iOS应用安全：黑客与开发者必读指南

5星 · 超过95%的资源需积分: 10 123 浏览量更新于2024-07-20 收藏 16.3MB PDF 举报

"iOS Application Security: The Definitive Guide for Hackers and Developers" 是一本由David Thiel编写的书籍，专注于iOS应用的安全性。该书面向开发者和安全专家，旨在揭示常见的iOS编程错误导致的安全问题，并提供解决这些问题的方法。2016年出版，拥有296页，使用英文，格式为PDF，大小为16 MB，ISBN号为159327601X。本书首先介绍了iOS应用程序的结构和Objective-C的设计模式，然后逐步深入到代码审查和漏洞修复。书中涵盖了以下关键知识点： 1. iOS安全模型：解释了iOS内置的安全机制以及它们的局限性，帮助读者理解如何在这些机制的基础上增强应用的安全性。 2. 敏感数据泄露：讨论了数据如何不经意间泄露到不应存在的地方，例如通过剪贴板，以及如何防止这种情况发生。 3. 加密技术：详细介绍了如何使用Keychain、Data Protection API以及CommonCrypto来实现数据加密，确保敏感信息的安全存储。 4. 遗留漏洞：分析了源自C语言的旧有缺陷如何影响现代iOS应用程序，以及如何修复这些历史遗留问题。 5. 用户隐私：探讨了收集用户数据时可能引发的隐私问题，并提供了避免潜在陷阱的策略。这本书适合那些希望强化自己应用防御能力的开发者，以及寻找并修复他人代码中安全漏洞的黑客。通过阅读，读者将能够更全面地了解iOS应用安全的方方面面，提升其开发出更安全应用的能力。 "iOS Application Security: The Definitive Guide for Hackers and Developers" 是一本深入探讨iOS应用安全的宝贵资源，无论你是开发者还是安全研究人员，都能从中获益，确保你的应用免受恶意攻击，保护用户信息安全。

Buffer Overﬂows and the Stack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

A strcpy Buffer Overﬂow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

Preventing Buffer Overﬂows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

Integer Overﬂows and the Heap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196

A malloc Integer Overﬂow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

Preventing Integer Overﬂows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

Closing Thoughts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

INJECTION ATTACKS 199

Client-Side Cross-Site Scripting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

Input Sanitization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200

Output Encoding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

SQL Injection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

Predicate Injection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204

XML Injection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

Injection Through XML External Entities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

Issues with Alternative XML Libraries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207

Closing Thoughts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207

PART IV

KEEPING DATA SAFE

ENCRYPTION AND AUTHENTICATION 211

Using the Keychain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211

The Keychain in User Backups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

Keychain Protection Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

Basic Keychain Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

Keychain Wrappers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217

Shared Keychains. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

iCloud Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

The Data Protection API . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

Protection Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220

The DataProtectionClass Entitlement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223

Checking for Protected Data Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224

Encryption with CommonCrypto . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225

Broken Algorithms to Avoid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226

Broken Initialization Vectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226

Broken Entropy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

Poor Quality Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

Performing Hashing Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228

Ensuring Message Authenticity with HMACs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229

Wrapping CommonCrypto with RNCryptor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

xvi Contents in Detail

Local Authentication: Using the TouchID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231

How Safe Are Fingerprints? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232

Closing Thoughts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232

MOBILE PRIVACY CONCERNS 233

Dangers of Unique Device Identiﬁers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233

Solutions from Apple . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

Rules for Working with Unique Identiﬁers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235

Mobile Safari and the Do Not Track Header . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236

Cookie Acceptance Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

Monitoring Location and Movement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

How Geolocation Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

The Risks of Storing Location Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

Restricting Location Accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239

Requesting Location Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240

Managing Health and Motion Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240

Reading and Writing Data from HealthKit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241

The M7 Motion Processor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242

Requesting Permission to Collect Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243

Proximity Tracking with iBeacons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244

Monitoring for iBeacons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244

Turning an iOS Device into an iBeacon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246

iBeacon Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247

Establishing Privacy Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247

Closing Thoughts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248

INDEX 249

Contents in Detail xvii

Foreword

Even the septuagenarians on the US Supreme Court have recognized

the power of modern mobile computing, setting new legal precedents

with judgements, like Riley v. California quoted above, that recognize that

a smartphone is more than just a device—it is a portal into the private

aspects of everyone’s lives.

Like all technological revolutions, the mobile revolution has its down-

sides. Our ability to connect with the far side of the world does nothing

to improve the way we communicate with those in front of our faces, and

mobile has done nothing to eliminate the world’s long-established economic

disparities. At the same time, as with enterprise computing, personal com-

puting, and networking revolutions, smartphones have introduced new kinds

of potential security ﬂaws, and introduced or reinvented all kinds of secu-

rity and safety issues.

While the proto-smartphones released prior to 2007 brought us several

important technological innovations, it was the subsequent publishing of

rich SDKs and the opening of centralized app stores that turned the new

mobile computers into platforms for third-party innovation. They also

created a wh

ole new generation of developers who now need to adapt the

security lessons of the past to a new, uncertain threat landscape.

In the ten years I have known David Thiel, I have constantly been

impressed by his desire to examine, disassemble, break, and understand

the latest technologies and apply his knowledge to improving the security of

others. David was one of the ﬁrst people to recognize the fascinating secu-

rity challenges and awesome potential of the iPhone, and since the ﬁrst days

of what was then the iPhone OS SDK, he has studied the ways app

develop

ers

could stumble and expose their users to risk, or rise above the limitations of

the platform to build privacy- and safety-enhancing applications.

This book contains the most thorough and thoughtful treatment of iOS

security that you can ﬁnd today. Any iOS developer who cares about their

customers should use it to guide their product, architecture, and engineer-

ing decisions and to learn from the mistakes that David has spent his career

ﬁnding and ﬁxing.

The smartphone revolution has tremendous potential, but only if we

do the utmost to protect the safety, trust, and privacy of the people holding

these devices, who want to enrich their lives through our inventions.

Alex Stamos

Chief Security Ofﬁcer, Facebook

剩余296页未读，继续阅读

DWcsdnNET

粉丝: 414
资源: 651

iOS应用安全：黑客与开发者必读指南

最新资源