iOS App Penetration Testing
It’s apparent (and becoming more and more so as time goes on) that our computing needs have evolved and have migrated from our desktops and laptops to our handheld phones and tablets. These mobile devices have brought us much convenience and capability, using apps to extend desktop functionality on the go, and responding to user demand for a level of functionality not seen (or needed for that matter) before. But like anything, with new technology/functionality, comes the potential to introduce new risk via these devices and apps to the end user or corporate resource.
As a penetration tester, I find the mobile device/app vector to be a prime target – for me, it’s a good thing. For the organization using or depending on the use of these apps, it’s not a good thing.
So we beg the question; how do we as app users know how secure our information is? How do we know what the app is doing behind the scenes? The Apple AppStore has their process for reviewing apps submitted by private developers, but as far as I know that information has not been made public. So how do they check apps for bugs, flaws…threats?
The short answer is to do it yourself via
- Static analysis
- Dynamic analysis
- Network analysis
- Supporting files the app installs.
To get started for iOS, we need to do the following:
- Jailbreak the target device (I’ll be using an iPhone 4 running iOS 7)
- Connect it to a WLAN
- Install software
– adv-cmds (Cydia)
– gdb (Cydia)
– class-dump (Cydia)
– Erica Utilities
– Snoop-it (Cydia àadd ‘repo.nesolabs.de’ to the repositories)
– Introspy (http://isecpartners.github.io/Introspy-iOS/)
– unzip (Cydia)
– cycript (Cydia)
– Cydia Substrate (Cydia)
– Keychain Dumper
– clutch (https://github.com/KJCracks/Clutch/releases)