![iOS Development - Tips & Tricks
Why iOS?
-(NSString *)generateReasonsWhyiOS {
NSMutableString *reasons = [[NSMutableString alloc] init];
[reasons appendString:@"It's new"];
[reasons appendString:@"It's challenging"];
[reasons appendString:@"It compiles to native"];
[reasons appendString:@"You have to deal with hardware limitations"];
[reasons appendString:@"You have to provide responsiveness"];
[reasons appendString:@"You have to provide usability"];
[reasons appendString:@"You have to provide security"];
[reasons appendString:@"0ften craftsmanship is required"];
[reasons appendString:@"Your code runs into people's pockets"];
return reasons;
}](https://image.slidesharecdn.com/iosdevelopment-tipstricks-140718094753-phpapp01/85/iOS-Development-Tips-Tricks-5-320.jpg)
![iOS Development - Tips & Tricks
Local Storage Security
Keychain Access
Encrypted by default
A bit more complex for use
Insecure on jailbroken devices
Data encryption
Crypto API
Obfuscate the encryption key
Use unique device information
String constant
[[UIDevice
currentDevice]
identifierForVendor]
Custom
algorithm
Secure encryption key](https://image.slidesharecdn.com/iosdevelopment-tipstricks-140718094753-phpapp01/85/iOS-Development-Tips-Tricks-12-320.jpg)
![iOS Development - Tips & Tricks
Runtime Manipulation
#import "AppDelegate.h"
#import "ptrace.h"
int main(int argc, char * argv[])
{
#ifndef DEBUG
ptrace(PT_DENY_ATTACH, 0, 0, 0);
#endif
@autoreleasepool {
return UIApplicationMain(argc, argv, nil, NSStringFromClass([AppDelegate class]));
}
}
ptrace
Deny a debugger to attach
Can be patched from binary
Put it in multiple places](https://image.slidesharecdn.com/iosdevelopment-tipstricks-140718094753-phpapp01/85/iOS-Development-Tips-Tricks-14-320.jpg)
iOS Development - Tips & Tricks
- 1. iOS Development - Tips & Tricks iOS Development - Tips & Tricks Software Development Lead - iOS Galin Kardzhilov Software Development Manager - iOS Stefan Tsvyatkov
- 2. iOS Development - Tips & Tricks Agenda Why iOS Some challenges iOS Security
- 3. iOS Development - Tips & Tricks About Me Started with
- 4. iOS Development - Tips & Tricks About Me
- 5. iOS Development - Tips & Tricks Why iOS? -(NSString *)generateReasonsWhyiOS { NSMutableString *reasons = [[NSMutableString alloc] init]; [reasons appendString:@"It's new"]; [reasons appendString:@"It's challenging"]; [reasons appendString:@"It compiles to native"]; [reasons appendString:@"You have to deal with hardware limitations"]; [reasons appendString:@"You have to provide responsiveness"]; [reasons appendString:@"You have to provide usability"]; [reasons appendString:@"You have to provide security"]; [reasons appendString:@"0ften craftsmanship is required"]; [reasons appendString:@"Your code runs into people's pockets"]; return reasons; }
- 6. iOS Development - Tips & Tricks Table view Background image Custom drawn cells flipped
- 7. iOS Development - Tips & Tricks
- 8. iOS Development - Tips & Tricks Scroll View Custom View
- 9. iOS Development - Tips & Tricks
- 10. iOS Development - Tips & Tricks Security in iOS Local Storage Communication with the server Binary analysis and manipulation
- 11. iOS Development - Tips & Tricks Local Storage Security NSUserDefaults Convenient Not encrypted by default Keeps the data in a plist file CoreData Not encrypted by default Keeps the data in sqlite db
- 12. iOS Development - Tips & Tricks Local Storage Security Keychain Access Encrypted by default A bit more complex for use Insecure on jailbroken devices Data encryption Crypto API Obfuscate the encryption key Use unique device information String constant [[UIDevice currentDevice] identifierForVendor] Custom algorithm Secure encryption key
- 13. iOS Development - Tips & Tricks Server Communication Security Use SSL Dont accept self-signed certificates Client and server side data validation
- 14. iOS Development - Tips & Tricks Runtime Manipulation #import "AppDelegate.h" #import "ptrace.h" int main(int argc, char * argv[]) { #ifndef DEBUG ptrace(PT_DENY_ATTACH, 0, 0, 0); #endif @autoreleasepool { return UIApplicationMain(argc, argv, nil, NSStringFromClass([AppDelegate class])); } } ptrace Deny a debugger to attach Can be patched from binary Put it in multiple places
- 15. iOS Development - Tips & Tricks SEC_IS_BEING_DEBUGGED_RETURN_NIL () Check if a debugger is attached Hard to be patched from binary Make the check regularly and in critical parts Doesnt work against Cycript Runtime Manipulation #ifndef DEBUG SEC_IS_BEING_DEBUGGED_RETURN_NIL(); #endif
- 16. iOS Development - Tips & Tricks Conclusion Keychain Access for storing SSL for transporting Check for debuggers 100% security does not exist
- 17. iOS Development - Tips & Tricks Thank you! Galin Kardzhilov @gravera Stefan Tsvyatkov @stsvyatkov
Editor's Notes
- #11: 亟舒于亠亶亠. 亰 仄 弌亠舒仆 丶于从仂于 - iOS Development Manager 于 亠仆仂亠亶. 乂亠 仗仂亟仍亢舒 亠仄舒舒 仆磻仂仍从仂 于亠舒 从舒从 亟舒 仗仂亟仂弍亳仄 亳亞仆仂舒 于 iOS 仗亳仍仂亢亠仆亳舒. 丐亶 从舒仂 仂于舒 亠 于亟亠 仂弍亳仆舒 亠仄舒 亟仂亳 亳 亰舒 舒仂于亠, 舒 仆亳亠 亳仄舒仄亠 仄亳仆亳, 亟仆亠 亠 亰舒亠亞仆舒 舒仄仂 仂仆仂于亳亠. 舒亶-磶于亳仄亳亠 仄亠舒 于 亠亟仆仂 仗亳仍仂亢亠仆亳亠 舒 仄仂仂, 从亟亠仂 舒仆磦舒仄亠 亟舒仆仆亳亠, 从仂仄仆亳从舒亳舒 于舒 亳 舒仄仂仂 弍舒亶仆亳. 丐仂于舒 亳 舒 仆亠舒舒, 亳仂 亰舒亳舒 亠 舒亰亞仍亠亟舒仄亠.
- #12: 舒仗仂于舒仄亠 舒仆亠仆亳亠仂 仆舒 亟舒仆仆亳 于 仄仂弍亳仍仆仂仂 仂亶于仂. 丼亠仂 仆亳 亠 仆舒仍舒亞舒 亟舒 亰舒仗亳于舒仄亠 仗仂亠弍亳亠仍从亳 亳仄亠仆舒, 亠仆 仂从仆亳 亳 亟仂亳 仗舒仂仍亳 仍仂从舒仍仆仂 于 仗亳仍仂亢亠仆亳亠仂. 舒仗亳仄亠 从仂亞舒仂 亳仄仗仍亠仄亠仆亳舒仄亠 仂仍舒亶仆 仍仂亞亳仆 亰舒 舒亰仍亳仆亳 仗仂亠弍亳仍亳 于 亠亟仆仂 仂亶于仂. 舒亶-亟仂弍仆亳 仆舒亳仆 亰舒 亰舒仗亳于舒仆亠 仆舒 亳仆仂仄舒亳 亠 NSUserDefaults. 亰仗仂仍亰于舒 亠 仍亠仆仂 - 舒仆磦舒仄亠 亳 亠亠仄 亟舒仆仆亳 亠亟亳仆 亠亟 从仂亟. 亠从舒 于亳亟亳仄 仂弍舒亠 从仂仍从仂 亳亞亠仆 亠 仂亰亳 仗仂亟仂亟. NSUserDefaults 舒仆磦舒 亟舒仆仆亳亠 于 plist 舒亶仍, 从仂亶仂 亟亢舒 仗仍亶亠亶仆 亠从 仗亳从 仂 从亳亶-于亠仍 亰舒仗亳亳. 亳仆亠仆亠 亳仄舒 亞仂仍礆 亳亰弍仂 仂 仗亳仍仂亢亠仆亳, 从仂亳仂 亳仆舒仍亳舒仆亳 仆舒 从仂仄仗ﾑ 于亰舒仆仂 仄仂弍亳仍仆仂 仂亶于仂, 仗仂从舒亰于舒 亟舒仆仆亳亠 仂 于磻仂 亳仆舒仍亳舒仆仂 仗亳仍仂亢亠仆亳亠. 亰 仆舒仗亳仄亠 亳亰仗仂仍亰于舒仄 DiskAid. 丐从 仄 仂于仂亳仍 亟亢舒仆亳亠仂 仆舒 亠亟仆仂 仂 仗亳仍仂亢亠仆亳舒, 从仂亳仂 舒亰舒弍仂于舒仄亠 亳 从舒从仂 于亳亢亟舒亠 亳仄舒仄 仗亳从 舒亶仍仂于亠亠 于 仆亠亞仂. 仂亳 仄 仂于仂亳仍 仗仍亳 舒亶仍舒, 从仂亶仂 舒仆磦舒 亟舒仆仆亳亠 仆舒 NSUserDefaults. 仂仆亠亢亠 仗亳仍仂亢亠仆亳亠仂 亠 仆舒仗亳舒仆仂 从舒亠于亠仆仂, 从 仆亠 于亳亢亟舒仄亠 亟舒仆仆亳, 从仂亳仂 亳亰亞仍亠亢亟舒 于舒亢仆亳. 亠从舒 舒亰亞仍亠亢亟舒仄亠 亟亞仂 仗仂仗仍仆仂 仄仂 亰舒 舒仆亠仆亳亠 仆舒 亟舒仆仆亳 - CoreData. 弍亳从仆仂于亠仆仂 从 亠 舒仆磦舒 亟舒仆仆亳, 从仂亳仂 亳仄舒 仗仂-仍仂亢仆舒 从舒 亳 仗仂-亞仂仍礆 仂弍亠仄. 亰仗仂仍亰于舒仆亠仂 亠 仄舒仍从仂 仗仂-亟仂亠仄从仂 仗仂仆亠亢亠 磡于舒 亟舒 亳 亰亟舒亟亠仄 亟亠亶舒 仄仂亟亠仍 亳 亟舒 亳 亳仄仗仍亠仄亠仆亳舒仄亠 仂仆仂于仆亳亠 仄亠仂亟亳, 仆亢仆亳 亰舒 CoreData 亳仄仗仍亠仄亠仆舒亳舒. 仂 仆舒 仗舒从 仆亳 亳仆亠亠于舒 仗仂-从仂仂 从仂仍从仂 亳亞亠仆 亠 仂亰亳 仄亠仂亟. CoreData, 仗仂亟仂弍仆仂 仆舒 NSUserDefaults, 舒仆磦舒 亳仆仂舒仄舒亳舒 于于 舒亶仍 于 弍仆亟仍舒 仆舒 仗亳仍仂亢亠仆亳亠仂. 丐仂于舒 舒亶仍 仗亠舒于仍磦舒 sqllite database. 舒 亟舒 于亳亟 亟舒仆仆亳亠, 舒亰 仗仂仂 磡于舒 亟舒 仆舒仄亠 仗仂亞舒仄舒, 从仂仂 仂于舒 sqlite 舒亶仍仂于亠 - 舒从亳于舒 从仂仍从仂仂 亳从舒 于 亳仆亠仆亠. 仂亳 舒亶仂从 仄仂亢亠 亟舒 亞仂 仆舒仗舒于亳. 仂 从舒从于 亳亰于仂亟 亳亞舒仄亠 - 仆舒亶-仗仂仗仍仆亳亠 仄亠舒 亰舒 舒仆亠仆亳亠 仆舒 亟舒仆仆亳 舒 仄仆仂亞仂 仆亳从舒 亠仗亠仆 仆舒 亳亞仆仂.
- #13: 亠亞舒 仗舒于亳仍仆亳 仆舒亳仆 亰舒 舒仆亠仆亳亠 -