Configure Burp Proxy to start listening for traffic. Make sure it is listening on all interfaces.
  • 89.
    Analyzing traffic overHTTP • Configure your iOS device to use your computer as a proxy.
  • 90.
    Analyzing traffic overHTTP • You can now intercept the traffic as it goes to the server.
  • 91.
    Analyzing traffic overHTTPs • This will require you to install Burp’s CA certificate as a trusted root on your device. • Configure your browser to relay traffic over Burp proxy.
  • 92.
    Analyzing traffic overHTTPs You will get a warning, click on Add Exception.
  • 93.
    Analyzing traffic overHTTPs • Click on View.
  • 94.
    Analyzing traffic overHTTPs • Go to Details, select the topmost certificate, click on Export and save the file with extension as .crt
  • 95.
    Analyzing traffic overHTTPs • Send this file to your device via email, click on it and Install it. Accept all the instructions and click on Done.
  • 96.
    Analyzing traffic overHTTPs • Quit and restart the application you want to sniff traffic for. You will now be able to see the traffic even if it is over HTTPs
  • 97.
    Certificate pinning • Theserver’s certificate is hardcoded in the application bundle and checked while exchanging data with the server. • Provides protection against MITM attacks. • Used by applications like Twitter, Square etc.
  • 98.
    Certificate pinning • Theserver’s certificate is hardcoded in the application bundle and checked while exchanging data with the server. • Provides protection against MITM attacks. • Used by applications like Twitter, Square etc.
  • 99.
    Certificate pinning bypass •Certificate pinning can be bypassed by hooking into some low level methods during runtime. • iOS SSL kill switch was released in Blackhat to demonstrate this. • https://github.com/iSECPartners/ios-ssl-kill-switch
  • 100.
    Certificate pinning bypass •Once it is enabled, user can see the traffic through applications like Twitter as well.
  • 101.
    • Most ofmodern applications use some third-party services for analytics, data storage, push-notifications, crash- reporting, social-auth and so on. • Besides different vulnerabilities in SDKs, this opens a couple of new attack vectors for penetration tester: • The unsecure storage of API keys, • The lack of security on the server-side. Attacking Third-Party Services
  • 102.
    • Parse.com isa MBaaS which helps with setting up backend infrastructure for mobile applications. Some of its capabilities: • Cloud data storage • Push notifications • Cloud code hosting • Gathering usage statistics Attacking Parse.com
  • 103.
    • All thedata in Cloud Core is stored in Parse Classes (ordinary database tables). Attacking Parse.com
  • 104.
    • There aredifferent levels of access-permissions: class level and object level. We’re going to investigate CLA. • All of Class Level Access permissions are set to Public by default. Attacking Parse.com
  • 105.
    • Using Hopperwe can extract the API keys and Parse Classes names from target application: Attacking Parse.com
  • 106.
    • Now youcan query the Parse API using these keys: • [Parse setApplicationId:<APP_ID> clientKey:<CLIENT_KEY>] • PFQuery *query = [PFQuery queryWithClassName:@”Target”]; • NSArray *data = [query findObjects]; • You can perform all the CRUD operations on class with Public access permissions. Attacking Parse.com
  • 107.
    • To simplifythese tasks, you can use the Parse Revealer utility: https://github.com/igrekde/ParseRevealer • It automates the analysis of access permissions and structure of provided classes. Attacking Parse.com
  • 108.
    • Flurry.com isthe most popular mobile analytics service. • It uses the single API key to identify the application. This key can be retrieved using Hopper app. • With this key an attacker can build his own application, generating a large number of random events and pollute the target app’s statistics monitoring. It can lead to impossibility of statistics analysis, which is very crucial for popular applications. Attacking Flurry.com
  • 109.
    • Starting session: [FlurrystartSession:@”API_KEY”]; • Logging events: [Flurry logEvent:@”EVENT_NAME” withParameters:params]; • Logging page views: [Flurry logPageView]; Attacking Flurry.com
  • 110.
    • For criticalapplications like banking applications etc, it is important that you ensure that the application doesn’t work on a jailbroken device. • With a copy of your app’s binary and tools like Cycript at his disposal, an attacker is in complete control. • It is therefore important to check for a jailbroken device and disable certain features of the application or quit the application in order to protect it. Jailbreak Detection
  • 111.
    • There aremany ways to check for a jailbroken device. • Checking for specific files that exist on a jailbroken device is one of the most common techniques being used. • Another way is to check if the application is able to modify a file outside it’s own sandbox. • Most than 80% of the jailbroken devices have Cydia installed, so check if you can open a url that starts with Cydia’s URL scheme, i.e cydia:// • It is important to note that no that there is no foolproof technique to detect a jailbroken device, however a combination of checks can make the job difficult for even a skilled hacker. Jailbreak Detection
  • 112.
    • There aremany ways to check for a jailbroken device. • Checking for specific files that exist on a jailbroken device is one of the most common techniques being used. • Another way is to check if the application is able to modify a file outside it’s own sandbox. • Most than 80% of the jailbroken devices have Cydia installed, so check if you can open a url that starts with Cydia’s URL scheme, i.e cydia:// • It is important to note that no that there is no foolproof technique to detect a jailbroken device, however a combination of checks can make the job difficult for even a skilled hacker. Jailbreak Detection
  • 113.
    +(BOOL)isJailbroken{ #if !(TARGET_IPHONE_SIMULATOR) if ([[NSFileManagerdefaultManager] fileExistsAtPath:@"/Applications/Cydia.app"]){ return YES; }else if([[NSFileManager defaultManager] fileExistsAtPath:@"/Library/MobileSubstrate/MobileSubstrate.dylib"]){ return YES; }else if([[NSFileManager defaultManager] fileExistsAtPath:@"/bin/bash"]){ return YES; }else if([[NSFileManager defaultManager] fileExistsAtPath:@"/usr/sbin/sshd"]){ return YES; }else if([[NSFileManager defaultManager] fileExistsAtPath:@"/etc/apt"]){ return YES; } NSError *error; NSString *stringToBeWritten = @"This is a test."; [stringToBeWritten writeToFile:@"/private/jailbreak.txt" atomically:YES encoding:NSUTF8StringEncoding error:&error]; if(error==nil){ //Device is jailbroken return YES; } else { [[NSFileManager defaultManager] removeItemAtPath:@"/private/jailbreak.txt" error:nil]; } if([[UIApplication sharedApplication] canOpenURL:[NSURL URLWithString:@"cydia://package/com.example.package"]]){ //Device is jailbroken return YES; } #endif //All checks have failed. Most probably, the device is not jailbroken return NO; } Jailbreak Detection Combining all these techniques, we get this method.
  • 114.
    Jailbreak Detection • Theproblem is that the signature of this method gives everything away. • Attacker can use Cycript to use bypass the check for jailbreak detection.
  • 115.
    Jailbreak Detection • Itis better to rename the method to something that doesn’t look important. • Something like +(BOOL)isDefaultColour • Yeah i know, we do ignore the coding guidelines, but in this case, the guidelines are something that gives everything away. • After analyzing the class-dump output of the application, the hacker is most likely to ignore this method. • He can always reverse engineer this method to see what’s going on inside, so this method is also not foolproof.
  • 116.
    Broken Cryptography • Occurswhen data stored on the device is not encrypted properly. • One of the most common vulnerabilities found in iOS applications. • Can occur by use of deprecated or weak algorithms. • Sometimes the key while encryption is hardcoded in the app thereby making it much easier for the attacker to break the application. • Related article: http://www.andreas-kurtz.de/2013/07/how- to-easily-spot-broken-cryptography.html
  • 117.
    Secure coding guidelines •Do not store confidential data using NSUserDefaults, plist files or Core Data framework. Use keychain to store data like passwords, authentication tokens, API-keys etc. • Use proper encryption while storing data locally in any insecure place. Do not use hardcoded keys etc. • Validate incoming URLs using URL schemes and properly authorize the user before taking any action. • Add checks to detect jailbroken device for critical applications like banking applications etc. • Text fields that might contain important information should be marked Secure. This will prevent leaking of data via pasteboard, application snapshots etc. • Use libraries like SQLCipher to encrypt sqlite databases.
  • 118.
    • Clear pasteboarddata when the application enters into background. • Add checks to prevent debuggers from hooking into your application. Add the highlighted lines of code in your application. Secure coding guidelines
  • 119.
    Patching iOS applications •Patching an application changes its login permanently. • This is better that making a change in cycript where you have to repeat the same process over and over again. • Often used to disable checks like Jailbreak detection, piracy check etc. • Tools used for patching iOS application: IDA Pro, Hexfiend and Hopper. • Once an application has been patched, it needs to be resigned using ldid before it can be deployed on the device.
  • 120.
    Patching iOS applications •Hopper is one of the best tools available for patching iOS applications. • Not free, but the value for money is very good. • Patching iOS applications with Hopper: http://highaltitudehacks.com/2014/01/17/ios-application-security-part-28- patching-ios-application-with-hopper/ • Patching iOS applications with IDA Pro and Hex fiend:http://highaltitudehacks.com/2013/12/17/ios-application-security- part-26-patching-ios-applications-using-ida-pro-and-hex-fiend
  • 121.
    Patching iOS applications •To modify any instruction in Hopper, click on it and click on Modify -> Assemble Instruction.
  • 122.
    Patching iOS applications •Make the change and click on Assemble and Go Next
  • 123.
    Patching iOS applications •Once the change has been made, click on File -> Produce new executable and overwrite the existing one.
  • 124.
    Patching iOS applications •To deploy the application back to your device, resign the application binary first using ldid as shown in the image below. Then copy the .app file to the /Applications directory on the device using Scp. You can also use sftp or the utility iExplorer to upload this application.
  • 125.
    Patching iOS applications Nowlogin as the mobile user, use the command su to get root privileges and give the binary executable permissions. Then use the exit command to go back as the mobile user, and use the command uicache to install the application. If this doesn’t work, you can reboot the device or try this method again. You will see that the application has been successfully installed on your device.
  • 126.
    Extracting Device Backups •It’s possible to extract the data from iOS device for further researches. • The first way is using libimobiledevice – a library to communicate with different services of iOS devices using native protocols. • You can download it from GitHub: https://github.com/libimobiledevice/libimobiledevice
  • 127.
    Extracting Device Backups •Run idevice_id –l for the list of connected devices • Run idevicebackup2 backup --full --source <UDID>~/Documents to make the full backup of the specified device.
  • 128.
    Extracting Device Backups •Download iBackupBot: http://www.icopybot.com/itunes-backup- manager.htm • Drag the backup folder to iBackupBot and enjoy browsing.
  • 129.
    Extracting Device Backups •The developer can mark files and directories to exclude them from backups. • The backup can be protected by the passcode.
  • 130.
    Extracting iCloud DeviceBackups • The other way of extracting backups is from iCloud. • You need to know the AppleID and password, linked with the target device. • Use iLoot: https://github.com/hackappcom/iloot • > python iloot.py email@icloud.com password
  • 131.
    Automated testing • Automatingtests while doing an iOS penetration test can help you save a lot of time. • Though not all tests can be automated, there are some tools that do a very good job at this. • Snoop-it - https://code.google.com/p/snoop-it/ • iNalyzer - https://appsec-labs.com/iNalyzer • iRET - https://blog.veracode.com/2014/03/introducing-the-ios- reverse-engineering-toolkit/ • idb - http://www.idbtool.com/ • iSpy - https://github.com/BishopFox/iSpy
  • 132.
    Snoop-it • Source: https://code.google.com/p/snoop-it/ •For iOS 7, it currently supports only 32 bit devices. • Related article: http://highaltitudehacks.com/2013/08/20/ios-application- security-part-9-analyzing-security-of-ios-applications-using-snoop-it/
  • 133.
    Snoop-it • Here ishow the interface looks like.
  • 134.
    iNalyzer • Related article:http://highaltitudehacks.com/2013/09/17/ios- application-security-part-15-static-analysis-of-ios-applications- using-inalyzer/
  • 135.
    iRET Source: https://blog.veracode.com/2014/03/introducing-the-ios- reverse-engineering-toolkit/ • Relatedarticle: https://blog.veracode.com/2014/03/introducing-the-ios- reverse-engineering-toolkit/
  • 136.
    idb • Related article:http://highaltitudehacks.com/2014/10/18/ios-application- security-part-35-auditing-ios-applications-with-idb/
  • 137.
    iSpy • Related article:https://github.com/BishopFox/iSpy/wiki/Setup-iSpy-from- Source
  • 138.
    Further practice Try outall the challenges in Damn Vulnerable iOS App (http://damnvulnerableiosapp.com)
  • 139.