Tweet
Tweet

Slide 1

Slide 1 text

iOS App Vulnerabilities Julia Potapenko and how to fix them

Slide 2

Slide 2 text

Security Software Engineer @julepka We help companies to protect their sensitive and valuable data.

Slide 3

Slide 3 text

How do we know the vulnerability is common? OWASP Mobile Top 10 CVE-List by MITRE Security tools/services vendors News and Twitter πŸ™‚ Our own experience 😎

Slide 4

Slide 4 text

OWASP Mobile Top 10 M1: Improper Platform Usage M2: Insecure Data Storage M3: Insecure Communication M4: Insecure Authentication M5: Insufficient Cryptography M6: Insecure Authorization M7: Client Code Quality M8: Code Tampering M9: Reverse Engineering M10: Extraneous Functionality https://owasp.org/www-project-mobile-top-10/

Slide 5

Slide 5 text

OWASP Mobile Top 10 M1: Improper Platform Usage M2: Insecure Data Storage M3: Insecure Communication M4: Insecure Authentication M5: Insufficient Cryptography M6: Insecure Authorization M7: Client Code Quality M8: Code Tampering M9: Reverse Engineering M10: Extraneous Functionality https://owasp.org/www-project-mobile-top-10/

Slide 6

Slide 6 text

2016 M1: Improper Platform Usage M2: Insecure Data Storage M3: Insecure Communication M4: Insecure Authentication M5: Insufficient Cryptography M6: Insecure Authorization M7: Client Code Quality M8: Code Tampering M9: Reverse Engineering M10: Extraneous Functionality M1: Weak Server Side Controls M2: Insecure Data Storage M3: Insufficient Transport Layer Protection M4: Unintended Data Leakage M5: Poor Authorization and Authentication M6: Broken Cryptography M7: Client Side Injection M8: Security Decisions Via Untrusted Inputs M9: Improper Session Handling M10: Lack of Binary Protection 2014 OWASP Mobile Top 10

Slide 7

Slide 7 text

2016 M1: Improper Platform Usage M2: Insecure Data Storage M3: Insecure Communication M4: Insecure Authentication M5: Insufficient Cryptography M6: Insecure Authorization M7: Client Code Quality M8: Code Tampering M9: Reverse Engineering M10: Extraneous Functionality M1: Weak Server Side Controls M2: Insecure Data Storage M3: Insufficient Transport Layer Protection M4: Unintended Data Leakage M5: Poor Authorization and Authentication M6: Broken Cryptography M7: Client Side Injection M8: Security Decisions Via Untrusted Inputs M9: Improper Session Handling M10: Lack of Binary Protection 2014 OWASP Mobile Top 10

Slide 8

Slide 8 text

CVE List https://cve.mitre.org/cve/search_cve_list.html Search: iOS app Common Vulnerabilities and Exposures List

Slide 9

Slide 9 text

NVD National Vulnerability Database Common Vulnerability Scoring System

Slide 10

Slide 10 text

Security tools/services vendors Databases, reports, statistics, blog posts https://snyk.io/vuln/

Slide 11

Slide 11 text

Security tools/services vendors Databases, reports, statistics, blog posts https://www.guardsquare.com/state-of-mobile-application-security-report

Slide 12

Slide 12 text

Improper Platform Usage

Slide 13

Slide 13 text

Improper Platform Usage Permissions TouchID / FaceID Keychain Secure Enclave URL Schemas WebView Autocorrection

Slide 14

Slide 14 text

Improper Platform Usage If I want to store some data…

Slide 15

Slide 15 text

Improper Platform Usage UserDefaults Not encrypted, accessible on a locked device. If I want to store some data…

Slide 16

Slide 16 text

Improper Platform Usage UserDefaults Not encrypted, accessible on a locked device. Keychain Encrypted storage, becomes decrypted on unlock. If I want to store some data…

Slide 17

Slide 17 text

Improper Platform Usage UserDefaults Not encrypted, accessible on a locked device. Keychain Encrypted storage, becomes decrypted on unlock. Secure Enclave Stores keys that can be used to encrypt Keychain entries. If I want to store some data…

Slide 18

Slide 18 text

Improper Platform Usage Not strict Keychain access policy == Attacker can easily access Keychain data

Slide 19

Slide 19 text

Improper Platform Usage

Slide 20

Slide 20 text

Improper Platform Usage

Slide 21

Slide 21 text

Improper Platform Usage

Slide 22

Slide 22 text

Improper Platform Usage

Slide 23

Slide 23 text

Improper Platform Usage kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly kSecAttrAccessibleWhenUnlockedThisDeviceOnly kSecAttrAccessibleWhenUnlocked kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly kSecAttrAccessibleAfterFirstUnlock

Slide 24

Slide 24 text

Improper Platform Usage kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly kSecAttrAccessibleWhenUnlockedThisDeviceOnly kSecAttrAccessibleWhenUnlocked kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly kSecAttrAccessibleAfterFirstUnlock

Slide 25

Slide 25 text

Improper Platform Usage kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly kSecAttrAccessibleWhenUnlockedThisDeviceOnly kSecAttrAccessibleWhenUnlocked kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly kSecAttrAccessibleAfterFirstUnlock Or encrypt and decrypt on your own πŸ” Secure Enclave πŸ” CryptoKit πŸ” Themis πŸ”

Slide 26

Slide 26 text

Improper Platform Usage kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly kSecAttrAccessibleWhenUnlockedThisDeviceOnly kSecAttrAccessibleWhenUnlocked kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly kSecAttrAccessibleAfterFirstUnlock Or encrypt and decrypt on your own πŸ” Secure Enclave πŸ” CryptoKit πŸ” Themis πŸ” AND!

Slide 27

Slide 27 text

Improper Platform Usage kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly kSecAttrAccessibleWhenUnlockedThisDeviceOnly kSecAttrAccessibleWhenUnlocked kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly kSecAttrAccessibleAfterFirstUnlock Watch your backups!

Slide 28

Slide 28 text

Improper Platform Usage TouchID / FaceID

Slide 29

Slide 29 text

Improper Platform Usage https://developer.apple.com/documentation/localauthentication/ logging_a_user_into_your_app_with_face_id_or_touch_id

Slide 30

Slide 30 text

Improper Platform Usage https://developer.apple.com/documentation/localauthentication/ logging_a_user_into_your_app_with_face_id_or_touch_id

Slide 31

Slide 31 text

Improper Platform Usage πŸ”₯ πŸ”₯ πŸ”₯ 🀯 πŸ”₯

Slide 32

Slide 32 text

Improper Platform Usage πŸ”₯ πŸ”₯ πŸ”₯ 🀯 πŸ”₯ Returns boolean = easy to bypass

Slide 33

Slide 33 text

Improper Platform Usage https://github.com/sensepost/objection https://frida.re/docs/home/ Example source: http://highaltitudehacks.com/2018/07/29/ios-application-security-part-53-objection-continued/

Slide 34

Slide 34 text

Improper Platform Usage πŸ€ πŸ€ πŸ€ πŸ€ ☺

Slide 35

Slide 35 text

Improper Platform Usage πŸ€ πŸ€ πŸ€ πŸ€ ☺

Slide 36

Slide 36 text

Improper Platform Usage πŸ€ πŸ€ πŸ€ πŸ€ ☺ Specific attributes

Slide 37

Slide 37 text

Improper Platform Usage πŸ€ πŸ€ πŸ€ πŸ€ ☺ Triggers biometry check automatically Specific attributes

Slide 38

Slide 38 text

Insecure Data Storage Data generated by the app: πŸ”Ή Logs πŸ”Ή Databases πŸ”Ή Caches πŸ”Ή Other saved files

Slide 39

Slide 39 text

Insecure Data Storage Data generated by the app: πŸ”Ή Logs πŸ”Ή Databases πŸ”Ή Caches πŸ”Ή Other saved files Check if any sensitive data may appear there!

Slide 40

Slide 40 text

Insecure Data Storage Data generated by the app: πŸ”Ή Logs πŸ”Ή Databases πŸ”Ή Caches πŸ”Ή Other saved files Check if any sensitive data may appear there! (check the code, not the files)

Slide 41

Slide 41 text

Insecure Data Storage Data stored inside the .ipa: πŸ”Ή Configuration files πŸ”Ή Executables

Slide 42

Slide 42 text

Insecure Data Storage Data stored inside the .ipa: πŸ”Ή Configuration files πŸ”Ή Executables Look for testing credentials and endpoints!

Slide 43

Slide 43 text

Insecure Data Storage Data stored inside the .ipa: πŸ”Ή Configuration files πŸ”Ή Executables Look for testing credentials and endpoints! (actually, any credentials and endpoints)

Slide 44

Slide 44 text

Insecure Data Storage Data stored inside the .ipa: πŸ”Ή Configuration files πŸ”Ή Executables Look for testing credentials and endpoints! (actually, any credentials and endpoints) (config comments may not be removed)

Slide 45

Slide 45 text

Insecure Data Storage Data stored inside the .ipa: πŸ”Ή Configuration files πŸ”Ή Executables [22:05:16] juliapotapenko:MyAwesomeAppl.app $ strings MyAwesomeApp | grep "https://"

Slide 46

Slide 46 text

Insecure Communication App Transport Security Do not allow HTTP

Slide 47

Slide 47 text

Insecure Communication App Transport Security Do not allow HTTP HTTP allowed for all endpoints HTTP allowed for localhost

Slide 48

Slide 48 text

Insecure Communication TLS Pinning Prevent MiTM SERVER iOS APP TLS Certificate

Slide 49

Slide 49 text

Insecure Communication SERVER iOS APP ATTACKER TLS Pinning Prevent MiTM TLS Cert MiTM Cert

Slide 50

Slide 50 text

Insecure Communication SERVER iOS APP ATTACKER TLS Pinning Prevent MiTM TLS Cert MiTM Cert βœ… Is trusted CA? βœ… Not expired?

Slide 51

Slide 51 text

Insecure Communication SERVER iOS APP ATTACKER TLS Pinning Prevent MiTM TLS Cert MiTM Cert βœ… Is trusted CA? βœ… Not expired? ❓ Is it our server’s cert?

Slide 52

Slide 52 text

Insecure Communication TLS Pinning Prevent MiTM https://developer.apple.com/news/?id=g9ejcf8y

Slide 53

Slide 53 text

Insecure Communication TLS Pinning Prevent MiTM https://developer.apple.com/news/?id=g9ejcf8y

Slide 54

Slide 54 text

Insecure Communication TLS Pinning Prevent MiTM It is just an Info.plist entry. I can bypass pinning by removing or changing it. Correct. But the main goal is to protect against MiTM when the attacked doesn’t have access to a physical device.

Slide 55

Slide 55 text

Insecure Communication TLS Pinning Prevent MiTM It is just an Info.plist entry. I can bypass pinning by removing or changing it. Correct. But the main goal is to protect against MiTM when the attacked doesn’t have access to a physical device.

Slide 56

Slide 56 text

Insecure Communication TLS Pinning Prevent MiTM https://developer.android.com/training/articles/security-ssl#Pinning Android docs

Slide 57

Slide 57 text

Unintended Data Leakage Application Backgrounding

Slide 58

Slide 58 text

Unintended Data Leakage Application Backgrounding What to protect? * * * * * Think of accidental sharing Sensitive data

Slide 59

Slide 59 text

Unintended Data Leakage Application Backgrounding What to protect? * * * * * Think of accidental sharing Sensitive data How to protect? Screen overlay Remove entered data Return to previous screen

Slide 60

Slide 60 text

Unintended Data Leakage Screen overlay when app moved to background

Slide 61

Slide 61 text

Summary We’ve learned - where we can read about common vulnerabilities - examples of top vulnerabilities - keychain - app generated content - allowing HTTP - biometrics - data stored in .ipa - TLS pinning - backgrounging - screen overlay

Slide 62

Slide 62 text

No content

Slide 63

Slide 63 text

Thank you! @julepka