iOS Attack Vectors and how to protect your app
summary
Demonstrates concrete iOS failures and fixes: app backups let attackers read and edit Core Data and UserDefaults so store tokens in Keychain / Secure Enclave or encrypt files with a key kept out of backups; unvalidated deep links enable phishing so restrict domains or sign/redirect URLs; MITM is mitigated by certificate pinning via URLSession delegate (use pinned public key hashes from a downloaded cert); binaries leak secrets — obfuscate critical methods; CocoaPods public-repo mixups enable supply‑chain injection; use App Attest (iOS14+) to verify installs.
AI-written summary · about
chapters (12)
- 0:00Intro
- 1:50The CIA Triad
- 2:51Why protect at App level?
- 4:24Insecure Storage - Attack
- 6:20Unvalidated User Input
- 9:42MiTM - Pinning SSL Certificates
- 15:57Reverse Engineering - Obfuscators
- 17:20Third Party Libraries - Vulnerable Podfile
- 18:23Third Party Libraries - Solution Best
- 19:33Third Party Libraries - Xcode Attack
- 22:32App Redistribution - Key Attestation (Server Side)
- 23:39App Redistribution - Requests Attestation
related talks
47mSecurity Threats & Mitigations for iOS Developers
37mOutsmarting Hackers before your App gets pwn'ed
45mTen Secrets to Secure Mobile Applications
48mMobile Security Attacks: A Glimpse from the Trenches
40m 10 Things you Need to Know before Implementing Cryptography
58mUncovering OWASP’s Mobile Risks in iOS Apps
49mHow to Hack Your Own Mobile App
39mMobile App Security