Unwrapping the Truth: Analysis of Mobile Application Wrapping Solutions
summary
Reverse engineers test major commercial MAM/app‑wrapping products for iOS and Android, diffing binaries (Mach‑O, LC_LOAD_DYLIB), using dex2jar and ASM dex edits, Mobile Substrate injection and ADB to trace behavior. Findings include keys and key‑material stored client‑side, decoupled weak passcode checks (unsalted SHA‑256), UTF‑8 conversion killing PBKDF2 entropy, unencrypted stores (NSUserDefaults, keychain misuse, iCloud cache, webview storage), exposed activities and SD card leaks, and insecure IPC like UIPasteboard IPC and method swizzling. Authors build a 50+ check security checklist and publish a white paper.
AI-written summary · about
chapters (17)
- 0:00Introduction to mobile wrapping
- 0:30BYOD risks and solutions
- 1:56Research methodology
- 4:49Major BYOD security risks
- 8:48MDM and MAM comparison
- 13:55How app wrapping works
- 17:17IOS wrapping technical details
- 21:15Android wrapping technical details
- 23:22MAM pros and cons
- 26:46Vulnerability pattern: Authentication
- 29:47Exploiting key derivation
- 34:18Cryptography implementation flaws
- 39:29Debugging obfuscated code
- 41:29Incomplete secure containers
- 45:45IPC vulnerability analysis
- 49:43File name and command attacks
- 51:12Conclusion and checklist
related talks
49mContain Yourself: Building Secure Containers for Mobile Devices
45mReverse engineering mobile apps: how, why, and what now?
47mAttacking Android Applications
58mUncovering OWASP’s Mobile Risks in iOS Apps
47mSecuring Android Applications
33mHacking and protection of Mobile Apps and backend APIs
29mA Day in the Life of a Mobile Malware Reverse Engineer
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security