Hacking and Securing iOS Applications

Preface

1. Everything You Know Is Wrong
-The Myth of a Monoculture
-The iOS Security Model
-Storing the Key with the Lock
-Passcodes Equate to Weak Security
-Forensic Data Trumps Encryption
-External Data Is at Risk, Too
-Hijacking Traffic
-Trust No One, Not Even Your Application
-Physical Access Is Optional
-Summary

Part 1: Hacking
2. The Basics of Compromising iOS
-Why It's Important to Learn How to Break Into a Device
-Jailbreaking Explained
-End User Jailbreaks
-Compromising Devices and Injecting Code
-Exercises
-Summary

3. Stealing the Filesystem
-Full Disk Encryption
-Copying the Live Filesystem
-Copying the Raw Filesystem
-Exercises
-The Role of Social Engineering
-Summary

4. Forensic Trace and Data Leakage
-Extracting Image Geotags
-SQLite Databases
-Reverse Engineering Remnant Database Fields
-SMS Drafts
-Property Lists
-Other Important Files
-Summary

5. Defeating Encryption
-Sogeti's Data Protection Tools
-Extracting Encryption Keys
-Decrypting the Keychain
-Decrypting Raw Disk
-Decrypting iTunes Backups
-Defeating Encryption Through Spyware
-Exercises
-Summary

6. Unobliterating Files
-Scraping the HFS Journal
-Carving Empty Space
-Commonly Recovered Data
-Summary

7. Manipulating the Runtime
-Analyzing Binaries
-Encrypted Binaries
-Abusing the Runtime with Cycript
-Exercises
-Summary

8. Abusing the Runtime Library
-Breaking Objective-C Down
-Disassembling and Debugging
-Malicious Code Injection
-Injection Using Dynamic Linker Attack
-Summary

9. Hijacking Traffic
-APN Hijacking
-Simple Proxy Setup
-Attacking SSL
-Attacking Application-Level SSL Validation
-Hijacking Foundation HTTP Classes
-Analyzing Data
-Driftnet
-Exercises
-Summary

Part 2: Securing
10. Implementing Encryption
-Password Strength
-Introduction to Common Crypto
-Master Key Encryption
-Geo-Encryption
-Split Server-Side Keys
-Securing Memory
-Public Key Cryptography
-Exercises

11. Counter Forensics
-Secure File Wiping
-Wiping SQLite Records
-Keyboard Cache
-Randomizing PIN Digits
-Application Screenshots

12. Securing the Runtime
-Tamper Response
-Process Trace Checking
-Blocking Debuggers
-Runtime Class Integrity Checks
-Inline Functions
-Complicating Disassembly
-Exercises

13. Jailbreak Detection
-Sandbox Integrity Check
-Filesystem Tests
-Page Execution Check

14. Next Steps
-Thinking Like an Attacker
-Other Reverse Engineering Tools
-Security Versus Code Management
-A Flexible Approach to Security
-Other Great Books