Apple iOS 4 Security Evaluation

More documents

Recommendations

Info

ApplicationIdentifierPrefix9ZJJSS7EFVCreationDate2010-08-20T02:55:55ZDeveloperCertificates...Entitlementsapplication-identifier9ZJJSS7EFV.*get-task-allowkeychain-access-groups9ZJJSS7EFV.*[ ... ]
Page 1 and 2: Apple iOS 4 Security EvaluationDino
Page 3 and 4: AcknowledgementsiPhone jailbreak de
Page 5 and 6: OverviewIntroductionASLRCode Signin
Page 7 and 8: Security ConcernsSensitive data com
Page 9 and 10: Persistence Attack GraphPrivileged
Page 11 and 12: Security ConcernsHow hard is it to
Page 13 and 14: ASLR with PIEExecutable Heap Stack
Page 15 and 16: Partial vs. Full ASLRPIEMainExecuta
Page 17 and 18: PIE in Real-World Apps?
Page 19 and 20: Bottom LineAll built-in apps in iOS
Page 21 and 22: Security ConcernsCan this applicati
Page 23 and 24: Mandatory Code SigningCode Signing
Page 25: Provisioning ProfilesThe Provisioni
Page 29 and 30: OTA App DistributionAd-Hoc and In-H
Page 31 and 32: MAC Hook API Description AMFI Usage
Page 33 and 34: Normal Code SignatureExecutable=/..
Page 35 and 36: Code SignatureVerificationiOS kerne
Page 37 and 38: AMFI Daemon/usr/libexec/amfidMessag
Page 39 and 40: Code Signing EnforcementEnsure that
Page 41 and 42: CS OpsFlag Value DescriptionCS_OPS_
Page 44 and 45: iOS 4.3 Adds JavaScript JIT
Page 46 and 47: AMFI MAC HookMAC Hook API Descripti
Page 48 and 49: Bottom LineMandatory Code Signing i
Page 50 and 51: Security ConcernsCan an exploited a
Page 52 and 53: Sandbox Kernel ExtensionInstalls MA
Page 54 and 55: Third-Party ApplicationsAssigned a
Page 56 and 57: Container ProfileSee whitepaper for
Page 58 and 59: Example Serverscom.apple.UIKit.past
Page 60 and 61: Data Encryption
Page 62 and 63: Data EncryptionWhat you need to kno
Page 64 and 65: Data Protection APIApplications mus
Page 66 and 67: Attacking PasscodeWith knowledge of
Page 68 and 69: Worst-Case PasscodeGuessing Time (i
Page 70 and 71: Conclusion
Page 72 and 73: FindingsAlthough filesystem is encr
Page 74 and 75: Unique to iOSDynamic Code Signing E
Page 76 and 77:
Attacks You ShouldCare Most AboutLo
Page 78 and 79:
Bottom LineShould you deploy iOS de
Page 80 and 81:
hobbyOne more thing...
Page 83:
Google Trends: Mac, iPhone
Page 87 and 88:
iOS Fuzz Farm
Page 89:
Questions?• Final slides and whit
show all

Apple iOS 4 Security Evaluation

Create successful ePaper yourself

Delete template?

Save as template?