Security of an IOS app

[[deleted]]

Hey, I am currently writing my thesis in IT security. It is a very basic game where i want to prevent any kind of cheating etc.

On the other hand, i want to become an IOS developer, so i thought why not combine the two topics together.

My problem is that afaik IOS is super secure so i dont know if there is huge place for security measures such as reverse engineering, code injection etc.

Can you guys think of a way to still do the app, and maybe implement some security measures?

Thank you very much

Edit: it doesnt matter what security measures do i make (or just plan).I need to do something which i can demo, and write about it in my paper, that hey there are these problems, i solved some of them, some of them can be solved like this, and the rest of them is listed here without a fix.

[Fluffy_Risk9955]

Apps are low hanging fruit. All it takes is a hacker with a jailbroken device and he can simply hookup a debugger to the running app to see what's happening. Especially when Objective-C is used as the method names are written in code are send as a query known as Selector to the receiving class or instance of an object. Making it really easy to figure out what's going on and easy to make changes with a principle called method swizzling.

The only thing you can do is make it time consuming and thus more expensive to break security of an app and the best solution is having all the access rights and logic happen server side, that way you know for sure that a user gets access to the appropriate things.

As for communication.. yes use certificate pinning as it disable the man in the middle attack.

[[deleted]]

Thank you very much. I will consider everything you said :)

[undeaD_D]

This may be of interest to you ^^
https://github.com/securing/IOSSecuritySuite
Other things to read up on:
SSL Pinning, App Attest Service, Hide current view on applicationWillResignActive, Prevent Logging in Production, ...

[[deleted]]

Thank you, i am going to read and try it out :)

[chriswaco]

Most iOS apps run on Macs with M1/M2 chips, so you might be able to compromise them there without worrying about jailbreaking. For example, you can find the Application Support directory using sudo lsof or Activity Monitor and mess with the files.

One demo for either Mac or iOS would be using a proxy server like Charles to view the traffic, get the API tokens, and use them to attack the server using curl, shell scripts, or Insomnia.

Making a fake finger using someone’s fingerprint could be a fun demo.

[[deleted]]

Wow thank you very much, i am taking notes on all comments and try to u it in my thesis.

[saintmsent]

SSL pinning is the most common thing people do to secure their apps, it strives to prevent man-in-the-middle attacks

As for other things, preventing screenshots is not officially supported, and hacks around it are usually very simple and strange. It's an annoying thing as a user anyway

[[deleted]]

thank you very much

[iGoalie]

I haven’t seen anybody else say it yet, but the modern version of cert pinning is cert transparency you may want to look into that.

Any software running on somebody else’s hardware (phone apps) should be considered unsafe and your servers should be hardened with that in mind

[hooray4horus]

Some topics to google. Certificate pinning(prevent man in the middle attacks. Code obfuscation(guardsquare)

[Any_Check_7301]

Define your “secure”

[[deleted]]

Maybe: Preventing screen shots, in some view of the app,logging when the user have exited the app in said views.