| Foreword |
|
xix | |
|
|
| Acknowledgments |
|
xxi | |
| Introduction |
|
xxiii | |
|
|
|
xxiv | |
|
|
|
xxiv | |
|
How This Book Is Structured |
|
|
xxiv | |
|
Conventions This Book Follows |
|
|
xxvi | |
|
|
|
xxvi | |
|
Mobile Security Promises and Threats |
|
|
xxvii | |
|
What Mobile Apps Shouldn't Be Able to Do |
|
|
xxvii | |
|
Classifying Mobile Security Threats in This Book |
|
|
xxviii | |
|
Some Notes for iOS Security Testers |
|
|
xxx | |
| Part I IOS Fundamentals |
|
|
|
|
3 | (10) |
|
|
|
4 | (1) |
|
Limiting Access with the App Sandbox |
|
|
4 | (1) |
|
Data Protection and Full-Disk Encryption |
|
|
5 | (3) |
|
The Encryption Key Hierarchy |
|
|
6 | (1) |
|
|
|
7 | (1) |
|
|
|
7 | (1) |
|
Native Code Exploit Mitigations: ASLR, XN, and Friends |
|
|
8 | (1) |
|
|
|
9 | (1) |
|
How Effective Is App Store Review? |
|
|
10 | (2) |
|
|
|
11 | (1) |
|
|
|
11 | (1) |
|
Intentionally Vulnerable Code |
|
|
12 | (1) |
|
|
|
12 | (1) |
|
|
|
12 | (1) |
|
2 Objective-C For The Lazy |
|
|
13 | (14) |
|
Key iOS Programming Terminology |
|
|
14 | (1) |
|
|
|
14 | (1) |
|
Dissecting an Objective-C Program |
|
|
15 | (3) |
|
|
|
15 | (1) |
|
Inside an Implementation File |
|
|
16 | (2) |
|
Specifying Callbacks with Blocks |
|
|
18 | (1) |
|
How Objective-C Manages Memory |
|
|
18 | (1) |
|
Automatic Reference Counting |
|
|
19 | (1) |
|
|
|
20 | (2) |
|
|
|
20 | (1) |
|
|
|
20 | (1) |
|
|
|
20 | (1) |
|
Declaring and Conforming to Protocols |
|
|
21 | (1) |
|
The Dangers of Categories |
|
|
22 | (1) |
|
|
|
23 | (2) |
|
|
|
25 | (2) |
|
3 IOS Application Anatomy |
|
|
27 | (14) |
|
|
|
29 | (3) |
|
|
|
32 | (1) |
|
|
|
33 | (1) |
|
|
|
34 | (3) |
|
The Documents and Inbox Directories |
|
|
34 | (1) |
|
|
|
35 | (2) |
|
|
|
37 | (1) |
|
|
|
37 | (1) |
|
|
|
38 | (3) |
| Part II Security Testing |
|
|
4 Building Your Test Platform |
|
|
41 | (20) |
|
Taking Off the Training Wheels |
|
|
41 | (1) |
|
Suggested Testing Devices |
|
|
42 | (1) |
|
Testing with a Device vs. Using a Simulator |
|
|
43 | (1) |
|
|
|
43 | (7) |
|
|
|
44 | (2) |
|
Bypassing SSL with stunnel |
|
|
46 | (1) |
|
Certificate Management on a Device |
|
|
47 | (1) |
|
|
|
48 | (2) |
|
|
|
50 | (5) |
|
|
|
51 | (2) |
|
|
|
53 | (1) |
|
Clang and Static Analysis |
|
|
54 | (1) |
|
Address Sanitizer and Dynamic Analysis |
|
|
55 | (1) |
|
Monitoring Programs with Instruments |
|
|
55 | (4) |
|
|
|
55 | (3) |
|
Watching Filesystem Activity with Watchdog |
|
|
58 | (1) |
|
|
|
59 | (2) |
|
5 Debugging With LLDB And Friends |
|
|
61 | (16) |
|
|
|
62 | (10) |
|
|
|
62 | (2) |
|
Navigating Frames and Variables |
|
|
64 | (4) |
|
Visually Inspecting Objects |
|
|
68 | (1) |
|
Manipulating Variables and Properties |
|
|
69 | (1) |
|
|
|
70 | (2) |
|
Using Ildb for Security Analysis |
|
|
72 | (3) |
|
|
|
72 | (2) |
|
|
|
74 | (1) |
|
Examining Core Frameworks |
|
|
74 | (1) |
|
|
|
75 | (2) |
|
|
|
77 | (30) |
|
Installing Third-Party Apps |
|
|
78 | (2) |
|
|
|
78 | (2) |
|
Using a .ipa Package File |
|
|
80 | (1) |
|
|
|
80 | (9) |
|
Launching the debugserver on the Device |
|
|
81 | (3) |
|
Locating the Encrypted Segment |
|
|
84 | (3) |
|
Dumping Application Memory |
|
|
87 | (2) |
|
Reverse Engineering from Decrypted Binaries |
|
|
89 | (7) |
|
Inspecting Binaries with otool |
|
|
90 | (2) |
|
Obtaining Class Information with class-dump |
|
|
92 | (1) |
|
Extracting Data from Running Programs with Cycript |
|
|
93 | (1) |
|
|
|
94 | (2) |
|
Defeating Certificate Pinning |
|
|
96 | (1) |
|
Hooking with Cydia Substrate |
|
|
97 | (3) |
|
Automating Hooking with Introspy |
|
|
100 | (3) |
|
|
|
103 | (4) |
| Part III Security Quirks Of The Cocoa API |
|
|
|
|
107 | (24) |
|
Using the iOS URL Loading System |
|
|
108 | (9) |
|
Using Transport Layer Security Correctly |
|
|
108 | (2) |
|
Basic Authentication with NSURLConnection |
|
|
110 | (2) |
|
Implementing TLS Mutual Authentication with NSURLConnection |
|
|
112 | (1) |
|
Modifying Redirect Behavior |
|
|
113 | (1) |
|
|
|
114 | (3) |
|
|
|
117 | (5) |
|
NSURLSession Configuration |
|
|
117 | (1) |
|
Performing NSURLSession Tasks |
|
|
118 | (1) |
|
Spotting NSURLSession TLS Bypasses |
|
|
119 | (1) |
|
Basic Authentication with NSURLSession |
|
|
119 | (2) |
|
Managing Stored URL Credentials |
|
|
121 | (1) |
|
Risks of Third-Party Networking APIs |
|
|
122 | (3) |
|
Bad and Good Uses of AFNetworking |
|
|
122 | (2) |
|
Unsafe Uses of ASIHTTPRequest |
|
|
124 | (1) |
|
|
|
125 | (2) |
|
Lower-Level Networking with NSStream |
|
|
127 | (1) |
|
Even Lower-level Networking with CFStream |
|
|
128 | (1) |
|
|
|
129 | (2) |
|
8 Interprocess Communication |
|
|
131 | (16) |
|
URL Schemes and the openURL Method |
|
|
132 | (5) |
|
|
|
132 | (1) |
|
Sending and Receiving URL/IPC Requests |
|
|
133 | (1) |
|
Validating URLs and Authenticating the Sender |
|
|
134 | (2) |
|
|
|
136 | (1) |
|
|
|
137 | (2) |
|
Sharing Data with UIActivity |
|
|
139 | (1) |
|
|
|
140 | (4) |
|
Checking Whether an App Implements Extensions |
|
|
141 | (1) |
|
Restricting and Validating Shareable Data |
|
|
142 | (1) |
|
Preventing Apps from Interacting with Extensions |
|
|
143 | (1) |
|
A Failed IPC Hack: The Pasteboard |
|
|
144 | (1) |
|
|
|
145 | (2) |
|
|
|
147 | (14) |
|
Using (and Abusing) UIWebViews |
|
|
147 | (3) |
|
|
|
148 | (1) |
|
Executing JavaScript in UIWebViews |
|
|
149 | (1) |
|
Rewards and Risks of JavaScript-Cocoa Bridges |
|
|
150 | (8) |
|
Interfacing Apps with JavaScriptCore |
|
|
150 | (4) |
|
Executing JavaScript with Cordova |
|
|
154 | (4) |
|
|
|
158 | (2) |
|
|
|
158 | (1) |
|
Security Benefits of WKWebViews |
|
|
159 | (1) |
|
|
|
160 | (1) |
|
|
|
161 | (28) |
|
The Truth About NSLog and the Apple System Log |
|
|
161 | (3) |
|
Disabling NSLog in Release Builds |
|
|
163 | (1) |
|
Logging with Breakpoint Actions Instead |
|
|
164 | (1) |
|
How Sensitive Data Leaks Through Pasteboards |
|
|
164 | (5) |
|
Restriction-Free System Pasteboards |
|
|
165 | (1) |
|
The Risks of Custom-Named Pasteboards |
|
|
165 | (2) |
|
Pasteboard Data Protection Strategies |
|
|
167 | (2) |
|
Finding and Plugging HTTP Cache Leaks |
|
|
169 | (6) |
|
|
|
170 | (1) |
|
Solutions for Removing Cached Data |
|
|
171 | (3) |
|
Data Leakage from HTTP Local Storage and Databases |
|
|
174 | (1) |
|
Keylogging and the Autocorrection Database |
|
|
175 | (3) |
|
Misusing User Preferences |
|
|
178 | (1) |
|
Dealing with Sensitive Data in Snapshots |
|
|
178 | (6) |
|
Screen Sanitization Strategies |
|
|
179 | (3) |
|
Why Do Those Screen Sanitization Strategies Work2 |
|
|
182 | (1) |
|
Common Sanitization Mistakes |
|
|
183 | (1) |
|
Avoiding Snapshots by Preventing Suspension |
|
|
183 | (1) |
|
Leaks Due to State Preservation |
|
|
184 | (1) |
|
Secure State Preservation |
|
|
185 | (2) |
|
Getting Off iCloud to Avoid Leaks |
|
|
187 | (1) |
|
|
|
188 | (1) |
|
11 Legacy Issues And Baggage From C |
|
|
189 | (10) |
|
|
|
190 | (3) |
|
Preventing Classic C Format String Attacks |
|
|
191 | (1) |
|
Preventing Objective-C Format String Attacks |
|
|
192 | (1) |
|
Buffer Overflows and the Stack |
|
|
193 | (3) |
|
|
|
194 | (1) |
|
Preventing Buffer Overflows |
|
|
195 | (1) |
|
Integer Overflows and the Heap |
|
|
196 | (2) |
|
A malloc Integer Overflow |
|
|
197 | (1) |
|
Preventing Integer Overflows |
|
|
198 | (1) |
|
|
|
198 | (1) |
|
|
|
199 | (12) |
|
Client-Side Cross-Site Scripting |
|
|
199 | (4) |
|
|
|
200 | (1) |
|
|
|
201 | (2) |
|
|
|
203 | (1) |
|
|
|
204 | (1) |
|
|
|
205 | (2) |
|
Injection Through XML External Entities |
|
|
205 | (2) |
|
Issues with Alternative XML Libraries |
|
|
207 | (1) |
|
|
|
207 | (4) |
| Part IV Keeping Data Safe |
|
|
13 Encryption And Authentication |
|
|
211 | (22) |
|
|
|
211 | (8) |
|
The Keychain in User Backups |
|
|
212 | (1) |
|
Keychain Protection Attributes |
|
|
212 | (2) |
|
|
|
214 | (3) |
|
|
|
217 | (1) |
|
|
|
218 | (1) |
|
|
|
219 | (1) |
|
|
|
219 | (6) |
|
|
|
220 | (3) |
|
The DataProtectionClass Entitlement |
|
|
223 | (1) |
|
Checking for Protected Data Availability |
|
|
224 | (1) |
|
Encryption with CommonCrypto |
|
|
225 | (3) |
|
Broken Algorithms to Avoid |
|
|
226 | (1) |
|
Broken Initialization Vectors |
|
|
226 | (1) |
|
|
|
227 | (1) |
|
|
|
227 | (1) |
|
Performing Hashing Operations |
|
|
228 | (1) |
|
Ensuring Message Authenticity with HMACs |
|
|
229 | (1) |
|
Wrapping CommonCrypto with RNCryptor |
|
|
230 | (1) |
|
Local Authentication: Using the TouchlD |
|
|
231 | (1) |
|
How Safe Are Fingerprints? |
|
|
232 | (1) |
|
|
|
232 | (1) |
|
14 Mobile Privacy Concerns |
|
|
233 | (16) |
|
Dangers of Unique Device Identifiers |
|
|
233 | (3) |
|
|
|
234 | (1) |
|
Rules for Working with Unique Identifiers |
|
|
235 | (1) |
|
Mobile Safari and the Do Not Track Header |
|
|
236 | (1) |
|
|
|
237 | (1) |
|
Monitoring Location and Movement |
|
|
238 | (2) |
|
|
|
238 | (1) |
|
The Risks of Storing Location Data |
|
|
238 | (1) |
|
Restricting Location Accuracy |
|
|
239 | (1) |
|
|
|
240 | (1) |
|
Managing Health and Motion Information |
|
|
240 | (3) |
|
Reading and Writing Data from HealthKit |
|
|
241 | (1) |
|
|
|
242 | (1) |
|
Requesting Permission to Collect Data |
|
|
243 | (1) |
|
Proximity Tracking with iBeacons |
|
|
244 | (3) |
|
|
|
244 | (2) |
|
Turning an iOS Device into an iBeacon |
|
|
246 | (1) |
|
|
|
247 | (1) |
|
Establishing Privacy Policies |
|
|
247 | (1) |
|
|
|
248 | (1) |
| Index |
|
249 | |
