iOS App Integrity: Got Any?

on YouTube ↗41m

" summary

Open-source Encrypted Code Modules (ECM) encrypt sensitive dynamic libraries at build time and decrypt them on-device with an app-specific key; Encrypted CoreData uses SQLCipher to keep SQLite blobs unreadable at rest. The build tool embeds a known-good size and SHA, the runtime decrypts with the app password, dlopen()s the module, shreds the ciphertext, then compares size and signature — demo shows success, wrong-key failure, and detection of a patched binary. Project lives on GitHub with Encrypted Code Modules (ECM) and Encrypted CoreData (ECD) and about 470+ stars and 100 forks.

AI-written summary · about

" chapters (29)

1. 0:00Introduction
2. 0:51iOS Mobile App Security (MAS) Elevator Pitch
3. 1:36Hacking and Jailbreaking ios Attacks and weaknesses are well documented
4. 2:47Recent iOS App Coding and OS Reported Vulnerabilities
5. 4:33Standard iOS Application Today
6. 4:57Research Idea: IMAS Secure Application Framework
7. 5:25iOS Security Architecture
8. 5:50IMAS App Security "trade-space" Comparison Mar 2014
9. 7:04IMAS - Security Controls Device Access
10. 9:07Github: project-imas.github.io 13 Controls
11. 11:20IMAS - Encrypted Core Data (ECD) em
12. 13:42Encrypted Core Data Additional iMAS Support
13. 15:12Multi-compiler Based on work out of UC Irvine by Michael Franz and Per Larsen . Produces different binaries each compile • Static analysis and ROP exploits must account for variations
14. 17:36System Monitor - Monitor all device processes and network calls at the kernel level - Filtering tools to find and react to developer defined system events -IMAS provides direct programmatic app integration
15. 19:19Memory Security Allows encryption, wiping, and checksums of objects in memory - Provides function address space validation Application Start
16. 20:43File Shredding
17. 22:00IMAS Sentry Application Add to existing Apple deployed devices • Jailbreak and Debugger Detection
18. 23:09Prior Research Focus - modifying ELF structures
19. 23:48iOS Static App Attacks
20. 24:29Static App Attacks Process
21. 24:47Code Injection and Binary Patching
22. 25:07Consequences of Static Attacks
23. 25:39Encrypted Code Modules (ECM) WHAT?
24. 26:15IMAS Encrypted Code Modules (ECM) Summary
25. 26:58ECM - Encrypted Code Modules Concept 2/3
26. 29:11Build Summary
27. 30:55App Startup
28. 31:32Validating Integrity
29. 39:00ECM Advantages

" related talks

• 43miOS Application Defense - iMASGregg Ganley · AppSecUSA 2013
• 52mBehind the Scenes of iOS SecurityIvan Krstić · Black Hat USA 2016
• 24mSecurity : protect the body of your appStéphane Mouawad · FrenchKit SE 2020
• 54mUnwrapping the Truth: Analysis of Mobile Application Wrapping SolutionsRon Gutierrez, Stephen Komal · Black Hat USA 2014
• 36mEnhancing Mobile App SecurityManikanta Garikipati · droidcon Berlin 2024
• 27miOS Attack Vectors and how to protect your appItay Brenner · BA: Swiftable 2022
• 58m10 Lines of Encryption, 1500 Lines of Key ManagementAnastasiia Voitova · RS Conf 2019: Mobile People Day
• 37mOutsmarting Hackers before your App gets pwn'edSubho Haldar · iOS Conf SG 2016