Upgrade to Pro — share decks privately, control downloads, hide ads and more …

iOS Security - Hacking iOS Apps

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for Bruno Rocha Bruno Rocha
June 11, 2017
Technology
0
20

iOS Security - Hacking iOS Apps

TDC 2017

Avatar for Bruno Rocha

Bruno Rocha

June 11, 2017
Tweet

More Decks by Bruno Rocha

See All by Bruno Rocha
BuckOutsideValley.pdf
Avatar for Bruno Rocha rockbruno
1
100
Avoiding Release Anxiety
Avatar for Bruno Rocha rockbruno
0
27
Creating Scalable iOS Apps
Avatar for Bruno Rocha rockbruno
0
13

Other Decks in Technology

See All in Technology
20260323_データ分析基盤でGeminiを使う話
Avatar for yuichi 1210yuichi0
0
190
【Oracle Cloud ウェビナー】データ主権はクラウドで守れるのか？NTTデータ様のOracle Alloyで実現するソブリン対応クラウドの最適解
Avatar for oracle4engineer oracle4engineer
PRO
3
110
Cursor Subagentsはいいぞ
Avatar for Yuji Yamaguchi yug1224
2
110
SaaSに宿る21g
Avatar for Yamakan kanyamaguc
2
180
ブラックボックス化したMLシステムのVertex AI移行 / mlops_community_62
Avatar for Visional Engineering ＆ Design visional_engineering_and_design
1
160
VSCode中心だった自分がターミナル沼に入門した話
Avatar for Genki Sano sanogemaru
0
780
Zephyr(RTOS)でOpenPLCを実装してみた
Avatar for misoji engineer iotengineer22
0
130
私がよく使うMCPサーバー3選と社内で安全に活用する方法
Avatar for KintoTech_Dev kintotechdev
0
130
TUNA Camp 2026 京都Stage ヒューリスティックアルゴリズム入門
Avatar for terry-u16 terryu16
0
560
Navigation APIと見るSvelteKitのWeb標準志向
Avatar for Okuto Oyama yamanoku
2
120
やさしいとこから始めるGitHubリポジトリのセキュリティ
Avatar for Yuta Matsumura tsubakimoto_s
3
1.9k
AI時代のシステム開発者の仕事_20260328
Avatar for 閃利㈱河村 純 sengtor
0
290

Featured

See All Featured
Taking LLMs out of the black box: A practical guide to human-in-the-loop distillation
Avatar for Ines Montani inesmontani
PRO
3
2.1k
Save Time (by Creating Custom Rails Generators)
Avatar for Garrett Dimon garrettdimon
PRO
32
2.6k
New Earth Scene 8
Avatar for Sydney Stone popppiees
1
1.8k
Why Our Code Smells
Avatar for Brandon Keepers bkeepers
PRO
340
58k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
Avatar for Morgane Peng morganepeng
133
19k
Building an army of robots
Avatar for Kyle Neath kneath
306
46k
Neural Spatial Audio Processing for Sound Field Analysis and Control
Avatar for NII S. Koyama's Lab skoyamalab
0
230
Digital Ethics as a Driver of Design Innovation
Avatar for Per Axbom axbom
PRO
1
240
Navigating the moral maze — ethical principles for Al-driven product design
Avatar for Skipper Chong Warson skipperchong
2
310
B2B Lead Gen: Tactics, Traps & Triumph
Avatar for Sophie Logan marketingsoph
0
86
コードの90%をAIが書く世界で何が待っているのか / What awaits us in a world where 90% of the code is written by AI
Avatar for r-kagaya rkaga
61
43k
Redefining SEO in the New Era of Traffic Generation
Avatar for Szymon Słowik szymonslowik
1
250

Transcript

  1. iOS Security Bruno Rocha iOS Developer @ Movile

  2. Bad people

  3. Crypto keys in NSUserDefaults/Keychain Secret API Keys in the Info.plist

    or hardcoded CoreData/SQLite with sensitive data var isSubscribed: Bool

  4. NSUserDefaults - Documents folder, not encrypted CoreData - Documents folder,

    not encrypted Info.plist - Exposed in your .ipa/.app Keychain - Encrypted, but exploitable NSKeyedArchiver - A plist in hex format
  5. None
  6. None

  7. var isSubscribed: Bool { let subscription = getSubscription() return subscription.isExpired

    == false } var swizzled__isSubscribed: Bool { return true }
  8. None

  9. Demo 1: Insecure Data Storages

  10. Protecting apps from Storage Attacks • Encrypt/Encode data before saving/

    hardcoding (Careful! This will not prevent attacks, only slow them down.) • Treat critical data (like secret API keys) server-side if possible • Open Source “String obfuscation" libs: Hackers have Google too.

  11. Demo 2: Runtime Manipulation

  12. Protecting apps from Runtime Manipulation Important logic should be treated/

    checked server-side! (eg: API Tokens)

  13. Protecting apps from Runtime Manipulation

  14. Protecting apps from Runtime Manipulation

  15. What about the real world?