iOS程序的逆向与安全.pdf

iOS App Security 唐巧 About Me • iOS Developer (有道云笔记，粉笔⺴，猿题库） • InfoQ中⽂站兼职编辑 • iOS Blogger: (70+posts) • “iOSDevTips”微信公众账号创建者
 (5000+ fans, 150+ posts) Why security? Agenda • ⾏业与现状 • iOS Security • Network Security • Local File/Data Security • Code Security • Resources ⾏业与现状 • 传统互联⺴ • ⼤公司有专⻔的安全部⻔ • 汉庭，如家酒店2000万⽤户数据库泄漏 • struts 2漏洞 • 苹果iTunesConnect⺴站多次重置开发者密码 • 移动互联⺴ • 信息较少 Network Security Network Security - Charles Network Security - Charles Network Security - Charles Network Security - Charles Network Security - Charles Network Security - Charles • 分析协议，测试协议，找安全漏洞 • 伪装请求，欺骗服务器 • 截取密码和Cookie • 《iOS开发⼯具—— ⺴络封包分析⼯具 Charles 》12-09 on InfoQ Network Security - IAP • IAP Story /blog/2013/04/07/tricks-in-iap/ Network Security • How to defend? • encode password • binary protocol Local File/Data Security • unzip ipa Local File/Data Security Local File/Data Security Local File/Data Security Local File/Data Security Local File/Data Security Local File/Data Security Local File/Data Security 分析⽀付宝客户端的插件机制
 /blog/2013/06/23/alipay-plugin-mechanism/ Local File/Data Security • How to defend? • encode • checksum • keychain Code Security • file Code Security • otool Code Security • theos Code Security • IDA Code Security Code Security • How to defend against IDA? • Macro • pure C library Summary iOS Security need attention!