Jonathan Zdziarski - Hacking and Securing iOS Applications: Stealing Data, Hijacking Software, and How to Prevent It

Copyright 2012 Jonathan Zdziarski

OReilly books may be purchased for educational, business, or sales promotional use. Online editions are also available for most titles (.

Nutshell Handbook, the Nutshell Handbook logo, and the OReilly logo are registered trademarks of OReilly Media, Inc. Hacking and Securing iOS Applications , the cover image of a skunk, and related trade dress are trademarks of OReilly Media, Inc.

Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and OReilly Media, Inc. was aware of a trademark claim, the designations have been printed in caps or initial caps.

While every precaution has been taken in the preparation of this book, the publisher and authors assume no responsibility for errors or omissions, or for damages resulting from the use of the information contained herein.

This book is geared toward iOS developers looking to design secure applications. This is not necessarily limited to government or financial applications, but may also pertain to applications with assets or other features that the developer is looking to protect. Youll need a solid foundation of Objective-C coding on iOS to understand a majority of this book. A further understanding of C or assembly language will also help, but is not required.

While this book primarily focuses on iOS, much of the material can also be applied directly to the Mac OS X desktop. Given that both environments run an Objective-C environment and share many of the same tools, youll find much of this book can be used to expose vulnerabilities in your companys desktop applications as well.

This book is split into two halves. The first half discusses hacking and exposes the many vulnerabilities in iOS and iOS applications, while the second half covers techniques to better secure applications.

explains the core problem with mobile security, and outlines common myths, misconceptions, and overall flaws in many developers ways of thinking about security.

introduces the reader to many techniques of compromising an iOS device, including jailbreaking. The reader will learn how to build and inject custom code into an iOS device using popular jailbreaking techniques and custom RAM disks.

demonstrates how the filesystem of an iOS device can be stolen in minutes, and how developers cant rely solely on a manufacturers disk encryption. Youll also learn about some common social engineering practices that secure access to a device without the owners knowledge.

covers the forensic data left by the operating system, and what kind of information one can steal from a device.

explains how iOSs keychain encryption and data protection encryption can be defeated, and the inherent problems of each.

demonstrates how the HFS journal can be scraped for deleted files, and provides examples of how to securely delete files so they cannot be recovered.

introduces you to tools for spying on and manipulating the runtime environment, and demonstrates how black hat hackers can manipulate your applications objects, variables, and methods to bypass many layers of security.

introduces you to tools and approaches for disassembling and debugging your application, injecting malicious code, and performing low-level attacks using a number of techniques.

illustrates some of the tools used to hijack SSL sessions, and how to protect your application from falling victim to these attacks.

elaborates on security and describes additional methods to protect your data with proper encryption techniques.

explains how to help prevent forensic data leakage by designing your application to leave fewer traces of information.

explains many best practices to increase the complexity needed for an attack on your applications.

explains techniques used to detect when an application is running on a device jailbroken with some of the popular jailbreaking tools available.

wraps up the book and explains how important it is to understand and strategize like your adversary.