Ivan R - Blog

Why embedding secrets in mobile apps is not a good idea

Why embedding secrets in mobile apps is not a good idea

This is a somewhat complicated topic to cover, but I'll try to go into detail on why, generally, this is not a good idea and you should avoid embedding secrets in your mobile applications as much as possible. tl;dr Anyone motivated enough will get these secrets and impersonate your

About Canada's COVID Alert application

About Canada's COVID Alert application

Disclaimer: First of all, I'm not writing on behalf of any entities involved in the development of the COVID Alert application. This is my take as a software engineer with some experience in mobile development [https://www.linkedin.com/in/ivanrodriguezca/]. This post is aimed to people with some questions

OPSEC tips for the general public

OPSEC tips for the general public

It's always a good idea to properly configure your computer and smartphone, know how to securely communicate with others and how to read, write and share content while protecting your personal information. These practices are more relevant than ever. OPSEC stands for operations security [https://en.wikipedia.org/wiki/Operations_

Is the Guatemalan government asking citizens for their location to show them ads?

Is the Guatemalan government asking citizens for their location to show them ads?

On Tuesday March 24th 2020, the president of Guatemala Alejandro Giammattei announced [https://twitter.com/DrGiammattei/status/1242828589524848643] that his government was releasing a mobile application named Alerta Guate [https://apps.apple.com/us/app/alerta-guate/id1472419119]. This application would have 3 main features: * Receive alert notifications: Users would receive

Advice for Targets of Mobile Spyware

Advice for Targets of Mobile Spyware

After publishing a blog post on spouseware [https://ivrodriguez.com/analyzing-ios-stalkerware-apps/], I started receiving many interesting messages about people claiming they were targets of spying attempts. Some of them had doubts about their partners spying on them, some of them worried that advanced attackers targeted them because of their publications

Introducing security.plist

Introducing security.plist

tl;dr It's like security.txt [https://securitytxt.org/] but for iOS applications [https://securityplist.ivrodriguez.com/]. As probably you know by now, I spend a lot of my free time reverse engineering iOS applications. But when I find a vulnerability in one of them, it's a very, very difficult

What checkm8 means for stalkerware on iOS

What checkm8 means for stalkerware on iOS

On Friday, September 27th 2019 many of us on the mobile security community were surprised with the news of a SecureROM [https://www.theiphonewiki.com/wiki/Bootrom] vulnerability disclosed on Twitter [https://twitter.com/axi0mX/status/1177542201670168576] by @axi0mX [https://twitter.com/axi0mX]. axi0mX described it as "a permanent unpatchable

Decrypting iOS applications - iOS 12 Edition

Reverse Engineering

Decrypting iOS applications - iOS 12 Edition

As some of you may know, with the release of iOS 12.4 Apple accidentally reintroduced a vulnerability [https://www.vice.com/en_us/article/qvgp77/hacker-releases-first-public-iphone-jailbreak-in-years] already patched on iOS 12.3 [https://support.apple.com/en-us/HT210118]. Shortly after this discovery, @Pwn20wnd [https://twitter.com/Pwn20wnd] released a

Analyzing iOS Stalkerware Applications

Analyzing iOS Stalkerware Applications

Stalkerware (a.k.a. Spouseware) applications are invasive applications that an individual installs on a target's device (usually their partner) to spy on them, snooping in as much data as they can. They aim to collect phone calls history, private messages, location data, browsing patterns, and many other private aspects

Investigating some subscription scam iOS apps

Reverse Engineering

Investigating some subscription scam iOS apps

For some reason Apple allows "subscription scam" apps on the App Store. These are apps that are free to download and then ask you to subscribe right on launch. It's called the freemium business model [https://developer.apple.com/app-store/freemium-business-model/], except these apps ask you to subscribe for "X"

Created an "age" mobile client

Created an "age" mobile client

A few days ago Filippo Valsorda [https://twitter.com/FiloSottile] twitted about a simple, secure and modern encryption tool that will hopefully substitute gpg [https://gnupg.org/]. Filippo, along with Ben Cox [https://twitter.com/Benjojo12], published a document detailing the output file and key formats as well as some

Mobile App Sec Assemble

Mobile App Sec Assemble

One of the reasons why I write blog posts about mobile app sec is for future me. I don't have a good memory so these posts help me refresh techniques and steps I need to perform to RE mobile applications, and more than once when I've shared one of my

Who's collecting analytics data from mobile apps?

Who's collecting analytics data from mobile apps?

I have the absolute pleasure and honour of being one of the beta testers of the GuardianApp [https://guardianapp.com/]. In an upcoming post I'll be explaining in more detail how it helps protect your privacy. For now, tl;dr: the GuardianApp creates a VPN connection between your device and

Announcing my very own course: "Reverse Engineer iOS Applications" 📱

Announcing my very own course: "Reverse Engineer iOS Applications" 📱

Big news! (or at least for me 😬) I've decided to create my own take on an online course to show beginner and intermediate researchers how to reverse engineer iOS applications. This course is 100% free and open source! Everything that I've accomplished so far in my professional career, since I

How Facebook-Research app works

How Facebook-Research app works

Last night I saw this tweet from Will Strafach [https://twitter.com/chronic]: After reading that article I just needed to reverse this iOS app and see how it worked, this is what I've found so far: Downloading the app: As the article mentions, you can download it from 3rd

Tips for Mobile Bug Bounty Hunting

Tips for Mobile Bug Bounty Hunting

My good friend Pete Yaworski [https://twitter.com/yaworsk] encouraged me to join the bug bounty scene for a long time before I decided to jump in and start using my mobile app sec knowledge to ethically hack on mobile apps from public bug bounty programs. Pete, who literally wrote

Fix SSL Kill Switch2 not showing on Settings

Fix SSL Kill Switch2 not showing on Settings

If you landed on this blog post, it probably means you already know what SSL Kill Switch2 is. Therefore I'm not going to explain what it is, but if you want to read more about it, you can find the details here [https://github.com/nabla-c0d3/ssl-kill-switch2]. If you've jailbroken

Racism and sexism are never funny

Racism and sexism are never funny

My blog is intended to be a hub of knowledge around Technology, Mobile & Web Application Security, Cryptography, Coding and Hacking. However, this is a very different post. This is a post about a toxic culture that I want to leave behind and don't be part of anymore. Honestly, I also

What do Pointer Authentication Codes mean for iOS jailbreaking?

What do Pointer Authentication Codes mean for iOS jailbreaking?

Yesterday, Sep 12th, Apple announced [https://www.youtube.com/watch?v=9m_K2Yg7wGQ] their next generation of iPhones. The iPhone X [s], X [s] Max and X [r] are the new members of the iPhone family and "the most advance iPhones Apple has ever created". You can watch the full

Reverse Engineering iOS Apps - iOS 11 Edition (Part 2)

Reverse Engineering iOS Apps - iOS 11 Edition (Part 2)

This is the second part of the "Reverse Engineering iOS Apps - iOS 11 Edition" series. In the first part of the series [https://ivrodriguez.com/reverse-engineer-ios-apps-ios-11-edition-part1/] we learned how to setup your phone on iOS 11 and how to decrypt an iOS app. In this second and final part

Formatting phone numbers in Swift

Formatting phone numbers in Swift

A simple code snippet to format 10 digit phone numbers in Swift 4.0, instead of including a big library, just implement a delegate function and a formatting function: * The UITextFieldDelegate function func textField(_ textField: UITextField, shouldChangeCharactersIn range: NSRange, replacementString string: String) -> Bool { var fullString = textField.text ?? "" fullString.append(

Saving your Github SSH Keys in a USB Drive

Github provides 2 main options for connecting (cloning, fetching, pulling, pushing) to repositories. HTTPS and SSH: HTTPS: This is the easiest way to clone a repo from Github. It needs no setup, the port 443 (https) is usually open on all networks and when we clone, fetch, pull or push

Reverse Engineering iOS Apps - iOS 11 Edition (Part 1)

Reverse Engineering iOS Apps - iOS 11 Edition (Part 1)

Even though there are already many, many [https://www.google.com/search?q=reverse+engineering+ios+apps] blog posts, tutorials and even youtube videos [https://www.youtube.com/results?search_query=reverse+engineering+ios+apps] about "reverse engineering iOS apps", every time Apple releases a new iOS version the "game"

Proxy iOS 11 applications’ traffic

Proxy iOS 11 applications’ traffic

A big part of understanding how mobile apps work is to identify the endpoints they hit on the server side and the data they send and receive. In order to inspect the mobile app's traffic we'll need to set up a proxy between the app and its server. Most applications

Installing self-signed certificates on Android

Installing self-signed certificates on Android

One of the best trends these days is the shift to encrypted Internet traffic, aka Transport Layer Security or TLS, and mobile apps are not the exception, often when testing a mobile app we need/want to see the data being sent from and received on our mobile devices but