Footnotes
Chapter 1: The IOS Security Model
3. This description is, of course, slightly simplified; there are also sticky bits, setuid bits, and so forth. Since iOS doesn’t use DAC as its primary access control mechanism, though, I won’t get into those topics in this book.
4. You can find a good summary of the default iOS sandbox policies at https://media.blackhat.com/bh-us-11/DaiZovi/BH_US_11_DaiZovi_iOS_Security_WP.pdf
5. It seems, however, that most jailbreak users are motivated by the ability to perform the digital equivalent of putting spinning hubcaps on your car.
7. http://www.cultofmac.com/82097/ibooks-1-2-1-tries-to-run-jailbreak-code-to-detect-jailbroken-iphones/
11. http://arstechnica.com/apple/2011/11/safari-charlie-discovers-security-flaw-in-ios-gets-booted-from-dev-program/
Chapter 2: Objective-C for the Lazy
1. http://developer.apple.com/library/mac/#releasenotes/ObjectiveC/RN-TransitioningToARC/Introduction/Introduction.html
2. https://developer.apple.com/library/mac/documentation/Cocoa/Reference/Foundation/Protocols/NSCoding_Protocol/Reference/Reference.html
Chapter 3: IOS Application Anatomy
2. Erica Utilities has a number of other useful tools for working with jailbroken devices; you can check out the list at http://ericasadun.com/ftp/EricaUtilities/.
3. https://developer.apple.com/library/Mac/documentation/Cocoa/Reference/Foundation/Classes/NSBundle_Class/Reference/Reference.html
4. Note that not all directories that can exist in this directory tree will exist for every application; some are created on the fly only when certain APIs are used by the app.
5. http://developer.apple.com/library/ios/#documentation/FileManagement/Conceptual/DocumentInteraction_TopicsForIOS
6. http://developer.apple.com/library/ios/documentation/iPhone/Conceptual/iPhoneOSProgrammingGuide/iPhoneAppProgrammingGuide.pdf (page 69)
Chapter 4: Building Your Test Platform
2. I generally consider Chrome a more secure daily browser, but the self-contained nature of Firefox does let you tweak proxy settings more conveniently.
Chapter 5: Debugging with lldb and Friends
2. For a detailed resource on debugging in Xcode, I recommend iOS 7 Programming: Pushing the Limits; see http://iosptl.com/.
3. If you’d like further insight into assembly on iOS and ARM, check out Ray Wenderlich’s tutorial at http://www.raywenderlich.com/37181/ios-assembly-tutorial/.
Chapter 6: Black-Box Testing
4. Traditionally, this has been done with the GNU Debugger, gdb. However, gdb hasn’t been included with Xcode since version 4, and most versions in Cydia are broken. This method of using lldb should work for the foreseeable future ... I think.
5. https://developer.apple.com/library/mac/#documentation/DeveloperTools/Conceptual/MachORuntime/Reference/reference.html
6. Unless you disable PIE. You can do this with the removePIE tool; see https://github.com/peterfillmore/removePIE/.
8. This is how it appears in xxd(1), which is what I usually use for quick-and-dirty editing. Your editor may vary. If in doubt, check with MachOView first and then develop whatever scripts you may require.
Chapter 7: IOS Networking
2. https://developer.apple.com/library/mac/#documentation/Foundation/Reference/NSURLConnectionDelegate_Protocol
3. https://developer.apple.com/library/ios/#documentation/cocoa/conceptual/URLLoadingSystem/Articles/RequestChanges.html
4. https://developer.apple.com/library/ios/#documentation/Foundation/Reference/NSURLConnectionDataDelegate_protocol/Reference/Reference.html#//apple_ref/occ/intfm/NSURLConnectionDataDelegate/connection:willSendRequest:redirectResponse:
6. https://docs.google.com/presentation/d/11eBmGiHbYcHR9gL5nDyZChu_-lCa2GizeuOfaLU2HOU/edit?pli=1#slide=id.g1d134dff_1_222
9. https://developer.apple.com/library/prerelease/ios/documentation/MultipeerConnectivity/Reference/MultipeerConnectivityFramework/index.html
12. https://developer.apple.com/library/mac/#documentation/CoreFoundation/Reference/CFSocketStreamRef/Reference/reference.html
Chapter 8: Interprocess Communication
1. https://developer.apple.com/library/mac/documentation/Cocoa/Reference/Foundation/Classes/NSURL_Class/index.html#//apple_ref/doc/uid/20000301-SW21
2. http://developer.apple.com/library/ios/documentation/iPhone/Conceptual/iPhoneOSProgrammingGuide/iPhoneAppProgrammingGuide.pdf (page 99)
Chapter 9: IOS-Targeted Web Apps
2. http://developer.apple.com/library/ios/documentation/uikit/reference/UIWebViewDelegate_Protocol/Reference/Reference.html
Chapter 10: Data Leakage
1. https://developer.apple.com/library/ios/#documentation/System/Conceptual/ManPages_iPhoneOS/man3/asl.3.html
4. https://developer.apple.com/library/mac/documentation/Cocoa/Reference/WebKit/Classes/WebArchive_Class/Reference/Reference.html
5. http://developer.apple.com/library/ios/#documentation/uikit/reference/UIResponder_Class/Reference/Reference.html
6. https://developer.apple.com/library/ios/documentation/cocoa/reference/foundation/Classes/NSURLCache_Class/Reference/Reference.html#//apple_ref/occ/instm/NSURLCache/setDiskCapacity:
7. https://developer.apple.com/library/ios/documentation/Cocoa/Conceptual/URLLoadingSystem/Concepts/CachePolicies.html#//apple_ref/doc/uid/20001843-BAJEAIEE
8. It’s rather out of character for me to not file bugs, but Apple’s bug tracker, RADAR, is so breathtakingly, insultingly useless that no reasonable person should have to use it. Instead, I recommend visiting http://fixradarorgtfo.com/ and filing this single RADAR bug: “Fix Radar or GTFO (duplicate of rdar://10993759).”
9. http://developer.apple.com/library/ios/#documentation/uikit/reference/UITextInputTraits_Protocol/Reference/UITextInputTraits.html
10. The en prefix will be different for different locales, but this is what it is for an English-speaking device.
12. For more details on the circumstances under which these events are triggered, visit http://www.cocoanetics.com/2010/07/understanding-ios-4-backgrounding-and-delegate-messaging/.
13. http://developer.apple.com/library/ios/#documentation/UIKit/Reference/UIView_Class/UIView/UIView.html#//apple_ref/occ/instp/UIView/alpha
14. Check out a good example of creating a Storyboard application with state preservation at http://www.techotopia.com/index.php/An_iOS_6_iPhone_State_Preservation_and_Restoration_Tutorial.
15. Using CCCrypt or, ideally, RNCryptor: https://github.com/rnapier/RNCryptor
16. Available at https://github.com/iSECPartners/SecureNSCoder
17. http://developer.apple.com/library/ios/documentation/iPhone/Conceptual/iPhoneOSProgrammingGuide/iPhoneAppProgrammingGuide.pdf (page 112)
Chapter 11: Legacy Issues and Baggage from C
1. The term format string attack was popularized by Tim Newsham’s paper of the same name; see http://www.thenewsh.com/~newsham/format-string-attacks.pdf.
2. Yes, %n works. Xcode might complain about it, but manual builds, such as those performed with the xcodebuild command line utility, work fine.
3. You can find more details on exploiting format strings to gain code execution in Scut’s paper on the topic; see https://crypto.stanford.edu/cs155/papers/formatstring-1.2.pdf.
4. Todd C. Miller, maintainer of sudo, discusses the merits of these functions further at http://www.sudo.ws/todd/papers/strlcpy.html.
5. https://developer.apple.com/library/ios/documentation/Security/Conceptual/SecureCodingGuide/Articles/BufferOverflows.html
Chapter 12: Injection Attacks
2. You can download Google Toolbox for Mac at https://code.google.com/p/google-toolbox-for-mac/.
Chapter 13: Encryption and Authentication
6. iOS generates the file public and file private keys using D. J. Bernstein’s Curve25519, an Elliptic Curve Diffie-Hellman algorithm (http://cr.yp.to/ecdh.html).
7. Please disregard this if you are in fact a cryptographer.
8. I see this all the time. No one should ever switch from a secure default to ECB mode, but I still come across this problem every month or two.
Chapter 14: Mobile Privacy Concerns
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.