Stealing user’s identity
summary
Jailbroken iPhone 8 Plus (iOS 16) runs a Frida server to perform a binary dump, then Hopper and LLDB over iProxy (2222→22, 6666→6666) reveal a WKWebView message handlers bridge and a CFBundle URL scheme. Injected JavaScript via a crafted deep link payload coerces the webview to post the auth token to an external node image server, token (valid ~20 minutes) is captured, keychain entries are written and a runtime LLDB runtime hook and method swizzle bypass jailbroken checks — resulting in a €1,000 account drain that succeeds end to end.
AI-written summary · about
chapters (6)
- 0:00Introduction and background
- 1:53Target app and setup
- 12:03Script injection exploit
- 21:25Deep link attack demo
- 23:14Runtime manipulation bypass
- 32:44Summary and prevention
related talks
40mStealing User's Identity
40mIntroduction into Reverse Engineering and iOS Security
29miOS Runtime Manipulation (PWND)
58mUncovering OWASP’s Mobile Risks in iOS Apps
36mTesting iOS Apps without Jailbreak in 2018
49mHow to Hack Your Own Mobile App
31mHacking Web Server Apps for iOS
35mAttacking iPhone XS Max