第 1 页
iOS Penetration Testing A Definitive Guide to iOS Security — First Edition — Kunal Relan www.allitebooks.com
iOS Penetration Testing A Definitive Guide to iOS Security — First Edition — Kunal Relan www.allitebooks.com
iOS Penetration Testing A Definitive Guide to iOS Security First Edition Kunal Relan www.allitebooks.com
iOS Penetration Testing: A Definitive Guide to iOS Security Kunal Relan Noida, Uttar Pradesh India ISBN-13 (pbk): 978-1-4842-2354-3 ISBN-13 (electronic): 978-1-4842-2355-0 DOI 10.1007/978-1-4842-2355-0 Library of Congress Control Number: 2016960329 Copyright © 2016 by Kunal Relan This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. Trademarked names, logos, and images may appear in this book. Rather than use a trademark symbol with every occurrence of a trademarked name, logo, or image we use the names, logos, and images only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights. While the advice and information in this book are believed to be true and accurate at the date of publication, neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or omissions that may be made. The publisher makes no warranty, express or implied, with respect to the material contained herein. Managing Director: Welmoed Spahr Lead Editor: Nikhil Karkal Technical Reviewer: Nishant Das Patnaik Editorial Board: Steve Anglin, Pramila Balan, Laura Berendson, Aaron Black, Louise Corrigan, Jonathan Gennick, Robert Hutchinson, Celestin Suresh John, Nikhil Karkal, James Markham, Susan McDermott, Matthew Moodie, Natalie Pao, Gwenan Spearing Coordinating Editor: Prachi Mehta Copy Editor: Kezia Endsley Compositor: SPi Global Indexer: SPi Global Artist: SPi Global Distributed to the book trade worldwide by Springer Science+Business Media New York, 233 Spring Street, 6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax (201) 348-4505, e-mail orders- ny@springer-sbm.com, or visit www.springeronline.com. Apress Media, LLC is a California LLC and the sole member (owner) is Springer Science + Business Media Finance Inc (SSBM Finance Inc). SSBM Finance Inc is a Delaware corporation. For information on translations, please e-mail rights@apress.com, or visit www.apress.com. Apress and friends of ED books may be purchased in bulk for academic, corporate, or promotional use. eBook versions and licenses are also available for most titles. For more information, reference our Special Bulk Sales–eBook Licensing web page at www.apress.com/bulk-sales. Any source code or other supplementary materials referenced by the author in this text are available to readers at www.apress.com. For detailed information about how to locate your book’s source code, go to www.apress.com/source-code/. Readers can also access source code at SpringerLink in the Supplementary Material section for each chapter. Printed on acid-free paper www.allitebooks.com
This book is dedicated to my mom, my spiritual guru for inspiring me to live, my mentor who always supported me in this journey, and to all the weirdoes like me; I love you all. www.allitebooks.com
Contents at a Glance About the Author ............................................................................ xiii About the Technical Reviewer ......................................................... xv Acknowledgments ......................................................................... xvii Introduction .................................................................................... xix ■Chapter 1: Introduction to iOS ........................................................ 1 ■Chapter 2: iOS App Development Basics ...................................... 13 ■Chapter 3: iOS App Vulnerabilities and Jailbreaking.................... 31 ■Chapter 4: Blackbox Testing iOS Apps.......................................... 47 ■Chapter 5: iOS Security Toolkit..................................................... 73 ■Chapter 6: Automating App Testing.............................................. 97 ■Chapter 7: iOS App Security Practices ....................................... 119 Index.............................................................................................. 131 v www.allitebooks.com
Contents About the Author ............................................................................ xiii About the Technical Reviewer ......................................................... xv Acknowledgments ......................................................................... xvii Introduction .................................................................................... xix ■Chapter 1: Introduction to iOS ........................................................ 1 iOS Introduction....................................................................................... 1 Security History ....................................................................................................... 2 Code Signing ............................................................................................................ 2 Data Execution Prevention (DEP) .............................................................................. 3 Address Space Layout Randomization (ASLR).......................................................... 3 Sandbox.................................................................................................................... 3 iOS Boot Procedure................................................................................................... 4 Updates..................................................................................................................... 5 What’s New?............................................................................................................. 6 System Insight.......................................................................................................... 7 iOS System Hierarchy.............................................................................. 8 Applications.............................................................................................................. 9 Library ...................................................................................................................... 9 Bin Folder ............................................................................................................... 10 Dev Directory.......................................................................................................... 10 Lib Folder................................................................................................................ 10 Sbin Directory......................................................................................................... 10 vii www.allitebooks.com
■ CONTENTS Tmp Directory......................................................................................................... 10 Developer Directory................................................................................................ 10 System Directory .................................................................................................... 10 Boot Directory......................................................................................................... 11 Etc Directory ........................................................................................................... 11 mnt Directory.......................................................................................................... 11 usr Directory........................................................................................................... 11 var Directory ........................................................................................................... 11 User Directory......................................................................................................... 11 Private Directory..................................................................................................... 11 iOS Application Overview ...................................................................... 11 Summary............................................................................................... 12 ■Chapter 2: iOS App Development Basics ...................................... 13 Introduction to Objective-C and Swift ................................................... 13 Objective-C Runtime............................................................................................... 13 Basic Terminology in Objective-C ........................................................................... 14 Object Creation ....................................................................................................... 15 Data Types .............................................................................................................. 15 Methods ................................................................................................ 16 Instance Methods ................................................................................................... 16 Class Methods ........................................................................................................ 17 Introduction to Swift.............................................................................. 17 Swift Runtime......................................................................................................... 18 Compatibility with Objective-C ............................................................................... 18 Stored Properties.................................................................................................... 18 Classes and Methods.............................................................................................. 19 Structures............................................................................................................... 20 viii www.allitebooks.com
■ CONTENTS Introduction to Xcode ............................................................................ 20 Getting Started with Xcode..................................................................................... 21 Cocoa Framework ................................................................................. 22 CocoaPods............................................................................................. 22 Hello World with Swift ........................................................................... 23 iOS Application Architecture.................................................................. 29 Summary............................................................................................... 30 ■Chapter 3: iOS App Vulnerabilities and Jailbreaking.................... 31 Introduction to Security and Vulnerabilities in iOS ................................ 31 What Is Jailbreaking? ............................................................................................. 31 Jailbreaking iOS ..................................................................................................... 32 SSHing in iOS.......................................................................................................... 34 Installing the Tools................................................................................. 35 Installing class-dump ............................................................................................. 35 Installing the libimobiledevice Library.................................................................... 36 Installing Cycript..................................................................................................... 37 Setting Up a Proxy .................................................................................................. 38 Installing Keychain Dumper.................................................................................... 38 Common iOS Vulnerabilities .................................................................. 40 Buffer Overfl ows..................................................................................................... 40 Invalidated Input ..................................................................................................... 41 Privilege Escalation ................................................................................................ 43 Insecure Data Storage ............................................................................................ 43 Insecure Transport Layer ........................................................................................ 43 Client-Side Injection ............................................................................................... 44 Weakness in Authentication and Authorization ..................................................... 45 Summary............................................................................................... 45 ix www.allitebooks.com
■ CONTENTS ■Chapter 4: Blackbox Testing iOS Apps.......................................... 47 Intercepting Network Traffi c.................................................................. 47 Defeating User Validation ...................................................................... 53 Damn Vulnerable iOS App: DVIA.............................................................................. 54 Performing Runtime Analysis ................................................................ 61 Summary............................................................................................... 72 ■Chapter 5: iOS Security Toolkit..................................................... 73 Advance Reverse Engineering .............................................................. 73 A Day in the Life of a Debugger............................................................. 79 Debugging in Xcode................................................................................................ 80 Bypassing Jailbreak Detection.............................................................. 91 Summary............................................................................................... 95 ■Chapter 6: Automating App Testing.............................................. 97 idb: Simplify Penetration Test................................................................ 97 iRET: iOS Reverse Engineering Toolkit ................................................. 103 Tweaking the Development ................................................................. 110 Summary............................................................................................. 118 ■Chapter 7: iOS App Security Practices ....................................... 119 Storage in iOS...................................................................................... 119 Data Storage Security ......................................................................... 120 Transport Layer Security ..................................................................... 122 Certifi cate Pinning ................................................................................................ 123 Anti-Debugging Protections ................................................................ 125 Secure Development Guidelines ......................................................... 126 Untrusted Data...................................................................................................... 126 Session Management ........................................................................................... 127 x www.allitebooks.com
■ CONTENTS Data Storage......................................................................................................... 127 Geolocation Handling............................................................................................ 127 Escape Classic C Attacks...................................................................................... 127 Transport Layer .................................................................................................... 128 Closing Thoughts................................................................................. 129 Index.............................................................................................. 131 xi www.allitebooks.com
About the Author Kunal Relan is an iOS security researcher and a full-stack developer who has been working as security lead for Mozilla, Delhi. He has published several research papers on information security in the esteemed Journal of ACM. Having obtained the acclaimed CCNA Security certification, he is also an Owasp ZAP evangelist. With his thriving experience as a security researcher and penetration tester, Kunal is known for actively reporting security bugs in a mobile and web applications. During the past few years, he has been working as a mobile application penetration tester and a security researcher in New Delhi. Currently working as a security consultant, he is the guy behind owlpro, a WordPress security scanning platform. xiii
About the Technical Reviewer Nishant Das Patnaik is an experienced application security and SecDevOps engineer. He is based out of India and is currently working for eBay in Bangalore. In the past, he has worked as an AppSec and SecDevOps engineer at InMobi and Yahoo. He loves to share his work with the community as open source projects and hence has been a presenter at Black Hat Europe 2016, Black Hat USA 2016, Black Hat USA 2013, and Nullcon 2012. He loves to code on Python and JavaScript. You can reach out to him on Twitter at @dpnishant and check out some of his open source projects at github. com/dpnishant. When he is not working, you can find him playing a piano or experimenting at the kitchen. xv
Acknowledgments I would personally like to thank Apress for giving me the opportunity to write this book. This book would not have been possible without the support of Nikhil Karkal, Prachi Mehta, and Suresh John. You guys have really helped a lot during the completion of this book. It has been a long journey into this amazing world of iOS development and penetration testing, the outcome of which would never have been possible without you guys. The long journey of framing the whole series into a book was possible only because of your support. Secondly, I would like to thank my mother, who has always supported me in all the things I ever wanted to do during my journey into the field of information security. Now, years after being in information security, it’s a journey I loved and spent those dark and lonely nights with, days full of passion and zeal to discover and dive deep into this area of my interest. I would also like to say thanks to Sailmn, my beloved hacker friend as he was always there as a part of motivation in my research and was one of those few who understood my vision and my passion for all of this. We spent days together working on different information security projects and he has always been so good at everything we did. Also a big thanks to all the information security books you shared with me, as they were really useful for all the things I do now. I would also like to say thanks to all my friends, family, and my mentors at Mozilla: you are the reason for me being what I am. This has been an amazing journey with you all. Lastly, a big thanks to Jay Khurana, Kunal Mohan, and all other unknown strange and weird kids we see. I have a special love for all of them; it is really hard to adjust in this world and I feel the same as you do. Keep exploring this infinite universe! xvii
Introduction iOS is one of the most famous mobile operating systems in the world after Android, having about 28% of total mobile operating system market. Since its release in June 2007, it has evolved, and the current stable version is iOS 9.3.3. Apple has a stronghold of the mobile market, making it the second most used mobile OS in the world. iOS is a closed source operating system, unlike its rival Android, which is open source. That makes Android the de facto mobile OS for all other hardware manufacturers including Samsung, LG, HTC, etc. Since its release in 2007, iOS has been prone to jailbreaking; however, Apple has worked hard to make the security of iOS tighter with every release. They still have not managed to avoid jailbreaking totally and the current stable version iOS 9.3.3 already has a public jailbreak available by the Pangu team, which also claims to have jailbroken the latest iOS 10 beta. This leaves a big question mark on Apple about jailbreaking and other security issues being addressed. iOS has always been a target of attackers, with many security breaches and causalities in the past, even though Apple has been very strict with its security policies and the App Store environment, which has a lot of restrictions on app development and deployment. Apple has also been very restrictive on giving up user data APIs to developers, and has denied a lot of Private APIs for use in apps, unlike Android, which gives its users data API like SMS, call history, etc. On the top of that, it has a sandboxed application environment in the OS that isolates the application from the operating system. Even with iOS’s tight architecture, app developers still manage to make their applications vulnerable to attackers, due to penetration testing and reverse engineering in iOS. This is very different from the Web or Android setup, with Android running applications built in Java, which makes it easier to reverse engineer. This book will be your guide to working with iOS penetration testing and reverse engineering, and I recommend you go through each chapter thoroughly, follow the tutorials, and try replicating them on your end. xix
CHAPTER 1 Introduction to iOS iOS has been around since 2007, when we first saw the iPhone, a beautiful device with iOS in it. Developed by the Apple Macintosh team, it was originally called iPhone OS, was renamed to iOS in 2010, and now runs Apple’s iPhone, iPad, and iPod Touch. It is the second most popular mobile phone in the world after Android. iOS has been around for nine years and we have seen a lot of changes since its launch. It has always been in the spotlight for its security bugs, with the first bug hitting the web in 2007. In this chapter, we talk about how iOS works, how it manages to keep away the malware from the App Store, and how the architecture of iOS is laid out. This chapter is an introduction to iOS and covers all the basics needed to understand the coming chapters. If you already understand the architecture of iOS and its file system, you can skip this chapter and move on to the second one, but it is always a good idea to brush up on your knowledge. ■ Note We will be following Apple’s latest 9.x and 8.x iOS versions; however, most of the features and issues are backward compatible and may work in upcoming versions as well. iOS Introduction iOS has been a popular operating system since its inception and its App Store has more than 1.5 million apps, of which 100 billion copies have been downloaded. iOS has always been praised for its user interface and is based on the concept of direct manipulation using multi-touch gestures. iOS shares Core Foundation and Foundation Kit frameworks with the popular OS X (the operating system in the MacBook); however, it has its own upgraded version of UIKit called Cocoa Touch. iOS also shares the Darwin foundation with OS X, which is an open source UNIX operating system released by Apple in 2000. However, iOS still doesn’t provide UNIX-like shell access to users. At the time of writing this book, iOS 9.3.1 is the latest release and 9.x and 8.x are the most commonly installed releases in current devices. Electronic supplementary material The online version of this chapter (doi: 10.1007/978-1-4842-2355-0_1) contains supplementary material, which is available to authorized users. © Kunal Relan 2016 1 K. Relan, iOS Penetration Testing, DOI 10.1007/978-1-4842-2355-0_1
CHAPTER 1 ■ INTRODUCTION TO IOS Lets dive deeper into how iOS works, including the security mechanisms of iOS and many other things that make iOS what it is today. Security History Apple has been quite successful in keeping the malware off its App Store, unlike Google Android, which has been tricked to host a ton of malware on its Play Store, harming millions of users everyday. The Apple App Store has managed to maintain the proper check on the quality and quantity of the apps on the store because of its long app review process, which gets annoying at times. Apple’s app review process takes around 7-8 working days to review the app before uploading it to the App Store, which aims to keep the ecosystem free from malware. But it has been a blackbox game for developers, at least, as many of the apps often get rejected even after falling into whitelist categories, as Apple never discloses its review process. It just publishes a guide on making apps that can pass through App Store review process. YiSpecter was one of the first applications to bypass the strict app review process of App Store. YiSpecter was the first iOS malware abusing private APIs in the sandboxed environment, and a recent study shows that over 100 apps on the App Store abuse private APIs, this taking Apple’s security a step back, in failing to safeguard its private APIs. ■ Note Private APIs are not publicly defined and are supposed to be used by Apple only. iOS has many private APIs, including Telephony, Message, etc. Apple has drastically improved its security model since iOS version 1.0, which had all the applications running as root user and had a bunch of security vulnerabilities. In contrast to what we see today, where every app has its own user and a sandbox in which it lives, the attack scope has been narrowed down to a great extent. With iOS 1.0, a vulnerability in any app could allow attackers to gain root privileges on a device’s OS, enabling them to perform sophisticated exploits, as there was no sandboxing or any other strong security mechanisms. However, with its growth, Apple has introduced a lot of security techniques, making iOS strong and managing to keep malware away from its App Store through its app review process and strong security model. Code Signing Apple uses the code signing method to verify the authenticity of third-party applications, which is only supposed to be coming from the App Store and nowhere else. Apple signs off the apps on the App Store to verify it, and the kernel is allowed to only execute signed applications. All the pages in memory also need to be signed to run, giving no access to runtime modification of app behavior. Code signing is a very critical step, as it keeps unverified apps out of the App Store that may abuse private APIs. Unsigned code simply cannot run on a device unless it’s jailbroken. For code signing while developing an app on Xcode, the developer should be registered and logged in. Without logging in, the developer can only test the app in a simulator. 2
CHAPTER 1 ■ INTRODUCTION TO IOS Data Execution Prevention (DEP) Data Execution Prevention (DEP) has been around since iOS 5.0 and is a technique to forbid arbitrary code from running in memory. DEP safeguards against exploitation by preventing code execution from data pages, such as the default heap pages, various stack pages, and memory pool pages. It is a way to distinguish between code and data, allowing only code to execute in the memory. Payloads that produce data over the network, files, etc., are not allowed to execute in memory. However, there is a workaround for bypassing DEP by using ROP (return-oriented programming), which reuses snippets of executable code that are already loaded in the memory to craft the exploit payload. Attackers frequently use ROP to bypass DEP. iOS tries to make such bypasses harder by enforcing code signing, which is done by Apple itself or by a trusted authority such as an enterprise that uses Apple iOS to distribute its private/in-house apps. This limits attackers from executing ROP, but not shell code. Address Space Layout Randomization (ASLR) Address Space Layout Randomization (ASLR) is an exploit mitigation technique used by Apple to empower DEP. ASLR randomizes the memory address of programs loading in memory, so even when an attacker finds a vulnerability he would still have a hard time getting the memory location. But ASLR bypass is still doable if the attacker gets multiple memory disclosure vulnerability. Hence, Apple implements ASLR together with DEP to strengthen the protection. The thing to note is that not all applications use full native ASLR provided by iOS, but by default the flag for using Position Independent Executable (PIE) support is available in Xcode since iOS 4.3. An app is PIE if and only if the main executable and all its dependencies were built as PIE. Full ASLR randomizes the memory space for executable, data, heap, stack, library, and the dynamic linker (DYLD). Let’s simplify this attack to understand it more. Consider an application that can view a user’s bookmarks and the content of the bookmarks, which means the application can read the memory address and memory at that particular point of bookmarks. The application can tinker with the memory address and change the value at any particular address, making the user visit web sites he never had in his bookmarks because of the existing ASLR. These types of attacks are not possible in current iOS versions, which use full ASLR. Sandbox Apple has been very particular and strict about its security, and sandboxing is the technique implemented in iOS. It is used to isolate an app in a container so that third- party apps are not able to access other applications or their data (including user data) or private APIs. Sandboxing enables iOS to lay out a granular control on its third-party apps, only allowing them to access certain functionalities. iOS uses the Apple XNU sandbox 3
CHAPTER 1 ■ INTRODUCTION TO IOS framework, which was initially called Seatbelt. It is implemented as a policy module of the TrustedBSD MAC (Mandatory Access Control) framework. Based on configuration that looks like LISP, it gets compiled into binary to be processed by the kernel. Sandboxing limits the scope of damage any malware can inflict on a third-party app, thus retaining the privacy of all other processes and files, even when the app is compromised. Sandbox rules are basic deny or allow written in the SBPL (Sandbox Policy Language), which very similar to that of a typical firewall policy file, and ensures only limited amount of permissions are given to the apps. For example, an SMS app shouldn’t be able to access browser history and a browser app should not able to access passwords. The rules in sandbox take care of all these permissions. We will be discussing sandboxing in depth in later chapters. iOS Boot Procedure In recent years, Apple has greatly improved on the boot procedure of iOS and almost all the changes have been central to the security of its platform. It is very interesting to see how an iOS device boots up and all the security measures it takes before loading the kernel. iOS has a very strict process of booting the operating system, where it checks for authenticity at every stage. When an iOS device is turned on, the processor executes the BootROM, which is a read-only and yet executable block of memory that’s created during the chip fabrication process. It contains the Apple Root CA, which then verifies the signature and decrypts the LLB (lower level bootloader) and executes it. LLB then initiates the execution of the second level of bootloader called iBoot, after verifying its authenticity. iBoot in turn again checks for the authenticity of the LLB. If everything goes well, iBoot finally executes the iOS kernel to load the operating system. Apple initiated the main OS boot, so even before the main OS is booted, Apple verifies the authenticity of services at every step and ensures that nothing is tinkered with. Once the main OS boots up, the kernel loads the system core services and iOS components and then the Apple native and third-party apps. The system services are loaded and the kernel then verifies these services one by one, whether they all have been signed by Apple or not. This whole process happens seamlessly in the background, once the device is turned on. It shows how particular Apple has been about iOS and its security. Figure 1-1 illustrates the iOS boot procedure and shows the flow of booting up iOS in a device. 4
CHAPTER 1 ■ INTRODUCTION TO IOS Figure 1-1. iOS boot procedure Updates Apple provides regular updates to its iOS through iTunes and through the over the air update, which can be directly installed in the device (since iOS 5.0). Apple also starts deprecating older versions of iOS as it steps higher and stops digitally signing the old version firmware, so a device running a higher version of iOS can’t revert to an older 5
CHAPTER 1 ■ INTRODUCTION TO IOS version if Apple has stopped signing it. This technique is used by Apple to keep jailbreaks away from its ecosystem by keeping most of its users on the latest version of iOS. Hence, jailbreak developers and their users prefer to stay on an iOS version that has a jailbreak available, because jailbreaks usually take time to appear and then Apple releases a new version of iOS with the security fix as soon as it finds a jailbreak available. At the time of writing this book, the latest version of iOS was 9.3.1 and the last working jailbreak was available for iOS 9.3. However, iOS 8.1-8.3 had the most stable jailbreak available for iOS, developed by TaiG and the Pangu team, the two most active jailbreak communities. We will be talking more about jailbreaks in the jailbreak section and will apply the same techniques to an iPad for our further exploitation and testing. What’s New? The rapidly changing world of technology is very hard to keep up with. At the time of writing this book, Apple rolled out iOS 9.3.2 and there are many things Apple has introduced in this version. Apple has introduced new security features as well as worked on the existing ones to make sure the user’s privacy is always protected. • App transport security: With the web becoming more prominent and the majority of apps becoming more Internet-centric, it is important for app developers to secure the network traffic of their apps from prying eyes. One way to achieve this is ensuring the app’s communication from the iOS device to server is encrypted and the integrity of the data is verified at both the ends. To promote this security best practice, Apple has mandated the use of HTTPS in apps when communicating with any remote web server. Although developers can turn off this protection for their app(s)in Xcode, it is recommended you not do so. • Blocking installed apps detection: Prior to iOS 9, there were some privacy gaps in iOS that allowed an app to gather the list of all currently installed apps; the first bug used sysctl() to retrieve the process list, which included the list of running apps. In iOS 9, Apple patched this bug so it did not provide the list of running apps to sandboxed apps. The second method relied on sandboxed apps being able to access icon cache (fixed in iOS 9) and the third method used the UIApplicationcanopenUrl method to open known URI schemes used by specific known apps using the brute force technique. This particular bug has reportedly been exploited by Twitter, futzing around 2500 known URI schemes, and has also been addressed in iOS 9. • Mac Address Randomization improved: Mac Address Randomization was introduced in iOS 8 to disallow tracking of users through the network card’s device address (MAC address). Apple improved this feature, which initially worked only when location services were off. In iOS 9 it has been fixed, this feature has has been extended to support inclusion of location service scans. 6
显示前 20 页。下载资料查看完整内容。
暂无评论。快来抢沙发吧!
评论 (0)
暂无评论。快来抢沙发吧!