Contain Yourself: Building Secure Containers for Mobile Devices
summary
Case studies show how commercial BYOD products perform dynamic library injection and method swizzling to wrap apps, with injected libs discovered by comparing Mach-O binaries using Hex Fiend and MachOView. Reversing uses Clutch, class‑dump, MobileSubstrate/theos and Cycript to call methods, bypass PINs and extract keys. Assessments find practical failures: plaintext copies via Document Interaction, persistent cookie files, and crypto errors like using SHA256 where PBKDF2 or proper key derivation is required. Remote wipe and jailbreak detection are frequently incomplete.
AI-written summary · about
chapters (5)
- 0:00Start
- 5:53What is Application Wrapping and How It Is Implemented
- 25:20Online and Offline Authentication Designs
- 27:21Common Crypto Implementation Flaws
- 37:09Jailbreak Detection
related talks
54mUnwrapping the Truth: Analysis of Mobile Application Wrapping Solutions
39mBad for Enterprise: Attacking BYOD Enterprise Mobile Security Solutions
58mUncovering OWASP’s Mobile Risks in iOS Apps
49mHow to Hack Your Own Mobile App
40mBest practices for shielding mobile apps from emerging threats
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
45mTen Secrets to Secure Mobile Applications
40mIntroduction into Reverse Engineering and iOS Security