Stealing User's Identity
summary
A banking app running on a jailbroken iPhone X (iOS 14, unc0ver) exposes a vulnerable WebView that appends unsanitized input to innerHTML, allowing JavaScript injection to call WKWebView postMessage IPC, override an updateToken handler, and exfiltrate session tokens via an injected image GET. Binary dumping and analysis with Hopper + lldb + frida reveal the app’s deep link scheme, let the attacker deliver the payload remotely (email click), inject the stolen token into Keychain at runtime, swizzle jailbreak checks, and successfully transfer €1,000.
AI-written summary · about
chapters (10)
- 0:00Introduction and background
- 2:58Dumping app memory
- 5:25Analyzing JavaScript in app
- 11:05First JavaScript injection
- 13:57Remote exploit via deep link
- 19:35Testing on non-jailbroken device
- 21:20Injecting token into keychain
- 25:31Bypassing jailbreak detection
- 31:16Summary of exploits
- 34:08Q&A session
related talks
36mStealing user’s identity
29miOS Runtime Manipulation (PWND)
58mUncovering OWASP’s Mobile Risks in iOS Apps
40mIntroduction into Reverse Engineering and iOS Security
42mHack My App: Learn Flutter Security by Breaking It
49mHow to Hack Your Own Mobile App
27miOS Attack Vectors and how to protect your app
31mHacking Web Server Apps for iOS