iOS Security - Hacking iOS Apps

TDC 2017

Transcript

1. iOS Security Bruno Rocha iOS Developer @ Movile
2. Bad people
3. Crypto keys in NSUserDefaults/Keychain Secret API Keys in the Info.plist or hardcoded CoreData/SQLite with sensitive data var isSubscribed: Bool
4. NSUserDefaults - Documents folder, not encrypted CoreData - Documents folder, not encrypted Info.plist - Exposed in your .ipa/.app Keychain - Encrypted, but exploitable NSKeyedArchiver - A plist in hex format
7. var isSubscribed: Bool { let subscription = getSubscription() return subscription.isExpired == false } var swizzled__isSubscribed: Bool { return true }
9. Demo 1: Insecure Data Storages
10. Protecting apps from Storage Attacks • Encrypt/Encode data before saving/ hardcoding (Careful! This will not prevent attacks, only slow them down.) • Treat critical data (like secret API keys) server-side if possible • Open Source “String obfuscation" libs: Hackers have Google too.
11. Demo 2: Runtime Manipulation
12. Protecting apps from Runtime Manipulation Important logic should be treated/ checked server-side! (eg: API Tokens)
13. Protecting apps from Runtime Manipulation
14. Protecting apps from Runtime Manipulation
15. What about the real world?