Сергей Харюк (Украина). Проверка безопасности приложений на платформе iOS
- 1. Сергей Ximerus Харюк “Проверка безопасности приложений на платформе iOS”
- 2. Agenda • Overview • iOS Security architecture • Application data structure • Preparation testing environment • Tools • dumpdecrypted • IDA and Hopper • Frida and Cycript • needle and idb • OWASP Top 10 Mobile • M1: Improper Platform Usage • M2: Insecure Data Storage • M3: Insecure Communication • M4: Insecure Authentication • M5: Insufficient Cryptography • M6: Insecure Authorization • M7: Client Code Quality • M8: Code Tampering • M9: Reverse Engineering • M10: Extraneous Functionality • Research results • Low security lvl • Medium security lvl • Good security lvl
- 3. iOS Security Architecture Kernel Secure Enclave Secure Element Crypto Engine Device Key Group Key Apple Root Certificate File System HardwareandFirmware Software OS Partition User Partition (Encrypted) Application sandbox Data protection class
- 4. Secure Boot Boot ROM Low Level Bootloader iBoot Kernel
- 5. File System protection Hardware Key Passcode Class key File metadata File content File system key File key
- 6. TouchID and FaceID is secure?
- 8. Environment on Device • AppList • Cydia Substrate • DumpDecrypted • Frida • Keychaineditor • NeedleAgent • OpenSSH • SSL KillSwitch 2 • Stashing for iOS
- 9. dumpdecrypted put dumpdecrypted.dlyb in to /usr/lib/ set permissions to read and execute DLYB_INSERT_LIBRARIES=/usr/lib/dumpdecrypted.dlyb /path/to/binary
- 10. IDA Pro decompiled code
- 12. needle
- 13. idb
- 14. OWASP 10 Mobile •M1: Improper Platform Usage •M2: Insecure Data Storage •M3: Insecure Communication •M4: Insecure Authentication •M5: Insufficient Cryptography •M6: Insecure Authorization •M7: Client Code Quality •M8: Code Tampering •M9: Reverse Engineering •M10: Extraneous Functionality
- 15. OWASP 10 Mobile •M1: Improper Platform Usage •M2: Insecure Data Storage •M3: Insecure Communication •M4: Insecure Authentication •M5: Insufficient Cryptography •M6: Insecure Authorization •M7: Client Code Quality •M8: Code Tampering •M9: Reverse Engineering •M10: Extraneous Functionality
- 16. OWASP 10 Mobile •M1: Improper Platform Usage •M2: Insecure Data Storage •M3: Insecure Communication •M4: Insecure Authentication •M5: Insufficient Cryptography •M6: Insecure Authorization •M7: Client Code Quality •M8: Code Tampering •M9: Reverse Engineering •M10: Extraneous Functionality
- 17. OWASP 10 Mobile •M1: Improper Platform Usage •M2: Insecure Data Storage •M3: Insecure Communication •M4: Insecure Authentication •M5: Insufficient Cryptography •M6: Insecure Authorization •M7: Client Code Quality •M8: Code Tampering •M9: Reverse Engineering •M10: Extraneous Functionality
- 18. OWASP 10 Mobile •M1: Improper Platform Usage •M2: Insecure Data Storage •M3: Insecure Communication •M4: Insecure Authentication •M5: Insufficient Cryptography •M6: Insecure Authorization •M7: Client Code Quality •M8: Code Tampering •M9: Reverse Engineering •M10: Extraneous Functionality
- 19. OWASP 10 Mobile •M1: Improper Platform Usage •M2: Insecure Data Storage •M3: Insecure Communication •M4: Insecure Authentication •M5: Insufficient Cryptography •M6: Insecure Authorization •M7: Client Code Quality •M8: Code Tampering •M9: Reverse Engineering •M10: Extraneous Functionality
- 20. OWASP 10 Mobile •M1: Improper Platform Usage •M2: Insecure Data Storage •M3: Insecure Communication •M4: Insecure Authentication •M5: Insufficient Cryptography •M6: Insecure Authorization •M7: Client Code Quality •M8: Code Tampering •M9: Reverse Engineering •M10: Extraneous Functionality
- 21. OWASP 10 Mobile •M1: Improper Platform Usage •M2: Insecure Data Storage •M3: Insecure Communication •M4: Insecure Authentication •M5: Insufficient Cryptography •M6: Insecure Authorization •M7: Client Code Quality •M8: Code Tampering •M9: Reverse Engineering •M10: Extraneous Functionality
- 22. OWASP 10 Mobile •M1: Improper Platform Usage •M2: Insecure Data Storage •M3: Insecure Communication •M4: Insecure Authentication •M5: Insufficient Cryptography •M6: Insecure Authorization •M7: Client Code Quality •M8: Code Tampering •M9: Reverse Engineering •M10: Extraneous Functionality
- 23. OWASP 10 Mobile •M1: Improper Platform Usage •M2: Insecure Data Storage •M3: Insecure Communication •M4: Insecure Authentication •M5: Insufficient Cryptography •M6: Insecure Authorization •M7: Client Code Quality •M8: Code Tampering •M9: Reverse Engineering •M10: Extraneous Functionality
- 24. OWASP 10 Mobile •M1: Improper Platform Usage •M2: Insecure Data Storage •M3: Insecure Communication •M4: Insecure Authentication •M5: Insufficient Cryptography •M6: Insecure Authorization •M7: Client Code Quality •M8: Code Tampering •M9: Reverse Engineering •M10: Extraneous Functionality
- 25. MyPay
- 26. MyPay Insecure Communication Plain Text Payment Info
- 27. HomeBank
- 28. HomeBank Insecure Communication Plain Text Payment Info Caching Screenshot
- 29. KolesaKz
- 30. KolesaKz
- 31. KolesaKz
- 32. KolesaKz
- 33. KolesaKz Insecure Authorization Insecure Data Storage Broken Cryptography Plain text credentials
- 34. Technodom
- 35. Technodom Insecure Communication Plain Text Payment Info
- 36. ATF24
- 37. ATF24
- 38. ATF24
- 39. Question? Contact info: telegram/twitter/linkedin/fb/vk: @ximerus mail: ximerus@gmail.com