Download as PDF, PPTX
Uploaded bySecuRing
Testing iOS apps without jailbreak in 2018
The document discusses methods for testing iOS applications without jailbreaking, highlighting the current state of jailbreaking and its challenges. It details the types of vulnerabilities to examine, the testing stages (static and dynamic analysis), and alternative methods like dylib injection for pentesting. It concludes that while jailbreaking is arduous, techniques exist to successfully conduct tests on iOS apps without it.
More Related Content
Similar to Testing iOS apps without jailbreak in 2018
![[CONFidence 2016] Sławomir Kosowski - Introduction to iOS Application Securit...](https://cdn.slidesharecdn.com/ss_thumbnails/slawomirkosowski-introductiontoiospenetrationtesting-160603095607-thumbnail.jpg?width=640&height=640&fit=bounds)
Testing iOS apps without jailbreak in 2018
- 1. Testing iOS Appswithout Jailbreak in 2018 Wojciech Reguła
- 2.
- 3. Testing iOS Appswithout Jailbreak in 2018 > Whoami Wojciech Reguła • Pentester @ SecuRing • Creator of Ruby secure code examples for OWASP SKF • 🍎 products fan • Blogger – https://wojciechregula.blog wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 4. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 Agenda 1. Introduction to iOS apps pentests 2. Current jailbreak situation 3. Pentesting without jailbreak • Setting environment 💻 📲 • Pentesting 👾 4. Summary wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 5. Why should wecare about iOS? Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 6. Wojciech Reguła Testing iOSApps without Jailbreak in 2018
- 7. ❤️ SEXUAL ACTIVITY❤️ BY SMART PHONE BRAND Men Women
- 8. Do we reallyneed checking iOS apps security? Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 10. Selected problems withiOS apps Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 13. Selected problems withiOS apps Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 15. Selected problems withiOS apps Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 18. So what wehave to check? Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 19. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 OWASP MASVS V1: Architecture, Design and Threat Modelling V2: Data Storage and Privacy V3: Cryptography Verification V4: Authentication and Session Management V5: Network Communication V6: Platform Interaction V7: Code Quality and Build Settings V8: Resiliency Against Reverse Engineering wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 20. Let's split thetests into two stages Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 Static analysis Dynamic analysis wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 21. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 Static analysis Examples: • Excessive data in application package • Binaries security • Obfuscation • ATS configuration, iTunes file sharing wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 22. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 Examples: • Files saved by application • Data in Keychain • Vulnerable URL handlers (IPC) • Application logs • Certificate pinning • Cache • Confidential information in snapshot Dynamic analysis wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 24. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 Examples: • Files saved by application • Data in Keychain • Vulnerable URL handlers (IPC) • Application logs • Certificate pinning • Cache • Confidential information in snapshot Dynamic analysis wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 25. What do weneed a Jailbreak for? Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 1. Usually for dynamic analysis 2. For static analysis when we don’t have app package (*ipa) wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 27. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 #update – recently it gets better
- 28. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 But could have been even better
- 29. So, if youare a security guy, why can’t you just create your own jailbreak? Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 31. Alriiight, let’s startjailbreaking 😈 Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 32. Not so fast!👿 Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 33. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 34. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 FAIL: Jailbreak on your iOS but for 32-bit devices wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 35. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 36. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 FAIL: Jailbreak exploiting bug in iPhone 7 driver wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 37. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 38. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 FAIL: Jailbreak from iOS x.3.0 but you have only iOS x.2.9 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 39. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 40. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 FAIL: Jailbreak for your iOS in not public wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 41. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 42. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 FAIL: Jailbreak up to iOS y.1.0 but you have only iOS y.1.2 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 43. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 44. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 SUCCESS: Congratz, you have working jailbreak! 👑 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 45. But there isa way! Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 46. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 Injecting custom dylib 0*. Downloading application package 1. Setting up the environment 2. Injecting custom dylib & modification of executable file 3. Repacking and signing the package 4. Installing the app on device in debug mode wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 47. 0*. Downloading applicationpackage Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 48. 1. Setting upthe environment Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 embedded.mobileprovision Signing certificate wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 49.
- 50.
- 51.
- 54. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 1. Setting up the environment wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 55. Injecting custom dylib& modification of executable file Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 59. Installing the Appin debug mode Link to demo: ➡️ https://vimeo.com/273879188 Wojciech Reguła Testing iOS Apps without Jailbreak in 2018
- 60. Connecting to Fridadylib Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 • Objection (Leonjza, bernard-wagner) • Needle • Directly using Frida • Passionfruit (ChiChou, oleavr) wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 61. Connecting with Passionfruit Linkto demo: ➡️ https://vimeo.com/273879557 Wojciech Reguła Testing iOS Apps without Jailbreak in 2018
- 62. Files saved byapplication Wojciech Reguła Testing iOS Apps without Jailbreak in 2018
- 63. Cookies 🍪 Wojciech Reguła TestingiOS Apps without Jailbreak in 2018
- 64. User defaults Wojciech Reguła TestingiOS Apps without Jailbreak in 2018
- 65. Application cache Wojciech Reguła TestingiOS Apps without Jailbreak in 2018
- 66. Accessing Keychain Wojciech Reguła TestingiOS Apps without Jailbreak in 2018
- 67. Sometimes it crashes WojciechReguła Testing iOS Apps without Jailbreak in 2018
- 68.
- 69. Summary Wojciech Reguła Testing iOSApps without Jailbreak in 2018 1. Jailbreaking needs a lot of effort from us 2. Using ‘dylib injection’ makes it possible to perform pentests of iOS apps 3. This method sometimes causes problems: • SSL Pinning not so obvious like on jailbroken device • How to get the application package (*.ipa)
- 70. Wojciech Reguła Testing iOSApps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula Try it at home 😎 https://goo.gl/XDD53U
- 71. More general mobilesec guide ⬇️ https://www.securing.biz/en/secure-mobile- applications-key-issues/index.html
- 72. Question: How doyou deal with this problem? Wojciech Reguła Testing iOS Apps without Jailbreak in 2018 wojciech.regula@securing.pl @_r3ggi wojciech-regula
- 73. SecuRing Kalwaryjska 65/6 30-504 Kraków,Poland info@securing.pl tel. +48 124252575 http://www.securing.biz/en Contact Wojciech Reguła wojciech.regula@securing.pl @_r3ggi wojciech-regula