Security Threats & Mitigations for iOS Developers
summary
Covers concrete iOS threats and fixes: shows an attack that replaced the Skype app and inherited its sandbox using enterprise-signed binaries, explains Xcode Ghost and a live demo of Xcode-injected Apple ID exfiltration via Keychain access, cites the iOS 9 AirDrop (ADROProp) and mask-attack families, and prescribes App Transport Security with TLS 1.2 + certificate pinning plus limiting keychain/backups and isolating developer tools in VMs.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 1:34Is iOS secure
- 2:16Security failures
- 3:33Whiler Kerr
- 4:26Mask Attacks
- 5:14iOS 9 Vulnerability
- 7:14Xcode Ghost
- 9:14Apples Response
- 9:55Security from attackers point of view
- 10:34App data
- 11:31Executing code
- 12:23Phishing attacks
- 12:43iOS vs Android
- 13:24App Store Review
- 14:56Enterprise Certificate
- 15:45Sam Boxing
- 17:30Data Protection
- 19:51Keychain Items
- 20:23App Transport Security
- 23:50TLS 102
- 25:25Certificate Authorities
- 27:28AFNetworking
- 28:45Demos
- 34:55XcodeGhost
- 41:32Summary
related talks
27miOS Attack Vectors and how to protect your app
33mBuilding Secure iOS Apps (you don’t have to learn it the hard way!)
37mOutsmarting Hackers before your App gets pwn'ed
58mUncovering OWASP’s Mobile Risks in iOS Apps
45mTen Secrets to Secure Mobile Applications
48mMobile Security Attacks: A Glimpse from the Trenches
49mHow to Hack Your Own Mobile App
43miOS Application Defense - iMAS