Code Injection on ios 8 for the Greater Good. Alban Diquet Angela Chow Eric Castro
|
|
|
- Elfreda Parker
- 9 years ago
- Views:
Transcription
1 TrustKit Code Injection on ios 8 for the Greater Good Alban Diquet Angela Chow Eric Castro
2 About Us Alban: Engineering/security lead at Data Theorem Eric: ios R&D at Data Theorem Angela: Paranoids (security) at Yahoo
3 Agenda TrustKit: effortless SSL pinning for ios and OS X Dynamic libraries and ios 8 Function hooking on a non-jailbroken device
4 Agenda TrustKit: effortless SSL pinning for ios and OS X Dynamic libraries and ios 8 Function hooking on a non-jailbroken device
5 TrustKit Goal: Create an SSL pinning library for ios Needed a usable solution that works in real-world Apps Collaborated with the Yahoo mobile & security teams
6 SSL Pinning at Yahoo Goal: SSL pinning for Yahoo s mobile Apps Easy project, right? But... Technical challenges: What and how to pin? Operational challenges: How to get buy-in from management?
7 SSL Pinning at Yahoo Goal: SSL pinning for Yahoo s mobile Apps Easy project, right? But... Technical challenges: What and how to pin? Operational challenges: How to get buy-in from product team?
8 Technical Challenges What to pin? Certificate or public key? Best practice is Subject Public Key Info No API on ios to extract SPKI from a certificate Most libraries and examples are doing it wrong Comparing the whole certificate or public key
9 Technical Challenges How to pin? Find and modify every single instance of NSURLConnection, NSURLSession? Or better: use method swizzling Problem: no public API for customizing certificate validation in UIWebView Not even swizzling would work
10 Operational Challenges How to get buy-in from the product team? Blocking attackers is a good cause but... What if we block the wrong connections? Answer: a report-only mode Shows what connections would be blocked and why Easier to decide on whether pinning should be enforced or not
11 Operational Challenges How to get buy-in from the product team? Blocking attackers is a good cause but... What if we block the wrong connections? Answer: a report-only mode Shows what connections would be blocked and why Easier to decide on whether pinning should be enforced or not
12 Operational Challenges How to get buy-in from the product team? Blocking attackers is a good cause but... What if we block the wrong connections? Answer: a report-only mode Shows what connections would be blocked and why Easier to decide on whether pinning should be enforced or not
13 SSL Pinning at Yahoo No existing ios library supported any of these requirements SPKI pinning Report-only mode Easy to deploy but works on all networking APIs Met with Data Theorem and started a collaboration :)
14 TrustKit We solved these challenges TrustKit works transparently on all Apple APIs Easy configuration: set the pinning policy in the Info.plist Settings are heavily based on HTTP Public Key Pinning SPKI pinning: Developer needs to specify the key algorithm Report-only mode Format similar to HPKP for pin failure reports
15 TrustKit We solved these challenges TrustKit works transparently on all Apple APIs Easy configuration: set the pinning policy in the Info.plist Settings are heavily based on HTTP Public Key Pinning SPKI pinning: Developer needs to specify the key algorithm Report-only mode Format similar to HPKP for pin failure reports
16 ios Network Stack AFNetworking HTTP NSURLConnection HTTP NSURLSession HTTP (ios 7+) UIWebView Web View CFNetwork Networking BSD Sockets Networking SecureTransport SSL/TLS
17 ios Network Stack AFNetworking HTTP NSURLConnection HTTP NSURLSession HTTP (ios 7+) UIWebView Web View CFNetwork Networking TrustKit BSD Sockets Networking SecureTransport SSL/TLS
18 ios Network Stack AFNetworking HTTP NSURLConnection HTTP NSURLSession HTTP (ios 7+) UIWebView Web View CFNetwork Networking TrustKit BSD Sockets Networking SecureTransport SSL/TLS
19 TrustKit We solved these challenges TrustKit works transparently on all Apple APIs Easy configuration: set the pinning policy in the Info.plist Settings are heavily based on HTTP Public Key Pinning SPKI pinning: Developer needs to specify the key algorithm Report-only mode Format similar to HPKP for pin failure reports
20 TrustKit We solved these challenges TrustKit works transparently on all Apple APIs Easy configuration: set the pinning policy in the Info.plist Settings are heavily based on HTTP Public Key Pinning SPKI pinning: Developer needs to specify the key algorithm Report-only mode Format similar to HPKP for pin failure reports
21 TrustKit We solved these challenges SPKI pinning: Developer needs to specify the key algorithm Easy configuration Heavily based on HTTP Public Key Pinning Works on all Apple APIs Report-only mode Format similar to HPKP for pin failure reports
22 TrustKit We solved these challenges TrustKit works transparently on all Apple APIs Easy configuration: set the pinning policy in the Info.plist Settings are heavily based on HTTP Public Key Pinning SPKI pinning: Developer needs to specify the key algorithm Report-only mode Format similar to HPKP for pin failure reports
23 TrustKit We solved these challenges TrustKit works transparently on all Apple APIs Easy configuration: set the pinning policy in the Info.plist Settings are heavily based on HTTP Public Key Pinning SPKI pinning: Developer needs to specify the key algorithm Report-only mode Format similar to HPKP for pin failure reports
24 TrustKit We solved these challenges TrustKit works transparently on all Apple APIs Easy configuration: set the pinning policy in the Info.plist Settings are heavily based on HTTP Public Key Pinning SPKI pinning: Developer needs to specify the key algorithm Report-only mode Format similar to HPKP for pin failure reports
25 TrustKit { "port":443, "include-subdomains":true, "noted-hostname":"domain.com", hostname":"test.domain.com", app-bundle-id :"com.test.testapp", "validated-certificate-chain": ["-----BEGIN CERTIFICATE---- \nmiilyjcccrkgawibagiqqcm82qxxnzszqtblpwpahdanbgkqhkig9w0baqufadcb\r \nttelmakga1uebhmcvvmxfzavbgnvbaotdlzlcmltawdulcbjbmmumr8whqydvqql\r... \nwkn/i4qtce3vmxp8o17ckqegvaei5nvfhca4r4f8mnyouyt+6j07sxya5cdsxq==\n -----END CERTIFICATE-----",... "-----BEGIN CERTIFICATE----- \nmiie0zcca7ugawibagiqgnrrniz96ltkivjnzgs7sjanbgkqhkig9w0baqufadcb\r... LPKsEdao7WNq\n-----END CERTIFICATE-----"], "date-time":" t18:12:30z", "known-pins": [ "pin-sha256=\"jbqbug5jmjuoi6brnx0x3vzf6jilxsapbxgvfjhn8fg=\"", pin-sha256=\"woiwryiovna9ihabcirsc7xhjliys9vwugoiud4pb18=\"" ], app-version":"2413" }
26 TrustKit We solved these challenges TrustKit works transparently on all Apple APIs Easy configuration: set the pinning policy in the Info.plist Settings are heavily based on HTTP Public Key Pinning SPKI pinning: Developer needs to specify the key algorithm Report-only mode Format similar to HPKP for pin failure reports
27 Demo
28 TrustKit We re open sourcing TrustKit today MIT License Also works in OS X Apps More on this at the end
29 TrustKit So how does TrustKit work? Leveraged techniques usually used on jailbroken ios Code injection Low-level C function hooking Could be applied to other things than SSL pinning
30 How It All Started ios 8 released: dynamic libraries now allowed in App Store Apps! Lots of experience building Cydia tweaks Dynamic libraries that modify Apps at runtime Used for customization and security research Leverages function hooking and code injection Can we use the same techniques within an ios 8 App Store App on a non-jailbroken device?
31 How It All Started ios 8 released: dynamic libraries now allowed in App Store Apps! Lots of experience building Cydia tweaks Dynamic libraries that modify Apps at runtime Used for customization and security research Implemented by hooking functions and methods Can we use the same techniques within an ios 8 App Store App on a non-jailbroken device?
32 How It All Started ios 8 released: dynamic libraries now allowed in App Store Apps! Lots of experience building Cydia tweaks Dynamic libraries that modify Apps at runtime Used for customization and security research Implemented by hooking functions and methods Can we use the same techniques within an ios 8 App Store App on a non-jailbroken device?
33 How It All Started ios 8 released: dynamic libraries now allowed in App Store Apps! Lots of experience building Cydia tweaks Dynamic libraries that modify Apps at runtime Used for customization and security research Implemented by hooking functions and methods Can we use the same techniques within an ios 8 App Store App on a non-jailbroken device?
34 How It All Started ios 8 released: dynamic libraries now allowed in App Store Apps! Lots of experience building Cydia tweaks Dynamic libraries that modify Apps at runtime Used for customization and security research Implemented by hooking functions and methods Can we use the same techniques within an ios 8 App Store App on a non-jailbroken device?
35 How It All Started ios 8 released: dynamic libraries now allowed in App Store Apps! Lots of experience building Cydia tweaks Dynamic libraries that modify Apps at runtime Used for customization and security research Implemented by hooking functions and methods Can we use the same techniques within an ios 8 App Store App on a non-jailbroken device?
36 How It All Started ios 8 released: dynamic libraries now allowed in App Store Apps! Lots of experience building Cydia tweaks Dynamic libraries that modify Apps at runtime Used for customization and security research Implemented by hooking functions and methods Can we use the same techniques within an ios 8 App Store App on a non-jailbroken device?
37 Agenda TrustKit: effortless SSL pinning for ios and OS X Dynamic libraries and ios 8 Function hooking on a non-jailbroken device
38 Agenda TrustKit: effortless SSL pinning for ios and OS X Dynamic libraries and ios 8 Function hooking on a non-jailbroken device
39 Dylibs Before ios 8 Historically: no third-party dynamic libraries in Apps System dylibs packaged with the OS Developer libraries: static linking only Enforced via the App Store review process
40 Dylibs Before ios 8 Historically: no third-party dynamic libraries in Apps System dylibs packaged with the OS Developer libraries: static linking only Enforced via the App Store review process
41 Dylibs on ios 8 ios 8: dynamic libraries now accepted Apple calls them Embedded Frameworks Introduced to facilitate sharing code between Apps and their App Extensions But can be used regardless of whether the App actually has an Extension
42 Dylibs on ios 8
43 Dylibs on ios 8 A dynamic library dependency is created in the Mach-O binary in a load command structure Mach-O is the binary file format for programs and libraries in ios and OS X Executables interact with dyld to load their library dependencies at runtime.
44 Dylibs on ios 8 Sandboxing forces our dependencies to be packaged within the app s bundle dyld uses prefixes inside the load command to locate points to the full path where the main executable is (the.app defines library search path locations In seems limited to one single location (a Frameworks directory inside app s bundle)
45 Dylibs on ios 8 Sandboxing forces our dependencies to be packaged within the app s bundle dyld uses prefixes inside the load command to locate points to the full path where the main executable is (the.app defines library search path locations In seems limited to one single location (a Frameworks directory inside app s bundle)
46 Dynamic Libraries
47 Dynamic Libraries
48 Dylib Constructors Dynamic libraries can have constructors Basically a C function that is called when the library is loaded in memory We use it to initialize our hooks (patches) and settings attribute ((constructor)) static void initializer()
49 Dylibs Recap By adding to the App a load command with our dylib The dylib will be automatically loaded when the App starts The dylib s constructor will be run first Takes care of the injection" process Can we create a dylib that does C function hooking?
50 Dylibs Recap By adding to the App a load command with our dylib The dylib will be automatically loaded when the App starts The dylib s constructor will be run first Takes care of the injection" process Can we create a dylib that does C function hooking?
51 Dylibs Recap By adding to the App a load command with our dylib The dylib will be automatically loaded when the App starts The dylib s constructor will be run first Takes care of the injection" process Can we create a dylib that does C function hooking?
52 Agenda TrustKit: effortless SSL pinning for ios and OS X Dynamic libraries and ios 8 Function hooking on a non-jailbroken device
53 Hooking Jailbreak-Free First attempt Tried packaging an actual Cydia Substrate tweak into an App Store App Failed: no way to package a Substrate tweak in an App Store App due to RWX requirement
54 Substrate in an App Hardware Model: iphone6,1 Process: TestSubstrate [1438] Path: /private/var/mobile/containers/bundle/application/af0e2fd7-ba47-4e57-95ed- B2C3D6116E62/TestSubstrate.app/TestSubstrate Identifier: TestSubstrate Version:??? Code Type: ARM-64 (Native) Parent Process: launchd [1] Date/Time: :57: Launch Time: :57: OS Version: ios 8.4 (12H143) Report Version: 105 Exception Type: EXC_BAD_ACCESS (SIGKILL - CODESIGNING) Exception Subtype: unknown at 0x b346c4 Triggered by Thread: 0 Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0 Crashed: 0 CydiaSubstrate 0x bc 0x SSLKillSwitch.dylib 0x d30 0x dyld 0x d234 0x12005c dyld 0x d3ec 0x12005c [...]
55 Substrate in an App Hardware Model: iphone6,1 Process: TestSubstrate [1438] Path: /private/var/mobile/containers/bundle/application/af0e2fd7-ba47-4e57-95ed- B2C3D6116E62/TestSubstrate.app/TestSubstrate Identifier: TestSubstrate Version:??? Code Type: ARM-64 (Native) Parent Process: launchd [1] Date/Time: :57: Launch Time: :57: OS Version: ios 8.4 (12H143) Report Version: 105 Exception Type: EXC_BAD_ACCESS (SIGKILL - CODESIGNING) Exception Subtype: unknown at 0x b346c4 Triggered by Thread: 0 Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0 Crashed: 0 CydiaSubstrate 0x bc 0x SSLKillSwitch.dylib 0x d30 0x dyld 0x d234 0x12005c dyld 0x d3ec 0x12005c [...]
56 Substrate in an App Hardware Model: iphone6,1 Process: TestSubstrate [1438] Path: /private/var/mobile/containers/bundle/application/af0e2fd7-ba47-4e57-95ed- B2C3D6116E62/TestSubstrate.app/TestSubstrate Identifier: TestSubstrate Version:??? Code Type: ARM-64 (Native) Parent Process: launchd [1] Date/Time: :57: Launch Time: :57: OS Version: ios 8.4 (12H143) Report Version: 105 Exception Type: EXC_BAD_ACCESS (SIGKILL - CODESIGNING) Exception Subtype: unknown at 0x b346c4 Triggered by Thread: 0 Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0 Crashed: 0 CydiaSubstrate 0x bc 0x SSLKillSwitch.dylib 0x d30 0x dyld 0x d234 0x12005c dyld 0x d3ec 0x12005c [...]
57 Substrate in an App Hardware Model: iphone6,1 Process: TestSubstrate [1438] Path: /private/var/mobile/containers/bundle/application/af0e2fd7-ba47-4e57-95ed- B2C3D6116E62/TestSubstrate.app/TestSubstrate Identifier: TestSubstrate Version:??? Code Type: ARM-64 (Native) Parent Process: launchd [1] Date/Time: :57: Launch Time: :57: OS Version: ios 8.4 (12H143) Report Version: 105 Exception Type: EXC_BAD_ACCESS (SIGKILL - CODESIGNING) Exception Subtype: unknown at 0x b346c4 Triggered by Thread: 0 Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0 Crashed: 0 CydiaSubstrate 0x bc 0x MSFunctionHook() 1 SSLKillSwitch.dylib 0x d30 0x Dylib Contructor 2 dyld 0x d234 0x12005c dyld 0x d3ec 0x12005c [...]
58 Substrate in an App SIGKILL when calling MSFunctionHook() Substrate hooks C functions by patching the function s prologue This requires RWX memory pages Not possible on a non-jailbroken device Unless running in a debugger
59 Substrate in an App SIGKILL when calling MSFunctionHook() Substrate hooks C functions by patching the function s prologue This requires RWX memory pages Not possible on a non-jailbroken device Unless running in a debugger
60 Hooking Jailbreak-Free First attempt Tried packaging an actual Cydia Substrate tweak into an App Store App Failed: no way to package a Substrate tweak in an App Store App due to RWX requirement
61 Hooking Jailbreak-Free First attempt Tried packaging an actual Cydia Substrate tweak into an App Store App Failed: no way to package a Substrate tweak in an App Store App due to RWX requirement
62 Hooking Jailbreak-Free Second attempt DYLD_INSERT_LIBRARIES and interpose Similar to LD_PRELOAD on Linux Symbol rebinding: can only override exported functions Requires setting an environment variable Failed: can t be done in an App Store App outside of Xcode
63 Hooking Jailbreak-Free Second attempt DYLD_INSERT_LIBRARIES and interpose Similar to LD_PRELOAD on Linux Symbol rebinding: can only override exported functions Requires setting an environment variable Failed: can t be done in an App Store App outside of Xcode
64 Hooking Jailbreak-Free Third attempt Newer libraries for dynamic symbol rebinding comex/substitute Specifically substitute_interpose_imports() facebook/fishhook Success: We were able to create a dylib to automatically hook functions in an App Store App
65 Hooking Jailbreak-Free Third attempt Newer libraries for dynamic symbol rebinding comex/substitute Specifically substitute_interpose_imports() facebook/fishhook Success: We were able to create a dylib to automatically hook functions in an App Store App
66 Hooking Jailbreak-Free Third attempt Newer libraries for dynamic symbol rebinding comex/substitute Specifically substitute_interpose_imports() facebook/fishhook Success: We were able to create a dylib to automatically hook functions in an App Store App
67 Hooking Jailbreak-Free Third attempt Newer libraries for dynamic symbol rebinding comex/substitute Specifically substitute_interpose_imports() facebook/fishhook Success: We were able to create a dylib to automatically hook functions in an App Store App
68 Hooking Jailbreak-Free Third attempt Newer libraries for dynamic symbol rebinding comex/substitute Specifically substitute_interpose_imports() facebook/fishhook Success: We were able to create a dylib to automatically hook functions in an App Store App
69 Putting It All Together One concrete example: TrustKit for SSL pinning Adding TrustKit to the App s Xcode project: Embeds the dylib in the App s bundle Adds a load command to the App s executable
70 Putting It All Together The TrustKit dylib s constructor does all the work: Reads the pinning policy from the App s Info.plist Sets up the SecureTransport hooks Runtime patch for SSLHandshake() Uses facebook/fishhook for C function hooking No need to modify the App s source code or call a TrustKit initialization method!
71 Putting It All Together The TrustKit dylib s constructor does all the work: Reads the pinning policy from the App s Info.plist Sets up the SecureTransport hooks Runtime patch for SSLHandshake() Uses facebook/fishhook for C function hooking No need to modify the App s source code or call a TrustKit initialization method!
72 Conclusion We re open-sourcing TrustKit today - MIT license Supports ios 7+ and OS X TrustKit is already live in a Yahoo App on the App Store Partnered with other companies who will deploy it in their OS X and ios Apps Feedback, comments and pull requests very welcome!
73 One Last Thing SSL pinning can be a challenge for security researchers And is not designed to block an attacker running code as root on the device So I also released SSL Kill Switch 2 Added support for TrustKit Apps (and OS X)
74 Thanks!
What s New in Security
System Frameworks #WWDC16 What s New in Security Session 706 Lucia Ballard Secure Transports Engineering Manager Simon Cooper Trusted Execution Engineering Manager 2016 Apple Inc. All rights reserved.
ios Testing Tools David Lindner Director of Mobile and IoT Security
ios Testing Tools David Lindner Director of Mobile and IoT Security Who is this guy? David Lindner @golfhackerdave [email protected] 15+ years consulting experience I hack and golf, sometimes at
Practical Attacks against Mobile Device Management (MDM) Michael Shaulov, CEO Daniel Brodie, Security Researcher Lacoon Mobile Security
Practical Attacks against Mobile Device Management (MDM) Michael Shaulov, CEO Daniel Brodie, Security Researcher Lacoon Mobile Security March 14, 2013 About: Daniel Security researcher for almost a decade
When Security Gets in the Way. PenTesting Mobile Apps That Use Certificate Pinning
When Security Gets in the Way PenTesting Mobile Apps That Use Certificate Pinning Justine Osborne Alban Diquet Outline What is Certificate Pinning? Definition and Background Consequences for Mobile Blackbox
Penetration Testing for iphone Applications Part 1
Penetration Testing for iphone Applications Part 1 This article focuses specifically on the techniques and tools that will help security professionals understand penetration testing methods for iphone
Enterprise Apps: Bypassing the Gatekeeper
Enterprise Apps: Bypassing the Gatekeeper By Avi Bashan and Ohad Bobrov Executive Summary The Apple App Store is a major part of the ios security paradigm, offering a central distribution process that
ABSTRACT' INTRODUCTION' COMMON'SECURITY'MISTAKES'' Reverse Engineering ios Applications
Reverse Engineering ios Applications Drew Branch, Independent Security Evaluators, Associate Security Analyst ABSTRACT' Mobile applications are a part of nearly everyone s life, and most use multiple mobile
AGENDA. Background. The Attack Surface. Case Studies. Binary Protections. Bypasses. Conclusions
MOBILE APPLICATIONS AGENDA Background The Attack Surface Case Studies Binary Protections Bypasses Conclusions BACKGROUND Mobile apps for everything == lots of interesting data Banking financial Social
Security Guide. BlackBerry Enterprise Service 12. for ios, Android, and Windows Phone. Version 12.0
Security Guide BlackBerry Enterprise Service 12 for ios, Android, and Windows Phone Version 12.0 Published: 2015-02-06 SWD-20150206130210406 Contents About this guide... 6 What is BES12?... 7 Key features
Mobile Application Security Testing ASSESSMENT & CODE REVIEW
Mobile Application Security Testing ASSESSMENT & CODE REVIEW Sept. 31 st 2014 Presenters ITAC 2014 Bishop Fox Francis Brown Partner Joe DeMesy Security Associate 2 Introductions FRANCIS BROWN Hi, I m Fran
Pentesting ios Apps Runtime Analysis and Manipulation. Andreas Kurtz
Pentesting ios Apps Runtime Analysis and Manipulation Andreas Kurtz About PhD candidate at the Security Research Group, Department of Computer Science, University of Erlangen-Nuremberg Security of mobile
BYPASSING THE ios GATEKEEPER
BYPASSING THE ios GATEKEEPER AVI BASHAN Technology Leader Check Point Software Technologies, Ltd. OHAD BOBROV Director, Mobile Threat Prevention Check Point Software Technologies, Ltd. EXECUTIVE SUMMARY
How to use PDFlib products with PHP
How to use PDFlib products with PHP Last change: July 13, 2011 Latest PDFlib version covered in this document: 8.0.3 Latest version of this document available at: www.pdflib.com/developer/technical-documentation
Example of Standard API
16 Example of Standard API System Call Implementation Typically, a number associated with each system call System call interface maintains a table indexed according to these numbers The system call interface
APPLICATION VIRTUALIZATION TECHNOLOGIES WHITEPAPER
APPLICATION VIRTUALIZATION TECHNOLOGIES WHITEPAPER Oct 2013 INTRODUCTION TWO TECHNOLOGY CATEGORIES Application virtualization technologies can be divided into two main categories: those that require an
BlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note
BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry Enterprise
eggon SDK for ios 7 Integration Instructions
eggon SDK for ios 7 Integration Instructions The eggon SDK requires a few simple steps in order to be used within your ios 7 application. Environment This guide assumes that a standard ios Development
Reminders. Lab opens from today. Many students want to use the extra I/O pins on
Reminders Lab opens from today Wednesday 4:00-5:30pm, Friday 1:00-2:30pm Location: MK228 Each student checks out one sensor mote for your Lab 1 The TA will be there to help your lab work Many students
Pentesting iphone Applications. Satishb3 http://www.securitylearn.net
Pentesting iphone Applications Satishb3 http://www.securitylearn.net Agenda iphone App Basics App development App distribution Pentesting iphone Apps Methodology Areas of focus Major Mobile Threats Who
Leave The App Alone! - Attack and Defense of Android App Hijack
Leave The App Alone! - Attack and Defense of Android App Hijack SESSION ID:MBS-W05 Rongyu Zhou Senior Research Engineer Baidu Inc. Outline Root or Not Root App Hijack Hook Insight Demo: App Hijack Detection
Citrix Worx App SDK Overview
Citrix Worx App SDK Overview Table of Contents Introduction... 3 About the App Catalog Deployment Model... 3 About the Citrix MDX Toolkit... 4 The Worx App SDK... 5 The Unmanaged and Managed Modes of Worx
Securing ios Applications. Dr. Bruce Sams, OPTIMAbit GmbH
Securing ios Applications Dr. Bruce Sams, OPTIMAbit GmbH About Me President of OPTIMAbit GmbH Responsible for > 200 Pentests per Year Ca 50 ios Pentests and code reviews in the last two years. Overview
Adobe Flash Player and Adobe AIR security
Adobe Flash Player and Adobe AIR security Both Adobe Flash Platform runtimes Flash Player and AIR include built-in security and privacy features to provide strong protection for your data and privacy,
Android Programming and Security
Android Programming and Security Dependable and Secure Systems Andrea Saracino [email protected] Outlook (1) The Android Open Source Project Philosophy Players Outlook (2) Part I: Android System
Xcode Project Management Guide. (Legacy)
Xcode Project Management Guide (Legacy) Contents Introduction 10 Organization of This Document 10 See Also 11 Part I: Project Organization 12 Overview of an Xcode Project 13 Components of an Xcode Project
BYOD AND NEXT- GENERATION MOBILE SECURITY
BYOD AND NEXT- GENERATION MOBILE SECURITY Joseph Gan V-Key Inc Session ID: MBS-W02 Session Classification: General Interest Next-Generation Computing Mobile enterprise apps Mobile payments Mobile authentication
How To Develop An App For Ios (Windows)
Mobile Application Development Lecture 14 ios SDK 2013/2014 Parma Università degli Studi di Parma Lecture Summary ios operating system ios SDK Tools of the trade ModelViewController MVC interaction patterns
Practical Attacks against Mobile Device Management Solutions
Practical Attacks against Mobile Device Management Solutions Michael Shaulov, CEO [email protected] Daniel Brodie, Sr Security Researcher [email protected] About: Daniel Security researcher for nearly
SWIPING THROUGH MODERN SECURITY FEATURES
SWIPING THROUGH MODERN SECURITY FEATURES HITB Amsterdam, April 11th, 2013 REACHING THE KERNEL Run unsigned code outside the sandbox Get around ASLR Take control of the kernel REACHING THE KERNEL Run unsigned
Reversing in OS X - what s different
Who Am I An Economist and MBA. Computer enthusiast for the past 30 years. Someone who worked at one of the world s best ATM networks, the Portuguese Multibanco. A natural-born reverser and assembler of
CompTIA Mobile App Security+ Certification Exam (ios Edition) Live exam IOS-001 Beta Exam IO1-001
CompTIA Mobile App Security+ Certification Exam (ios Edition) Live exam IOS-001 Beta Exam IO1-001 INTRODUCTION This exam will certify that the successful candidate has the knowledge and skills required
Everything is Terrible
Everything is Terrible A deep dive into provisioning and code signing Hello and welcome to Everything is Terrible. This is a deep dive talk into the processes behind provisioning and code signing on Apple
Software Development Kit for ios and Android
Software Development Kit for ios and Android With Bomgar's software development kit for mobile devices, your developers can integrate your mobile app with Bomgar to provide faster, more thorough support
Mobile Application Security and Penetration Testing Syllabus
Mobile Application Security and Penetration Testing Syllabus Mobile Devices Overview 1.1. Mobile Platforms 1.1.1.Android 1.1.2.iOS 1.2. Why Mobile Security 1.3. Taxonomy of Security Threats 1.3.1.OWASP
VMware and CPU Virtualization Technology. Jack Lo Sr. Director, R&D
ware and CPU Virtualization Technology Jack Lo Sr. Director, R&D This presentation may contain ware confidential information. Copyright 2005 ware, Inc. All rights reserved. All other marks and names mentioned
NVIDIA CUDA GETTING STARTED GUIDE FOR MAC OS X
NVIDIA CUDA GETTING STARTED GUIDE FOR MAC OS X DU-05348-001_v6.5 August 2014 Installation and Verification on Mac OS X TABLE OF CONTENTS Chapter 1. Introduction...1 1.1. System Requirements... 1 1.2. About
Mac OS X Security Checklist:
Mac OS X Security Checklist: Implementing the Center for Internet Security Benchmark for OS X Recommendations for securing Mac OS X The Center for Internet Security (CIS) benchmark for OS X is widely regarded
Mobilitics Inria-CNIL project: privacy and smartphones
Mobilitics Inria-CNIL project: privacy and smartphones Privatics team (Jagdish Achara, Claude Castelluccia, James Lefruit, Vincent Roca) Inria Rhone-Alpes CAPPRIS Reunion, Lyon Sept 10 th, 2013 Outline
Enterprise Mobility Management
Enterprise Mobility Management Security Without Compromising User Experience SESSION ID: SPO2-R03 Brian Robison Principal Technology Evangelist, XenMobile Citrix Systems, Inc. Providing the freedom to
Hotpatching and the Rise of Third-Party Patches
Hotpatching and the Rise of Third-Party Patches Alexander Sotirov [email protected] BlackHat USA 2006 Overview In the next one hour, we will cover: Third-party security patches _ recent developments
Hi and welcome to the Microsoft Virtual Academy and
Hi and welcome to the Microsoft Virtual Academy and 2012 Microsoft Corporation 1 the start of the Windows 8 Security Insights training. My name is Milad Aslaner I m part of the Premier Field Engineering
Application-Level Debugging and Profiling: Gaps in the Tool Ecosystem. Dr Rosemary Francis, Ellexus
Application-Level Debugging and Profiling: Gaps in the Tool Ecosystem Dr Rosemary Francis, Ellexus For years instruction-level debuggers and profilers have improved in leaps and bounds. Similarly, system-level
Advanced Testing and Continuous Integration
Developer Tools #WWDC16 Advanced Testing and Continuous Integration Session 409 Zoltan Foley-Fisher Xcode Engineer Eric Dudiak Xcode Engineer 2016 Apple Inc. All rights reserved. Redistribution or public
XenMobile Logs Collection Guide
XenMobile Logs Collection Guide 1 Contents Summary... 3 Background... 3 How to Collect Logs from Server Components... 4 Support Bundle Contents... 4 Operations Supported for Server Components... 5 Configurations
ios Security Decoded Dave Test Classroom and Lab Computing Penn State ITS Feedback - http://j.mp/psumac33
ios Security Decoded Dave Test Classroom and Lab Computing Penn State ITS Feedback - http://j.mp/psumac33 Why care about ios Security? 800M 800 million ios devices activated 130 million in last year 98%
MS Enterprise Library 5.0 (Logging Application Block)
International Journal of Scientific and Research Publications, Volume 4, Issue 8, August 2014 1 MS Enterprise Library 5.0 (Logging Application Block) Anubhav Tiwari * R&D Dept., Syscom Corporation Ltd.
Key & Data Storage on Mobile Devices
Key & Data Storage on Mobile Devices Advanced Computer Networks 2015/2016 Johannes Feichtner [email protected] Outline Why is this topic so delicate? Keys & Key Management High-Level Cryptography
Pentesting iphone & ipad Apps Hack In Paris 2011 June 17
Pentesting iphone & ipad Apps Hack In Paris 2011 June 17 Who are we? Flora Bottaccio Security Analyst at ADVTOOLS Sebastien Andrivet Director, co-founder of ADVTOOLS ADVTOOLS Swiss company founded in 2002
What s Cool in the SAP JVM (CON3243)
What s Cool in the SAP JVM (CON3243) Volker Simonis, SAP SE September, 2014 Public Agenda SAP JVM Supportability SAP JVM Profiler SAP JVM Debugger 2014 SAP SE. All rights reserved. Public 2 SAP JVM SAP
For Enterprise. Attacking BYOD Enterprise Mobile Security Solutions. Vincent Tan Senior Security Consultant
For Enterprise Attacking BYOD Enterprise Mobile Security Solutions Vincent Tan Senior Security Consultant whoami Sunny Singapore Senior Security Consultant @ Vantage Point Security 4+ years hacking stuff
Deploying Management and Security Agents to Mobile Devices. Deploying Mgmt and Security Agents
Deploying Management and Security Agents to Mobile Devices John Engels Principal Product Manager Symantec Scott Jareo Field Enablement Engineering Symantec Agenda 1 Symantec MDM Agent Options 2 Mobile
Product Manual. MDM On Premise Installation Version 8.1. Last Updated: 06/07/15
Product Manual MDM On Premise Installation Version 8.1 Last Updated: 06/07/15 Parallels IP Holdings GmbH Vordergasse 59 8200 Schaffhausen Switzerland Tel: + 41 52 632 0411 Fax: + 41 52 672 2010 www.parallels.com
ArcGIS for Server in the Cloud
Esri Developer Summit March 8 11, 2016 Palm Springs, CA ArcGIS for Server in the Cloud Cherry Lin, Nikhil Shampur, and Derek Law March 10, 2016 Quick Survey 1. How many attendees are using the Cloud today?
KonyOne Server Prerequisites _ MS SQL Server
KonyOne Server Prerequisites _ MS SQL Server KonyOne Platform Release 5.0 Copyright 2012-2013 Kony Solutions, Inc. All Rights Reserved. Page 1 of 13 Copyright 2012-2013 by Kony Solutions, Inc. All rights
New Features in XE8. Marco Cantù RAD Studio Product Manager
New Features in XE8 Marco Cantù RAD Studio Product Manager Marco Cantù RAD Studio Product Manager Email: [email protected] @marcocantu Book author and Delphi guru blog.marcocantu.com 2 Agenda
Total Baby. Backup, Restore and itunes Backup Extraction
Total Baby Backup, Restore and itunes Backup Extraction Backup! 3 Introduction and Steps! 3 How to Backup! 3 Backup using E-Mail! 4 Backup using Wi-Fi! 4 Restoring! 5 Introduction and Steps! 5 How it Works!
Legal notices. Legal notices. For legal notices, see http://help.adobe.com/en_us/legalnotices/index.html.
ADOBE AIR Security Legal notices Legal notices For legal notices, see http://help.adobe.com/en_us/legalnotices/index.html. iii Contents Installing and updating desktop applications...........................................................................
A Comparative Study on Vega-HTTP & Popular Open-source Web-servers
A Comparative Study on Vega-HTTP & Popular Open-source Web-servers Happiest People. Happiest Customers Contents Abstract... 3 Introduction... 3 Performance Comparison... 4 Architecture... 5 Diagram...
App Distribution Guide
App Distribution Guide Contents About App Distribution 10 At a Glance 11 Enroll in an Apple Developer Program to Distribute Your App 11 Generate Certificates and Register Your Devices 11 Add Store Capabilities
Best Practice Guide (SSL Implementation) for Mobile App Development 最 佳 行 事 指 引. Jointly published by. Publication version 1.
Best Practice Guide (SSL Implementation) for Mobile App Development 流 動 應 用 程 式 (SSL 實 施 ) 最 佳 行 事 指 引 香 港 電 腦 事 故 協 調 中 心 ] Jointly published by [ 專 業 資 訊 保 安 協 會 ] Hong Kong Computer Emergency Response
Android Operating System
Prajakta S.Adsule Student-M.B.A.[I.T.] BharatiVidyapeeth Deemed University,Pune(india) [email protected] Mob. No. 9850685985 Android Operating System Abstract- Android operating system is one
Certificates and Application Resigning
Certificates and Application Resigning Introduction In the following chapters we will be reviewing how to resign an application along with how to get the needed resources for the process. To successfully
SYLLABUS MOBILE APPLICATION SECURITY AND PENETRATION TESTING. MASPT at a glance: v1.0 (28/01/2014) 10 highly practical modules
Must have skills in any penetration tester's arsenal. MASPT at a glance: 10 highly practical modules 4 hours of video material 1200+ interactive slides 20 Applications to practice with Leads to emapt certification
Workday Mobile Security FAQ
Workday Mobile Security FAQ Workday Mobile Security FAQ Contents The Workday Approach 2 Authentication 3 Session 3 Mobile Device Management (MDM) 3 Workday Applications 4 Web 4 Transport Security 5 Privacy
BYOD Guidance: BlackBerry Secure Work Space
GOV.UK Guidance BYOD Guidance: BlackBerry Secure Work Space Published 17 February 2015 Contents 1. About this guidance 2. Summary of key risks 3. Secure Work Space components 4. Technical assessment 5.
Research and Design of Universal and Open Software Development Platform for Digital Home
Research and Design of Universal and Open Software Development Platform for Digital Home CaiFeng Cao School of Computer Wuyi University, Jiangmen 529020, China [email protected] Abstract. With the development
Pcounter Mobile Guide
Pcounter Mobile Guide Pcounter Mobile Guide 2012.06.22 Page 1 of 19 1. Overview... 3 2. Pre-requisites and Requirements... 4 2.1 Gateway server requirements... 4 2.2 Mobile device requirements... 4 2.3
Mobile Labs Plugin for IBM Urban Code Deploy
Mobile Labs Plugin for IBM Urban Code Deploy Thank you for deciding to use the Mobile Labs plugin to IBM Urban Code Deploy. With the plugin, you will be able to automate the processes of installing or
Please Complete Speaker Feedback Surveys. SecurityTube.net
Please Complete Speaker Feedback Surveys Advanced ios Applica:on Pentes:ng Vivek Ramachandran Founder, SecurityTube.net [email protected] Vivek Ramachandran B.Tech, ECE IIT Guwaha: Media Coverage
WEB, HYBRID, NATIVE EXPLAINED CRAIG ISAKSON. June 2013 MOBILE ENGINEERING LEAD / SOFTWARE ENGINEER
WEB, HYBRID, NATIVE EXPLAINED June 2013 CRAIG ISAKSON MOBILE ENGINEERING LEAD / SOFTWARE ENGINEER 701.235.5525 888.sundog fax: 701.235.8941 2000 44th St. S Floor 6 Fargo, ND 58103 www.sundoginteractive.com
Using the Push Notifications Extension Part 1: Certificates and Setup
// tutorial Using the Push Notifications Extension Part 1: Certificates and Setup Version 1.0 This tutorial is the second part of our tutorials covering setting up and running the Push Notifications Native
Architecture and Data Flow Overview. BlackBerry Enterprise Service 10 721-08877-123 Version: 10.2. Quick Reference
Architecture and Data Flow Overview BlackBerry Enterprise Service 10 721-08877-123 Version: Quick Reference Published: 2013-11-28 SWD-20131128130321045 Contents Key components of BlackBerry Enterprise
ELEC 377. Operating Systems. Week 1 Class 3
Operating Systems Week 1 Class 3 Last Class! Computer System Structure, Controllers! Interrupts & Traps! I/O structure and device queues.! Storage Structure & Caching! Hardware Protection! Dual Mode Operation
ios Application Security
Diploma Thesis Student: Email: [email protected] Matriculation Number: 108004202162 Supervisor: Prof. Dr. Thorsten Holz Period: From 2010-12-06 till 2011-06-06 Embedded Malware Research Group Prof. Dr. Thorsten
RTOS Debugger for ecos
RTOS Debugger for ecos TRACE32 Online Help TRACE32 Directory TRACE32 Index TRACE32 Documents... RTOS Debugger... RTOS Debugger for ecos... 1 Overview... 2 Brief Overview of Documents for New Users... 3
CS 377: Operating Systems. Outline. A review of what you ve learned, and how it applies to a real operating system. Lecture 25 - Linux Case Study
CS 377: Operating Systems Lecture 25 - Linux Case Study Guest Lecturer: Tim Wood Outline Linux History Design Principles System Overview Process Scheduling Memory Management File Systems A review of what
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
Performance Counter. Non-Uniform Memory Access Seminar Karsten Tausche 2014-12-10
Performance Counter Non-Uniform Memory Access Seminar Karsten Tausche 2014-12-10 Performance Counter Hardware Unit for event measurements Performance Monitoring Unit (PMU) Originally for CPU-Debugging
Automating Security Testing. Mark Fallon Senior Release Manager Oracle
Automating Security Testing Mark Fallon Senior Release Manager Oracle Some Ground Rules There are no silver bullets You can not test security into a product Testing however, can help discover a large percentage
ios Application Development &
Introduction of ios Application Development & Swift Programming Language Presented by Chii Chang [email protected] Outlines Basic understanding about ios App Development Development environment: Xcode IDE Foundations
Android v ios Mobile Operating Systems
v ios Mobile Operating Systems is an open source operating system widely used on smartphones and tablets. has been available under a free and open source software license from October 21, 2008 and until
MERLIN SERVER. The Quick Start Guide for collaborative project management. 2012 ProjectWizards GmbH, Melle, Germany. All rights reserved.
MERLIN SERVER The Quick Start Guide for collaborative project management 2012 ProjectWizards GmbH, Melle, Germany. All rights reserved. INTRODUCTION Welcome to this quick start guide for Merlin Server!
Design for Success: Designing for the Internet of Things with TiWiConnect
Design for Success: Designing for the Internet of Things with TiWiConnect Today s presenters Scott Lederer Senior Software Architect Dave Burleton Vice President of Marketing LSR.com Today s Agenda Why
Chapter 1. Introduction to ios Development. Objectives: Touch on the history of ios and the devices that support this operating system.
Chapter 1 Introduction to ios Development Objectives: Touch on the history of ios and the devices that support this operating system. Understand the different types of Apple Developer accounts. Introduce
Using Microsoft Visual Studio 2010. API Reference
2010 API Reference Published: 2014-02-19 SWD-20140219103929387 Contents 1... 4 Key features of the Visual Studio plug-in... 4 Get started...5 Request a vendor account... 5 Get code signing and debug token
Encryption Wrapper. on OSX
Encryption Wrapper on OSX Overview OSX Kernel What is an Encryption Wrapper? Project Implementation OSX s Origins and Design NeXTSTEP Legacy NextStep v1 NextStep v3.3 Mac OS X Jobs creates NeXT Apple acquisition
Full System Emulation:
Full System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware Christopher Kruegel Lastline, Inc. [email protected] 1 Introduction Automated malware analysis systems (or sandboxes)
Smart home appliance security and malware
Smart home appliance security and malware om Jeong wook (Matt) Oh HP Security Research, September 2014 Why Smart TV? The most popular smart device in real life TVs are everywhere If you bought a new TV
Introduction to iphone Development
Introduction to iphone Development Introduction to iphone Development Contents Task 1 2 3 4 Application Runtime Core Architecture and Life-cycles What s in a bundle? The resources in an app bundle Customizing
McAfee Web Gateway Administration Intel Security Education Services Administration Course Training
McAfee Web Gateway Administration Intel Security Education Services Administration Course Training The McAfee Web Gateway Administration course from Education Services provides an in-depth introduction
Mobile Device Management Version 8. Last updated: 17-10-14
Mobile Device Management Version 8 Last updated: 17-10-14 Copyright 2013, 2X Ltd. http://www.2x.com E mail: [email protected] Information in this document is subject to change without notice. Companies names