Building&Hacking modern iOS apps Wojciech Regua @_r3ggi - PowerPoint PPT Presentation

www.securing.pl Building&Hacking modern iOS apps Wojciech Reguła @_r3ggi wojciech.regula@securing.pl

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl WHOAMI -Senior IT Security Consultant @ SecuRing -Focused on iOS apps security -Blogger https://wojciechregula.blog/ -OWASP SKF contributor

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl INTRODUCTION

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl AGENDA 1. iOS platform myths and reality 2. securityProblemsInMASVSCategories.forEach { problem in 2.1 Discuss problem 2.2 Show solution 2.3 Present new Apple WWDC feature } 3. My new library – iOS Security Suite 🚁 4. Short and long term things to implement in your code

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl PART I PLATFORM MYTHS AND REALITY

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl MYTH #1 APPLE’S REVIEW IS 100% RELIABLE https://twitter.com/orhaneee/status/1076147994574184449

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl MYTH #2 THERE IS NO JAILBREAK FOR IOS 11+ https://github.com/pwn20wndstuff/Undecimus

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl MYTH #3 NO JAILBREAK MEANS NO REVERSING APPS

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl PART II SECURE DEVELOPMENT

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl V1 ARCHITECTURE

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl SWIFT VS OBJECTIVE-C -Integer overflow -> Runtime error -No direct memory access (unless usage of UnsafePointer) -Format string mitigated through string interpolation

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl MYTH – SWIFT AUTOOBFUSCATES ITSELF -There is no obfuscation -Swift uses ”name mangling”

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl MYTH – SWIFT AUTOOBFUSCATES ITSELF -Class TestClass -1 Instance variable -Constructor -2 Methods

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl www.securing.pl www.securing.pl MYTH – SWIFT MYTH – SWIFT AUTOOBFUSCATES AUTOOBFUSCATES ITSELF ITSELF - _$ Swift Symbol - _$ Swift Symbol - Length and module name - Length and module name - Length and class name - Length and class name - C function of class (method) - C function of class (method) - Length and method name - Length and method name - Parameters and return type - Parameters and return type

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl MYTH – SWIFT METHODS CANNOT BE DYNAMICALLY CHANGED -They can, using for example Frida -You just need to hook the symbol

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl MYTH – SWIFT METHODS CANNOT BE DYNAMICALLY CHANGED

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl DEMO HTTPS://VIMEO.COM/334861122

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl TAKEAWAYS -Binary vulnerabilities mitigated -Mostly no memory access -Obufscation ⬇ https://github.com/rockbruno/swiftshield

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl AUTOMATED SMS CODES INPUT (WWDC 2018) -Controversial feature since other app may have access to the one time password -Low risk but there is possibility to do social engineering

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl DEMO HTTPS://VIMEO.COM/334861389

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl V2 DATA STORAGE

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl ON-DEVICE DATA STORAGE -Most common issue is storing sensitive data on the device that should not be there: • API Keys • SSH Keys • Cloud credentials • Test env credentials

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl ON-DEVICE DATA STORAGE -Sensitive data may be insecurely stored in: • Info.plist • User defaults • Regular files • Hardcoded into the binary • Even in Keychain (as they shouldn’t be stored client-side)

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl ON-DEVICE DATA STORAGE

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl ON-DEVICE DATA STORAGE -Directories that are backed up: • Documents/ • Library/Application Support/ • Library/Preferences/ • Library/* -Directories not backed up: • Library/Caches/ • tmp/

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl CREDENTIAL PROVIDER EXTENSION (WWDC 2018) -Password managers in native apps -Add UITextContentType

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl TAKEAWAYS -No sensitive data in IPA -kSecAttrAccessibleWhen with ThisDeviceOnly -UIKit DataProtection -Credential Providers

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl V3 CRYPTOGRAPHY

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl CRYPTOGRAPHY - Insecure token generation - Bear case

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl https://wojciechregula.blog/post/stealing-bear-notes-with-url-schemes/

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl AUTOMATIC STRONG PASSWORDS (WWDC 2018) - Mentioned before Autofill can create new passwords connected with your domain - You are able to set the password policy that will be applied

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl TAKEAWAYS -No home-made ciphers -Everything in IPA is public -SecKeyCreateEncryptedData instead of 3 rd party AES/RSA -Native password policy

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl V4 SESSION MANAGEMENT

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl SESSION MANAGEMENT -Local access control… -JWT -> sign the token!

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl V5 NETWORK COMMUNICATION

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl NETWORK COMMUNICATION -Avoid HTTP -Use HTTPS ✅ -App Transport Security -HTTPS -> make sure if cert is trusted

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl V6 PLATFORM INTERACTION

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl INTER-PROCESS (APPLICATION) COMMUNICATION -XPC (macOS, iOS not allowed) -Mach messages (macOS, iOS not allowed) -URL Schemes -AirDrop -Clipboard (please, do not do that)

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl TAKEAWAYS -Verify sender -Check parameters -If WebView -> check permissions

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl V7 CODE QUALITY

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl CODE QUALITY -No deprecated APIs -Vulnerable libraries -CocoaPods/Carthage -> no fixed versions please

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl AFNetworking 2.5.1 allowed to perform Man in the Middle attack when app did not use SSL pinning

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl DEPRECATED UIWEBVIEW (WWDC 2018) -UIWebView has access to local files via file:// handler BY DEFAULT -WKWebView also has if you turn some flags on btw -XSS ☠

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl DICTIONARY THAT LOOKS YOU UP

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl DEMO HTTPS://VIMEO.COM/334862417

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl HELP VIEWER PROBLEMS

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl DEMO HTTPS://VIMEO.COM/334861507

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl YAHOO IOS XSS EXAMPLE BY @OMESPINO

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl V8 RESILIENCY REQUIREMENTS

@_r3ggi wojciech.regula@securing.pl www.securing.pl www.securing.pl ANTI TAMPERING For those who: • Don’t want their app to be tampered with • Consider malware as a risk • Have to be complaint with OWASP MASVS