Hooking up the hacker way (iOS edition)

Transcript

1. • • 1 Hooking up, the hacker way.
 Breaking mobile apps for fun and profit (iOS Edition)
2. • • 2 #whoami Above average interest in breaking code Backend engineer at Stocard <3 " Ajith Chandran - (r3dsm0k3) Likes to poke web browsers for security bugs Amateur photographer Will consume beer in industrial quantities
3. • • 3 • Applications are developed with Apple’s SDK. • Distributed as .ipa files on Appstore. • Compiled to ARM architecture. • Requires a provisioning profile to sign the application. • Encrypted with FairPlay DRM and signed with apple’s signature.
4. • • 4 • Every application runs inside a sandbox • Position Independent executable - (PIE) • Automatic reference counting - (ARC) • Stash smacking protection • Secure Enclave iOS Security Model
5. • • 5 • Application permissions • App Transport Security - (ATS) • Authentication using TouchID/ FaceID • Data protection apis iOS Security Model
6. • • 6
7. • • 7 • Removes *all* the restrictions enforced by apple. • Enables running untrusted code on the device • Provides root level access • Patches code signing to achieve unsigned code execution What about Jailbreaking? got root? iPhone:~ whoami uid=0(root) iPhone:~ whatcanido EVERYTHING!
8. • • 8 OWASP Mobile Top 10 vulnerabilities Improper platform usage Insecure data storage Insecure communication Insecure authorisation Insufficient cryptography Insecure authentication Client code quality Code tampering Reverse engineering Extraneous functionality
9. • • • • 9
10. • • • • 10 Demo Time Intercepting HTTP Intercepting HTTPS SSL Pinning bypass
11. • • • • 11 Dynamic Binary Instrumentation • DBI is means to inject foreign code into existing (running) binaries. • Access process memory. • Change/ Overwrite functions at runtime. • Call functions from imported classes. • Find object instances on the heap and use them. • Hook, trace, intercept functions etc.
12. • • • • 12 • Scriptable. • Portable. • Free & Open source • Well tested • Feels like God mode
13. • • • • 13 FЯIDA Tools frida cli frida-ps frida-trace frida-discover frida-ls-devices frida-kill
14. • • • • 14 FЯIDA Trace ~ ╍ frida-trace -U -f com.toyopagroup.picaboo -I "libcommonCrypto*" ~ ╍ frida-trace -U DVIA-v2 -i "*debug*" Launch and trace all the crypto module calls from snapchat Trace all the debug method calls
15. • • • • 15 Demo/Attack Time Bypass jailbreak detection Runtime manipulation
16. • • 16 THANK YOU /r3dsm0k3 /bunch_of_pixels