AN OUTLINE THE TALK TODAY WILL COVER A SOLID AMOUNT OF MATERIAL
3
IOS IS DERIVED FROM OS X
4
REVERSING IS SOMEWHAT NON-TRIVIAL - being an object-oriented language static analysis can be challenging
5
ARM POWERS MOBILE PROCESSORS EVERYWHERE - IOS DEVICES RUN ON PROCESSORS BASED ON THE ARM ARCHITECTURE
6
ARM ARCHITECTURE ON (MODERN) 32-BIT CPUS
7
ARM ARCHITECTURE ON 64-BIT CPUS
8
AUTOMATED APP GRABBING
9
REMOVING ENCRYPTION
10
OTOOL OTOOL OBJECT FILE DISPLAYING TOOL
11
CLASS-DUMP
12
IDA PRO IDA IS THE DE-FACTO REVERSING TOOL
13
DYNAMIC ANALYSIS OF IOS APPS
14
SPOTTING A VULNERABILITY STATICALLY
15
SPOTTING A VULNERABILITY DYNAMICALLY
16
SPOTTING A VULNERABILITY - scope out the disassembly or dump the user defaults plist
Description:
Explore the process of reverse-engineering iOS applications to uncover mobile security risks in this conference talk from OWASP AppSec California 2015. Delve into the challenges of iOS app analysis, including encryption, Objective-C complexities, and the proprietary nature of the operating system. Learn techniques for extracting unencrypted binary code, analyzing ARM disassembly, and identifying common mobile-specific vulnerabilities. Gain insights from real-world examples of security flaws found in App Store applications. Discover tools and methods for automated app grabbing, removing encryption, and performing both static and dynamic analysis. Understand the ARM architecture powering mobile processors and its implications for iOS devices. Follow along as the speaker demonstrates how to spot vulnerabilities through disassembly and user defaults plist examination, providing a comprehensive look at iOS app security auditing.
Uncovering OWASP's Mobile Risks in iOS Apps - AppSec California 2015