iOS
iOS devices are naturally limited compared to Android
Apple keeps a "walled garden" of apps you can install and utilize
Can be bypassed using Jailbreaking
xCode is the supported development for iOS
Many iOS devices have a hardware security components, and in certain cases even replacing physical part can cause the phone to error.
iOS Security Architecture
Hardware and Software layer
Apps run in Sandbox environment.
Similar to Android, it is based on Unix.
All apps are signed by Apple
We need developer profile and pay yearly fee to put apps on App Store.
(Free Developer account allows Sideloading)
Two patitions in the file system. Hardware and Software.
Each iOS Device has two keys created and put into the device during manufacturing.
Static Analysis for iOS
Apps are developed using Swift.
Apps are in a .iPA format
.ipa is signed bundle of folders and assets
/Payload/Application.app - the application itself.
/Payload/iTunesMetadata.plist - Info about the app developer.
/Payload/Application.app/Info.plist - Where important app info is stored (Similar to AndroidManifest.xml). This is a key-value type file.
Various .json files, assets or resources unique to the app
Use Xcode for development, and static analysis of iPA file.
Check system.log for any sensitive information.
AnyTrans
Tool to pull iPA files from AppStore.
Connect iPhone to AnyTrans and download App on device. Now, we can download the same iPA using AnyTrans.
Other Emulating Tools
Corellium and Appetize.io
Manual Static Analysis
Rename the iPA file to .zip
Unzip the file. We can now check .app file using the "Show package contents"
We can now see all the files such as Info.plist
Automated Static Analysis using MobSF
Dynamic Analysis
Setup Burp and import Certificate/Profile and install the certificate.
Goto About/Certificate Settings and enable Trust for Burp certificate.
Breaking SSL Pinning for iOS
We can use Objection to patch the iPA and disable SSL Pinning.
Requires physical device to receive a provisioning profile.
May not work in all cases.
The last kill resort will be to utilize a jailbroken iOS device and use tools like SSL KillChain to break SSL Pinning.
Patching iPA using Objection
Install objection.
Patch with code signed signature from Xcode via Developer profile.
Goto any project in Xcode and export the profile to device. Trust the developer profile on device.
Jailbreaking
checkra1n
Download checkra1n for macOS.
Allow untested iOS in checkra1n
Follow instructions on checkra1n
If we see Cydia installed, it means Jailbreak is successful.
Cydia
We can install apps using Cydia.
SSL Kill Switch for bypassing SSL Pinning
Install via Jailbreak and download on macbook and push on device to break SSL Pinning.
Open Cydia and install wget
SSH into jailbroken device and download the package in /tmp folder using wget.
dpkg -i com.nablac0d3.sslkillswitch_0.14.deb
If you get an error, run apt --fix-broken install
Open iOS settings app, locate SSL Kill Switch 2.
Open it and enable "Disable Certificate Validation".
Last updated