Uncovering OWASP’s Mobile Risks in iOS Apps
Talkat AppSec California 2015 · on Wednesday, 2015-01-28· at 11:30· Annenberg Community Beach House: Track 4, 415 Pacific Coast Hwy·
summary
Shows concrete steps and results: uses AppleScript to automate iTunes download (about 10–15 lines), jailbroken-device techniques to extract unencrypted binary via GDB, clutch or DYLD-injected decryptor and to dump decrypted memory, and IDA Pro / otool / class-dump and ARM disassembly to trace Objective‑C calls. Demonstrates Burp network interception, file IO inspection and runtime instrumentation (cycript/script) and reports real, exploitable findings — hardcoded API keys, unpinned SSL, exposed session tokens and plaintext databases — all reproducible on apps like Tinder SnapChat CitiMobile Dropcam WhatsApp Puffchat Grinder Whisper.
AI-written summary · about
chapters (38)
- 0:00Start
- 1:50Technical Overview
- 2:32Apple Devices Ios Applications
- 7:52Constructs of Ios Application Security
- 8:12Sandbox Limits Apps
- 12:13Architecture Specific Argumentaries
- 12:35Load Commands
- 13:09Objective C
- 13:38Syntax
- 19:13Reverse Engineering Tools
- 19:59Comprehensive Tool Suites
- 23:48Enumerate All the Ui Elements
- 25:36Strip Off the Encryption Manually
- 25:51Remove the Encryption from Apple Binaries
- 26:45Static Analysis
- 27:36Class Names and Method Signatures
- 29:11First Call to Obscene Message Check
- 30:04Formatting the State Object into a String
- 30:54Types of Dynamic Analysis
- 32:34Filemod
- 33:07Debugging
- 33:22Debugging Apps
- 33:59Info Share
- 34:27Print Object Command
- 37:38Most Common Class of Ios Vulnerabilities
- 37:50Standard Network Security Practices
- 38:23Does the App Use Ssl
- 39:32Disassembly from an App That Allows a Self-Signed Certificate
- 40:16Mixed Content Attacks
- 42:05Ssl Pinning
- 43:40Common Web Vulnerabilities
- 44:38How To Secure Your Data and Why
- 44:58The Data Protection Api
- 45:45Data Storage
- 51:00Storage within a Log File
- 51:49Geolocation
- 53:00Grindr
- 55:37Binary Cookies
related talks
47mBASHing iOS Applications
49mHow to Hack Your Own Mobile App
36mTesting iOS Apps without Jailbreak in 2018
40mIntroduction into Reverse Engineering and iOS Security
29miOS Runtime Manipulation (PWND)
47mSecurity Threats & Mitigations for iOS Developers
54mUnwrapping the Truth: Analysis of Mobile Application Wrapping Solutions
49mContain Yourself: Building Secure Containers for Mobile Devices