Privacy What checkm8 means for stalkerware on iOS On Friday, September 27th 2019 many of us on the mobile security community were surprised with the news of a SecureROM vulnerability disclosed on Twitter by @axi0mX. axi0mX described it as "a permanent
Reverse Engineering Decrypting iOS applications - iOS 12 Edition As some of you may know, with the release of iOS 12.4 Apple accidentally reintroduced a vulnerability already patched on iOS 12.3. Shortly after this discovery, @Pwn20wnd released a new version
Privacy Analyzing iOS Stalkerware Applications Stalkerware (a.k.a. Spouseware) applications are invasive applications that an individual installs on a target's device (usually their partner) to spy on them, snooping in as much data as they can. They
Reverse Engineering Investigating some subscription scam iOS apps For some reason Apple allows "subscription scam" apps on the App Store. These are apps that are free to download and then ask you to subscribe right on launch. It's called the freemium
Cryptography Created an "age" mobile client A few days ago Filippo Valsorda twitted about a simple, secure and modern encryption tool that will hopefully substitute gpg. Filippo, along with Ben Cox, published a document detailing the output file and
Android Mobile App Sec Assemble One of the reasons why I write blog posts about mobile app sec is for future me. I don't have a good memory so these posts help me refresh techniques and steps I
Mobile Who's collecting analytics data from mobile apps? I have the absolute pleasure and honour of being one of the beta testers of the GuardianApp. In an upcoming post I'll be explaining in more detail how it helps protect your privacy.
iOS Announcing my very own course: "Reverse Engineer iOS Applications" š± Big news! (or at least for me š¬) I've decided to create my own take on an online course to show beginner and intermediate researchers how to reverse engineer iOS applications. This course is
How Facebook-Research app works Last night I saw this tweet from Will Strafach: After reading that article I just needed to reverse this iOS app and see how it worked, this is what I've found so far:
iOS Tips for Mobile Bug Bounty Hunting My good friend Pete Yaworski encouraged me to join the bug bounty scene for a long time before I decided to jump in and start using my mobile app sec knowledge to ethically
Fix SSL Kill Switch2 not showing on Settings If you landed on this blog post, it probably means you already know what SSL Kill Switch2 is. Therefore I'm not going to explain what it is, but if you want to read
Racism and sexism are never funny My blog is intended to be a hub of knowledge around Technology, Mobile & Web Application Security, Cryptography, Coding and Hacking. However, this is a very different post. This is a post about
iOS What do Pointer Authentication Codes mean for iOS jailbreaking? Yesterday, Ā Sep 12th, Ā Apple announced their next generation of iPhones. The iPhone X [s], X [s] Max and X [r] are the new members of the iPhone family and "the most advance iPhones
iOS Reverse Engineering iOS Apps - iOS 11 Edition (Part 2) This is the second part of the "Reverse Engineering iOS Apps - iOS 11 Edition" series. In the first part of the series we learned how to setup your phone on iOS 11
Development Formatting phone numbers in Swift A simple code snippet to format 10 digit phone numbers in Swift 4.0, instead of including a big library, just implement a delegate function and a formatting function: The UITextFieldDelegate function func
Saving your Github SSH Keys in a USB Drive Github provides 2 main options for connecting (cloning, fetching, pulling, pushing) to repositories. HTTPS and SSH: HTTPS: This is the easiest way to clone a repo from Github. It needs no setup, the
iOS Reverse Engineering iOS Apps - iOS 11 Edition (Part 1) Even though there are already many, many blog posts, tutorials and even youtube videos about "reverse engineering iOS apps", every time Apple releases a new iOS version the "game"
iOS Proxy iOS 11 applicationsā traffic A big part of understanding how mobile apps work is to identify the endpoints they hit on the server side and the data they send and receive. In order to inspect the mobile
Android Installing self-signed certificates on Android One of the best trends these days is the shift to encrypted Internet traffic, aka Transport Layer Security or TLS, and mobile apps are not the exception, often when testing a mobile app
iOS Fix Cydia Impactor crypto-osx.cpp:97 error If you upgraded to macOS Hight Sierra 10.13.x changes are Cydia Impactor is giving you this error when trying to install an app: The text reads: crypto-osx.cpp:97 The user
Jailbreaking Installing Dropbear SSH on iOS 10.3.3 In December last year, @thimstar and @S1guza released H3lix a semi-untether jailbreak for all 32-bit devices on iOS 10.0 to 10.3.3. This is amazing, it means devices like the iPhone
CTF Reversing one thousand binaries This past week (Nov 3rd) I attended the Hackfest CTF in Quebec city, QC. This was my second CTF and was the fist time I ever found a flag. This is how I
Cryptography The most innovative āthingā Iāve done (so far) The context Iām a software engineer and really enjoy using technology, but I love using technology to solve problems and make peopleās lives better. For the last six years of my
