"You take the blue pill, the story ends here, you wake up and believe whatever you want to believe. You take the red pill...and I'll show you just how deep the rabbit hole goes."
— Morpheus, The Matrix
Last week, our iOS developer Viktor Kotov organized a roundtable for his fellow Azoft developers to discuss the topic of protecting user data in case of a jailbroken iPhone or iPad. Turns out, magic framework that would allow developers to build invincible apps hasn’t been invented yet. However, Viktor talked about a number of practices proposed by Jonathan Zdziarski in his book “Hacking and Securing iOS Applications”, which help protect against user data theft.
Similar to the way Morpheus’ red pill dispelled Neo’s illusion of safety and stability in the world, a jailbreak can destroy the elaborate security system of iOS. In fact, all security measures (i.e. built-in data encryption algorithm, control over accessing system resources, sandbox limitations, etc.) become useless after a jailbreak, so hackers can easily access any information on the device. You can perform iOS pentesting yourself to find and fix the crucial weaknesses.
Here are some tips to make iOS apps more secure.
- The key to a good encryption is to use data that isn’t stored on the device. Instead, use data entered by the user (for example user’s passphrase).
- Storing data outside device doesn't make it safe automatically. Securing remote data is also important.
- Perform security checks on a remote server, not on a device.
- Use server responses that can be validated on the client device rather than BOOL answers.
- Add false contacts and kill switches in your application, which allows to erase data, report a breach attempt to the remote server at a false hit of attackers.
- Enable logging of all events happening inside an application.
- Avoid storing decoded data on a device: even if files have been deleted, they can be restored.
- Prevent critical data from openly hanging in singletons the whole time application is working.
- Avoid cliché practices, like using the Keychain.
- Turn off autocorrection for fields with secure information.
- Avoid storing data in string variables, since it will be easily retrieved from application distributive.
- Avoid giving standard names to critical methods.
- Use С/С++ for critical classes, instead of Objective-C.
- Use static inline functions.
- Use VACUUM for SQLite database. If the procedure takes too long, for fast deleting use UPDATE + ZEROBLOB, then DELETE.
- Prohibit iOS to make screenshots by using [UIApplication sharedApplication].keyWindow.hidden = YES; (applicationWillResignActive + applicationDidEnterBackground).
- Incorporate anti-debugging techniques, class validation, and jailbreak detection into your app.
And lastly, some apps you might find useful:
- redsn0w — jailbreaking
- ldid — signing apps
- OpenSSH — connecting to a device over a network through a shell
- iProxy — communicating with device through usbmux protocol
- class-dump-z — retrieving data like classes and methods from Objective-C apps
Secure your apps and don’t let your guard down.
P.S. “Actually, I've been thinking it ever since I got here: Why oh why didn't I take the BLUE pill?” — Cypher, The Matrix