Ekoparty #UniTalks 2020 | Juan Urbano Stordeur: iOS App Analysis, ¿por dónde empiezo?

### Overview In this Ekoparty #UniTalks 2020 presentation, speaker Juan Urbano Stordeur delivers an introductory guide on getting started with iOS mobile application security analysis. Addressing common hurdles faced by researchers who primarily focus on Android or bug bounties, the talk covers essential hardware and software prerequisites, jailbreaking workflows, app deployment techniques, decryption methods, binary reverse engineering, local data inspection, and HTTP/HTTPS traffic interception.

### Key Topics - **Initial Requirements**: Analyzing iOS applications generally requires a physical iPhone running a jailbreakable iOS version, as well as a macOS computer to run Xcode and generate necessary provisioning profiles. - **Jailbreaking Methods and Stability**: The talk outlines tethered vs. untethered styles of jailbreaks, referencing tools like Checkra1n (noted for high stability on supported firmware/devices) and unc0ver, alongside helper utilities like Cydia Impactor and iOS-App-Signer/Apple Sign. - **Application Installation Techniques**: Multiple approaches exist for installing target applications, including using impactor/signing tools, Xcode with mobile provisioning profiles, or manual installation via SSH (extracting IPAs, copying payload folders, setting execution permissions, and refreshing SpringBoard with `uicache`). - **Dynamic Instrumentation and Decryption**: Apps fetched directly from the App Store or TestFlight are encrypted. Frida (via `frida-tools` and Cydia packages) is highlighted for dynamic instrumentation, identifying running process IDs/bundle identifiers, and dumping decrypted binaries. - **Binary Analysis and Inspection**: Comparing encrypted vs. decrypted applications using tools such as Hopper Disassembler and Radare2 (R2) allows analysts to examine strings, classes, and methods, or disassemble functions. - **Local Data Extraction and Traffic Interception**: Analysts inspect app containers and plists via SSH/SCP and intercept network communications by configuring an HTTP proxy (Burp Suite) and trusting custom CA profiles installed on the jailbroken device.

### Technical Details - **Device Communication**: Setting up communication with the device uses libraries like `libimobiledevice` (and tools like `ideviceinfo`, `ideviceinstaller`) or local SSH tunnels over USB via `iproxy` to port 22 (avoiding Wi-Fi dependencies and using default credentials like `alpine`). - **App Decryption & Repackaging**: Once an application runs, Frida scripts dump decrypted Mach-O binaries. Researchers reconstruct an `.ipa` file by assembling a `Payload/` folder, archiving it into a `.zip`, renaming it to `.ipa`, and pulling it down over SCP. - **Static Analysis with Radare2 & Hopper**: Inside Radare2 (`r2`), commands are used to check encryption flags (such as the `cryptid` flag), search for strings, list classes and methods, or jump into visual mode to inspect application logic. - **Network Interception**: Setting up Burp Suite involves binding a proxy listener to port 8080 on the host IP, configuring the iOS device's Wi-Fi HTTP proxy settings, downloading the PortSwigger CA certificate via `http://burp`, and trusting the downloaded configuration profile under iOS Settings to enable SSL interception.

### Takeaways Setting up an effective iOS assessment environment fundamentally depends on obtaining a jailbroken device and decrypting the binary at runtime. Combining dynamic instrumentation tools like Frida with static disassembly tools (Hopper, Radare2) and proxy setups provides the foundation needed to inspect internal application data, bypass security controls like SSL pinning, and analyze iOS app internals.