iOS Security Data protection January 17, Tokyo iOS Meetup What is? - - PowerPoint PPT Presentation
iOS Security Data protection January 17, Tokyo iOS Meetup What is? It is a feature to protect data at rest and to make offline attacks difficult. iOS 4 DATA PROTECTION 101
January 17, Tokyo iOS Meetup
It is a feature to protect data “at rest” and to make offline attacks difficult.
iOS 4 DATA PROTECTION 101
https://media.blackhat.com/bh-us-11/Belenko/BH_US_11_Belenko_iOS_Forensics_WP.pdf
iOS Security October 2014
https://www.apple.com/privacy/docs/iOS_Security_Guide_Oct_2014.pdf
Class keys Are encryption keys used to encrypt files and keychains elements depending on their protection class.
Hacking and Securing iOS Applications Stealing Data, Hijacking Software, and How to Prevent It By Jonathan Zdziarski
NSFileProtectionComplete
NSFileProtectionComplete The class key is protected with a key derived from the user passcode and the device UID. Shortly after the device is locked, the decrypted class key is discarded, rendering all data in this class inaccessible until the device is unlocked.
NSFileProtectionComplete The class key is protected with a key derived from the user passcode and the device UID. Shortly after the device is locked, the decrypted class key is discarded, rendering all data in this class inaccessible until the device is unlocked.
An AES 256-bit key fused into the application processor during manufacturing. Is unique to each device and is not recorded by Apple or any of its suppliers.
NSFileProtectionCompleteUnlessOpen
NSFileProtectionCompleteUnlessOpen The per-file key is accessible while it is open, as soon as the file is closed, the per-file key is discarded.
NSFileProtectionCompleteUnlessOpen The per-file key is accessible while it is open, as soon as the file is closed, the per-file key is discarded. Used to write files while the device is locked, e.g., downloading a file in the background.
NSFileProtectionCompleteUnlessOpen The per-file key is accessible while it is open, as soon as the file is closed, the per-file key is discarded. Used to write files while the device is locked, e.g., downloading a file in the background. Uses ECDH.
NSFileProtectionCompleteUnlessOpen The per-file key is accessible while it is open, as soon as the file is closed, the per-file key is discarded. Used to write files while the device is locked, e.g., downloading a file in the background. Uses ECDH.
Why?
NSFileProtectionCompleteUnlessOpen The per-file key is accessible while it is open, as soon as the file is closed, the per-file key is discarded. Used to write files while the device is locked, e.g., downloading a file in the background. Uses ECDH.
Why? Higher security (more security per bit) Less resources
NSFileProtectionCompleteUntilFirstUserAuthentication
NSFileProtectionCompleteUntilFirstUserAuthentication Same as NSFileProtectionComplete but the key remains in memory after the device has been locked.
NSFileProtectionNone The class key is protected only with the UID.
Flexibility and performance
Flexibility and performance
Flexibility and performance
encrypt (file, perFileKey)
AES engine
File File
encryptedperFilekey
encrypt (file, perFileKey)
AES engine
File File
encryptedClass key
encrypt (file, perFileKey)
AES engine
File File
encryptedMetadata Class key
encrypt (file, perFileKey)
AES engine
File File
encryptedFile
encrypted
Metadata Class key
File
encrypted
Metadata
Class key
File
encrypted
Metadata
Class key
System key
File
encrypted
Metadata
Class key
System key Metadata Class key
File
encrypted
Metadata
Class key
System key Metadata Class key decrypt (file, perFileKey)
AES engine
File
encrypted
Metadata
Class key
System key Metadata Class key decrypt (file, perFileKey)
AES engine
File
The keychain is implemented as a SQLite database stored on the file system.
The keychain is implemented as a SQLite database stored on the file system. There is only one database; the security daemon determines which keychain items each process or app can access.
The default is kSecAttrAccessibleAfterFirstUnlock .
The default is kSecAttrAccessibleAfterFirstUnlock . I recommend using kSecAttrAccessibleWhenUnlocked as default and
need in the background.
NSMutableDictionary *attributes = [[NSMutableDictionary alloc] init]; //... [attributes setObject:(__bridge id)kSecAttrAccessibleWhenUnlocked forKey:(__bridge id)kSecAttrAccessible];
Install the Gmail app.
Install the Gmail app. Read some emails.
Install the Gmail app. Read some emails. Lock the device (non-jailbroken).
Install the Gmail app. Read some emails. Lock the device (non-jailbroken). Browse the device (iFunBox, Xcode).
project.pbxproj 9C201A441827FB6F60CC6872 = { DevelopmentTeam = 9XFDAR3CTM; SystemCapabilities = { com.apple.DataProtection = { enabled = 1; }; }; };
and How to Prevent it http://www.amazon.co.jp/Hacking-Securing-iOS-Applications-Hijacking/dp/1449318746/ref=sr_1_1?
ie=UTF8&qid=1420987300&sr=8-1&tag=tabisty-22&keywords=Hacking+and+Securing+iOS+Applications+Stealing+Data%2C+Hijacking+Software% 2C+and+How+to+Prevent+It
http://blog.cloudflare.com/a-relatively-easy-to-understand-primer-on-elliptic-curve-cryptography/