![iOS Development - Tips & Tricks
Why iOS?
-(NSString *)generateReasonsWhyiOS {
NSMutableString *reasons = [[NSMutableString alloc] init];
[reasons appendString:@"It's new"];
[reasons appendString:@"It's challenging"];
[reasons appendString:@"It compiles to native"];
[reasons appendString:@"You have to deal with hardware limitations"];
[reasons appendString:@"You have to provide responsiveness"];
[reasons appendString:@"You have to provide usability"];
[reasons appendString:@"You have to provide security"];
[reasons appendString:@"0ften craftsmanship is required"];
[reasons appendString:@"Your code runs into people's pockets"];
return reasons;
}](https://image.slidesharecdn.com/iosdevelopment-tipstricks-140718094753-phpapp01/85/iOS-Development-Tips-Tricks-5-320.jpg)
![iOS Development - Tips & Tricks
Local Storage Security
Keychain Access
Encrypted by default
A bit more complex for use
Insecure on jailbroken devices
Data encryption
Crypto API
Obfuscate the encryption key
Use unique device information
String constant
[[UIDevice
currentDevice]
identifierForVendor]
Custom
algorithm
Secure encryption key](https://image.slidesharecdn.com/iosdevelopment-tipstricks-140718094753-phpapp01/85/iOS-Development-Tips-Tricks-12-320.jpg)
![iOS Development - Tips & Tricks
Runtime Manipulation
#import "AppDelegate.h"
#import "ptrace.h"
int main(int argc, char * argv[])
{
#ifndef DEBUG
ptrace(PT_DENY_ATTACH, 0, 0, 0);
#endif
@autoreleasepool {
return UIApplicationMain(argc, argv, nil, NSStringFromClass([AppDelegate class]));
}
}
ptrace
Deny a debugger to attach
Can be patched from binary
Put it in multiple places](https://image.slidesharecdn.com/iosdevelopment-tipstricks-140718094753-phpapp01/85/iOS-Development-Tips-Tricks-14-320.jpg)
More Related Content
Viewers also liked (18)
Similar to iOS Development - Tips & Tricks (20)
![Magento Application Security [EN]](https://cdn.slidesharecdn.com/ss_thumbnails/magentoapplicationsecurityenmm15nl-150529123031-lva1-app6891-thumbnail.jpg?width=560&fit=bounds)
Recently uploaded (20)
iOS Development - Tips & Tricks
- 1. iOS Development - Tips & Tricks iOS Development - Tips & Tricks Software Development Lead - iOS Galin Kardzhilov Software Development Manager - iOS Stefan Tsvyatkov
- 2. iOS Development - Tips & Tricks Agenda Why iOS Some challenges iOS Security
- 3. iOS Development - Tips & Tricks About Me Started with
- 4. iOS Development - Tips & Tricks About Me
- 5. iOS Development - Tips & Tricks Why iOS? -(NSString *)generateReasonsWhyiOS { NSMutableString *reasons = [[NSMutableString alloc] init]; [reasons appendString:@"It's new"]; [reasons appendString:@"It's challenging"]; [reasons appendString:@"It compiles to native"]; [reasons appendString:@"You have to deal with hardware limitations"]; [reasons appendString:@"You have to provide responsiveness"]; [reasons appendString:@"You have to provide usability"]; [reasons appendString:@"You have to provide security"]; [reasons appendString:@"0ften craftsmanship is required"]; [reasons appendString:@"Your code runs into people's pockets"]; return reasons; }
- 6. iOS Development - Tips & Tricks Table view Background image Custom drawn cells ¡ flipped
- 7. iOS Development - Tips & Tricks
- 8. iOS Development - Tips & Tricks Scroll View Custom View
- 9. iOS Development - Tips & Tricks
- 10. iOS Development - Tips & Tricks Security in iOS Local Storage Communication with the server Binary analysis and manipulation
- 11. iOS Development - Tips & Tricks Local Storage Security NSUserDefaults Convenient Not encrypted by default Keeps the data in a plist file CoreData Not encrypted by default Keeps the data in sqlite db
- 12. iOS Development - Tips & Tricks Local Storage Security Keychain Access Encrypted by default A bit more complex for use Insecure on jailbroken devices Data encryption Crypto API Obfuscate the encryption key Use unique device information String constant [[UIDevice currentDevice] identifierForVendor] Custom algorithm Secure encryption key
- 13. iOS Development - Tips & Tricks Server Communication Security Use SSL Don¡¯t accept self-signed certificates Client and server side data validation
- 14. iOS Development - Tips & Tricks Runtime Manipulation #import "AppDelegate.h" #import "ptrace.h" int main(int argc, char * argv[]) { #ifndef DEBUG ptrace(PT_DENY_ATTACH, 0, 0, 0); #endif @autoreleasepool { return UIApplicationMain(argc, argv, nil, NSStringFromClass([AppDelegate class])); } } ptrace Deny a debugger to attach Can be patched from binary Put it in multiple places
- 15. iOS Development - Tips & Tricks SEC_IS_BEING_DEBUGGED_RETURN_NIL () Check if a debugger is attached Hard to be patched from binary Make the check regularly and in critical parts Doesn¡¯t work against Cycript Runtime Manipulation #ifndef DEBUG SEC_IS_BEING_DEBUGGED_RETURN_NIL(); #endif
- 16. iOS Development - Tips & Tricks Conclusion Keychain Access for storing SSL for transporting Check for debuggers 100% security does not exist
- 17. iOS Development - Tips & Tricks Thank you! Galin Kardzhilov @gravera Stefan Tsvyatkov @stsvyatkov
Editor's Notes
- #11: §©§Õ§â§Ñ§Ó§Ö§Û§ä§Ö. §¡§Ù §ã§ì§Þ §³§ä§Ö§æ§Ñ§ß §¸§Ó§ñ§ä§Ü§à§Ó - iOS Development Manager §Ó §®§Ö§ß§ä§à§â§®§Ö§Û§ä. §»§Ö §á§â§à§Õ§ì§Ý§Ø§Ñ §ä§Ö§Þ§Ñ§ä§Ñ §ã §ß§ñ§Ü§à§Ý§Ü§à §ã§ì§Ó§Ö§ä§Ñ §Ü§Ñ§Ü §Õ§Ñ §á§à§Õ§à§Ò§â§Ú§Þ §ã§Ú§Ô§å§â§ß§à§ã§ä§ä§Ñ §Ó iOS §á§â§Ú§Ý§à§Ø§Ö§ß§Ú§ñ§ä§Ñ. §´§ì§Û §Ü§Ñ§ä§à §ä§à§Ó§Ñ §Ö §ä§Ó§ì§â§Õ§Ö §à§Ò§ê§Ú§â§ß§Ñ §ä§Ö§Þ§Ñ §Õ§à§â§Ú §Ú §Ù§Ñ §é§Ñ§ã§à§Ó§Ö, §Ñ §ß§Ú§Ö §Ú§Þ§Ñ§Þ§Ö §Þ§Ú§ß§å§ä§Ú, §Õ§ß§Ö§ã §ë§Ö §Ù§Ñ§ã§Ö§Ô§ß§Ñ §ã§Ñ§Þ§à §à§ã§ß§à§Ó§Ú§ä§Ö. §¯§Ñ§Û-§å§ñ§Ù§Ó§Ú§Þ§Ú§ä§Ö §Þ§Ö§ã§ä§Ñ §Ó §Ö§Õ§ß§à §á§â§Ú§Ý§à§Ø§Ö§ß§Ú§Ö §ã§Ñ §Þ§ñ§ã§ä§à§ä§à, §Ü§ì§Õ§Ö§ä§à §ã§ì§ç§â§Ñ§ß§ñ§Ó§Ñ§Þ§Ö §Õ§Ñ§ß§ß§Ú§ä§Ö, §Ü§à§Þ§å§ß§Ú§Ü§Ñ§è§Ú§ñ§ä§Ñ §ã§ì§ã §ã§ì§â§Ó§ì§â§Ñ §Ú §ã§Ñ§Þ§à§ä§à §Ò§Ñ§Û§ß§ì§â§Ú. §´§à§Ó§Ñ §Ú §ã§Ñ §ß§Ö§ë§Ñ§ä§Ñ, §é§Ú§ñ§ä§à §Ù§Ñ§ë§Ú§ä§Ñ §ë§Ö §â§Ñ§Ù§Ô§Ý§Ö§Õ§Ñ§Þ§Ö.
- #12: §©§Ñ§á§à§é§Ó§Ñ§Þ§Ö §ã§ì§ã §ã§ì§ç§â§Ñ§ß§Ö§ß§Ú§Ö§ä§à §ß§Ñ §Õ§Ñ§ß§ß§Ú §Ó §Þ§à§Ò§Ú§Ý§ß§à§ä§à §å§ã§ä§â§à§Û§ã§ä§Ó§à. §¹§Ö§ã§ä§à §ß§Ú §ã§Ö §ß§Ñ§Ý§Ñ§Ô§Ñ §Õ§Ñ §Ù§Ñ§á§Ú§ã§Ó§Ñ§Þ§Ö §á§à§ä§â§Ö§Ò§Ú§ä§Ö§Ý§ã§Ü§Ú §Ú§Þ§Ö§ß§Ñ, §ã§Ö§ê§ì§ß §ä§à§Ü§ì§ß§Ú §Ú §Õ§à§â§Ú §á§Ñ§â§à§Ý§Ú §Ý§à§Ü§Ñ§Ý§ß§à §Ó §á§â§Ú§Ý§à§Ø§Ö§ß§Ú§Ö§ä§à. §¯§Ñ§á§â§Ú§Þ§Ö§â §Ü§à§Ô§Ñ§ä§à §Ú§Þ§á§Ý§Ö§Þ§Ö§ß§ä§Ú§â§Ñ§Þ§Ö §à§æ§Ý§Ñ§Û§ß §Ý§à§Ô§Ú§ß §Ù§Ñ §â§Ñ§Ù§Ý§Ú§é§ß§Ú §á§à§ä§â§Ö§Ò§Ú§Ý§Ú §Ó §Ö§Õ§ß§à §å§ã§ä§â§à§Û§ã§ä§Ó§à. §¯§Ñ§Û-§å§Õ§à§Ò§ß§Ú§ñ§ä §ß§Ñ§é§Ú§ß §Ù§Ñ §Ù§Ñ§á§Ú§ã§Ó§Ñ§ß§Ö §ß§Ñ §Ú§ß§æ§à§â§Þ§Ñ§è§Ú§ñ §Ö NSUserDefaults. §ª§Ù§á§à§Ý§Ù§Ó§Ñ §ã§Ö §Ý§Ö§ã§ß§à - §ã§ì§ç§â§Ñ§ß§ñ§Ó§Ñ§Þ§Ö §Ú §é§Ö§ä§Ö§Þ §Õ§Ñ§ß§ß§Ú §ã §Ö§Õ§Ú§ß §â§Ö§Õ §Ü§à§Õ. §¯§Ö§Ü§Ñ §Ó§Ú§Õ§Ú§Þ §à§Ò§Ñ§é§Ö §Ü§à§Ý§Ü§à §ã§Ú§Ô§å§â§Ö§ß §Ö §ä§à§Ù§Ú §á§à§Õ§ç§à§Õ. NSUserDefaults §ã§ì§ç§â§Ñ§ß§ñ§Ó§Ñ §Õ§Ñ§ß§ß§Ú§ä§Ö §Ó plist §æ§Ñ§Û§Ý, §Ü§à§Û§ä§à §ã§ì§Õ§ì§â§Ø§Ñ §á§Ý§Û§Ö§Û§ß §ä§Ö§Ü§ã§ä §ã§á§Ú§ã§ì§Ü §à§ä §Ü§Ú§Û-§Ó§Ö§Ý§ð §Ù§Ñ§á§Ú§ã§Ú. §£ §Ú§ß§ä§Ö§â§ß§Ö§ä §Ú§Þ§Ñ §Ô§à§Ý§ñ§Þ §Ú§Ù§Ò§à§â §à§ä §á§â§Ú§Ý§à§Ø§Ö§ß§Ú§ñ, §Ü§à§Ú§ä§à §Ú§ß§ã§ä§Ñ§Ý§Ú§â§Ñ§ß§Ú §ß§Ñ §Ü§à§Þ§á§ð§ä§ì§â §ã§ì§ã §ã§Ó§ì§â§Ù§Ñ§ß§à §Þ§à§Ò§Ú§Ý§ß§à §å§ã§ä§â§à§Û§ã§ä§Ó§à, §á§à§Ü§Ñ§Ù§Ó§Ñ§ä §Õ§Ñ§ß§ß§Ú§ä§Ö §à§ä §Ó§ã§ñ§Ü§à §Ú§ß§ã§ä§Ñ§Ý§Ú§â§Ñ§ß§à §á§â§Ú§Ý§à§Ø§Ö§ß§Ú§Ö. §¡§Ù §ß§Ñ§á§â§Ú§Þ§Ö§â §Ú§Ù§á§à§Ý§Ù§Ó§Ñ§Þ DiskAid. §´§å§Ü §ã§ì§Þ §à§ä§Ó§à§â§Ú§Ý §ã§ì§Õ§ì§â§Ø§Ñ§ß§Ú§Ö§ä§à §ß§Ñ §Ö§Õ§ß§à §à§ä §á§â§Ú§Ý§à§Ø§Ö§ß§Ú§ñ§ä§Ñ, §Ü§à§Ú§ä§à §â§Ñ§Ù§â§Ñ§Ò§à§ä§Ó§Ñ§Þ§Ö §Ú §Ü§Ñ§Ü§ä§à §Ó§Ú§Ø§Õ§Ñ§ä§Ö §Ú§Þ§Ñ§Þ §ã§á§Ú§ã§ì§Ü §ã §æ§Ñ§Û§Ý§à§Ó§Ö§ä§Ö §Ó §ß§Ö§Ô§à. §¥§à§â§Ú §ã§ì§Þ §à§ä§Ó§à§â§Ú§Ý §á§Ý§Ú§ã§ä §æ§Ñ§Û§Ý§Ñ, §Ü§à§Û§ä§à §ã§ì§ç§â§Ñ§ß§ñ§Ó§Ñ §Õ§Ñ§ß§ß§Ú§ä§Ö §ß§Ñ NSUserDefaults. §±§à§ß§Ö§Ø§Ö §á§â§Ú§Ý§à§Ø§Ö§ß§Ú§Ö§ä§à §Ö §ß§Ñ§á§Ú§ã§Ñ§ß§à §Ü§Ñ§é§Ö§ã§ä§Ó§Ö§ß§à, §ä§å§Ü §ß§Ö §Ó§Ú§Ø§Õ§Ñ§Þ§Ö §Õ§Ñ§ß§ß§Ú, §Ü§à§Ú§ä§à §Ú§Ù§Ô§Ý§Ö§Ø§Õ§Ñ§ä §Ó§Ñ§Ø§ß§Ú. §¯§Ö§Ü§Ñ §â§Ñ§Ù§Ô§Ý§Ö§Ø§Õ§Ñ§Þ§Ö §Õ§â§å§Ô§à §á§à§á§å§Ý§ñ§â§ß§à §Þ§ñ§ã§ä§à §Ù§Ñ §ã§ì§ç§â§Ñ§ß§Ö§ß§Ú§Ö §ß§Ñ §Õ§Ñ§ß§ß§Ú - CoreData. §°§Ò§Ú§Ü§ß§à§Ó§Ö§ß§à §ä§å§Ü §ã§Ö §ã§ì§ç§â§Ñ§ß§ñ§Ó§Ñ§ä §Õ§Ñ§ß§ß§Ú, §Ü§à§Ú§ä§à §Ú§Þ§Ñ§ä §á§à-§ã§Ý§à§Ø§ß§Ñ §ã§ä§â§å§Ü§ä§å§â§Ñ §Ú §á§à-§Ô§à§Ý§ñ§Þ §à§Ò§Ö§Þ. §ª§Ù§á§à§Ý§Ù§Ó§Ñ§ß§Ö§ä§à §Ö §Þ§Ñ§Ý§Ü§à §á§à-§ä§â§å§Õ§à§Ö§Þ§Ü§à §á§à§ß§Ö§Ø§Ö §ä§â§ñ§Ò§Ó§Ñ §Õ§Ñ §ã§Ú §ã§ì§Ù§Õ§Ñ§Õ§Ö§Þ §Õ§Ö§Û§ä§Ñ §Þ§à§Õ§Ö§Ý §Ú §Õ§Ñ §ã§Ú §Ú§Þ§á§Ý§Ö§Þ§Ö§ß§ä§Ú§â§Ñ§Þ§Ö §à§ã§ß§à§Ó§ß§Ú§ä§Ö §Þ§Ö§ä§à§Õ§Ú, §ß§å§Ø§ß§Ú §Ù§Ñ CoreData §Ú§Þ§á§Ý§Ö§Þ§Ö§ß§ä§Ñ§è§Ú§ñ§ä§Ñ. §¯§à §ß§Ñ§ã §á§Ñ§Ü §ß§Ú §Ú§ß§ä§Ö§â§Ö§ã§å§Ó§Ñ §á§à-§ã§Ü§à§â§à §Ü§à§Ý§Ü§à §ã§Ú§Ô§å§â§Ö§ß §Ö §ä§à§Ù§Ú §Þ§Ö§ä§à§Õ. CoreData, §á§à§Õ§à§Ò§ß§à §ß§Ñ NSUserDefaults, §ã§ì§ç§â§Ñ§ß§ñ§Ó§Ñ §Ú§ß§æ§à§â§Ñ§Þ§Ñ§è§Ú§ñ§ä§Ñ §Ó§ì§Ó §æ§Ñ§Û§Ý §Ó §Ò§ì§ß§Õ§ì§Ý§Ñ §ß§Ñ §á§â§Ú§Ý§à§Ø§Ö§ß§Ú§Ö§ä§à. §´§à§Ó§Ñ §æ§Ñ§Û§Ý §á§â§Ö§ã§ä§Ñ§Ó§Ý§ñ§Ó§Ñ sqllite database. §©§Ñ §Õ§Ñ §Ó§Ú§Õ§ñ §Õ§Ñ§ß§ß§Ú§ä§Ö, §Ñ§Ù §á§â§à§ã§ä§à §ä§â§ñ§Ò§Ó§Ñ §Õ§Ñ §ß§Ñ§Þ§Ö§â§ñ §á§â§à§Ô§â§Ñ§Þ§Ñ, §Ü§à§ñ§ä§à §à§ä§Ó§Ñ§â§ñ sqlite §æ§Ñ§Û§Ý§à§Ó§Ö - §ä§Ñ§Ü§Ú§Ó§Ñ §Ü§à§Ý§Ü§à§ä§à §Ú§ã§Ü§Ñ§ê §Ó §Ú§ß§ä§Ö§â§ß§Ö§ä. §¥§à§â§Ú §æ§Ñ§Û§ì§â§æ§à§Ü§ã §Þ§à§Ø§Ö §Õ§Ñ §Ô§à §ß§Ñ§á§â§Ñ§Ó§Ú. §¥§à §Ü§Ñ§Ü§ì§Ó §Ú§Ù§Ó§à§Õ §ã§ä§Ú§Ô§Ñ§Þ§Ö - §ß§Ñ§Û-§á§à§á§å§Ý§ñ§â§ß§Ú§ä§Ö §Þ§Ö§ã§ä§Ñ §Ù§Ñ §ã§ì§ç§â§Ñ§ß§Ö§ß§Ú§Ö §ß§Ñ §Õ§Ñ§ß§ß§Ú §ã§Ñ §ã §Þ§ß§à§Ô§à §ß§Ú§ã§Ü§Ñ §ã§ä§Ö§á§Ö§ß §ß§Ñ §ã§Ú§Ô§å§â§ß§à§ã§ä.
- #13: §ª §ã§Ö§Ô§Ñ §á§â§Ñ§Ó§Ú§Ý§ß§Ú§ñ §ß§Ñ§é§Ú§ß §Ù§Ñ §ã§ì§ç§â§Ñ§ß§Ö§ß§Ú§Ö -