Your SlideShare is downloading. ×
0
eXtend Security on Xcode
Vol.01 Mar/26/2014
Tokuji Akamine
Raymund Pedraita
DU, Rakuten, Inc.
http://www.rakuten.co.jp/
About Us
• Who we are
– Tokuji Akamine @tokujia
• Lead Security Engineer, Rakuten Inc.
– Raymund Dante Pedraita (redwud)
•...
Statistics : iOS Apps
• More than 1 million apps on the AppStore
• Users spent $ 10 billion for paid apps
• 3 billion apps...
Statistics : iOS Apps
• According to the IOActive’s research, many
banking apps have security issues
– 40% of the audited ...
So, what can we use?
• Security Awareness and Education
– OWASP Top 10 Mobile Risks
– iGoat, DVIA
• Secure Development
– O...
Security Testing Tools
for iOS Apps
• Free Tools
– Dynamic Analysis Tools, Pen-testing frameworks:
iAuditor, iNalyzer, sno...
Motivations
• No free security source code analysis tools
• A lot of manual work for security testing
• Can't fully depend...
Xcode Plug-in
• We extend security on Xcode with our plug-in
– Centralize developer-friendly security features on the
IDE
...
Intro of Xcode plug-in
development
• Choose “Bundle” as a template and “Cocoa” as
a Framework
• Configure build settings
(...
Xcode plug-in development
continues …
• Internal Frameworks
– IDEKit, IDEFoundation
/Applications/Xcode.app/Contents/Frame...
Xcode plug-in development
continues …
• Obtain internal class information with class-
dump to look for useful Class, Metho...
Available Xcode Plug-ins
• XVim
• Injection
• BBUncrustifyPlugin
• Xcode Fixins
• XcodeColors
• OMColorSense
• KSImageName...
XSecurity
• XSecurity
– Quick Security Help with built-in Security Guidelines
– Real-time Vulnerability Notifications
– St...
Feature 1: Quick Security Help
• Quick Help
– Display concise reference documentation without
taking focus away from the f...
Feature 1: Quick Security Help
• Quick Security Help
– Add security guidelines in reference documentation.
– Added to both...
Feature 1: Quick Security Help
Quick Help Window
Quick Help Inspector
Feature 2: Real-time
Vulnerability Notifications
• Real-time Vulnerability Notifications
– Show the vulnerability as it is...
Feature 2: Real-time
Vulnerability Notifications
• Detection Triggers
– When the source is modified.
– When switching betw...
Feature 2: Real-time
Vulnerability Notifications
Feature 3: Clang Static
Security Analyzer
• Clang
– A compiler front-end for C family languages
– It uses LLVM as its back...
Feature 3: Clang Static
Security Analyzer
• Clang Static Analyzer
– A source code analysis tool that can find bugs in C,
C...
Feature 3: Clang Static
Security Analyzer
• It boils down to checkers
– Static analyzer engine can do path-sensitive
explo...
Feature 3: Clang Static
Security Analyzer
• Analyzer in action
Feature 3: Clang Static
Security Analyzer
• CI with Security Checkers
Detectable Vulnerabilities
Category Vulnerability Real-time Checker
Insecure Data
Storage
Insecure Keychain Storage ● ●
In...
XSecurity Project
• XSecurity Project
https://github.com/XSecurity/
@prj_xsecurity
Future Plans
• We aim to…
– Make configurations flexible or customizable guideline
in Quick Security Help
– Have an option...
Next vulnerabilities
Category Vulnerability
Insufficient Transport Layer Security Data Transport Over Unencrypted Channel
...
Questions?
Thank you
References
• References
– OWASP Mobile Security Project
– Mac Developer Library
– The LLVM project
– OCLint
– Clang Scan-B...
Upcoming SlideShare
Loading in...5
×

eXtend Security on Xcode

2,141

Published on

In order to assist developers to develop a secure iOS app in a rapid development process, we propose our own security features implemented on top of Xcode IDE. "The mobile industry is now booming. According to Apple, the number of iOS apps in App Store reached to 900,000 as of June 2013. In this highly competitive market, mobile app developers are required to develop a high-value, high-quality and high-performance app and with a short time-to-market. Implementing security into earlier phases of such rapid pace agile development life cycle can be considered as one of the key success factors for organizations.
We believe that by adding an automated security measure into Xcode IDE itself is essential and can help facilitate secure agile development cycles for iOS developers. Therefore, we are implementing our own security features on top of Xcode. During coding phase, the developers will be able to automatically spot general security issues of iOS apps and thus prevent them from creating those issues. This can also help security testers to conduct white-box security testing in a shorter amount of time. We will also share difficulties and problems we faced and how we overcome them during our research.

迅速な開発プロセスにおいてセキュアなiOSアプリを開発するデベロッパーを支援するために、XcodeのIDE上にセキュリティ機能を実装することを提案する。モバイル業界は急成長している。Appleによると、2013年6月の時点でAppStoreにあるiOSアプリは90万を超えた。この急激な競争市場において、モバイル・アプリ開発者は短納期でありながら、価値があり、質が高く、ハイパフォーマンスなアプリの開発が求められている。企業の成功要因の一つとして、このような急ピッチなアジャイル開発ライフサイクルにおいてセキュリティ機能を開発初期に実装することは重要と考えられる。
Xcode自体に自動化されたセキュリティ対策機能は必要不可欠であり、機能追加することによって、iOS開発者は安全なアジャイル開発サイクルを促進できると考えている。そこで、Xcode上にセキュリティ機能を実装した。コーディング中には、開発者はiOSの一般的なセキュリティ問題に自然に気が付き、問題を避けたアプリ開発を可能にする。セキュリティテスターにとっては、短期間で行われるホワイトボックスのセキュリティテストを手助けしてくれる。これまで直面した問題と問題に対してどのようにして乗り越えかを本発表で共有する。


OWASP AppSec APAC 2014にて3/20に発表。
http://appsecapac.org/2014/

発表者:
Tokuji Akamine (赤嶺 徳治)
Raymund Pedraita

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
2,141
On Slideshare
0
From Embeds
0
Number of Embeds
18
Actions
Shares
0
Downloads
12
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Transcript of "eXtend Security on Xcode"

  1. 1. eXtend Security on Xcode Vol.01 Mar/26/2014 Tokuji Akamine Raymund Pedraita DU, Rakuten, Inc. http://www.rakuten.co.jp/
  2. 2. About Us • Who we are – Tokuji Akamine @tokujia • Lead Security Engineer, Rakuten Inc. – Raymund Dante Pedraita (redwud) • Senior Security Engineer, Rakuten Inc.
  3. 3. Statistics : iOS Apps • More than 1 million apps on the AppStore • Users spent $ 10 billion for paid apps • 3 billion apps were downloaded • Almost half of all smartphone owners were concerned about privacy • 90% of iOS mobile apps show security vulnerabilities References: http://www.apple.com/pr/library/2014/01/07App-Store-Sales-Top-10-Billion-in-2013.html http://www.mobilesecurity.com/articles/656-smartphone-users-reveal-mobile-privacy-fears http://www.zdnet.com/hp-research-finds-vulnerabilities-in-9-of-10-mobile-apps- 7000023324/
  4. 4. Statistics : iOS Apps • According to the IOActive’s research, many banking apps have security issues – 40% of the audited apps did not validate the authenticity of SSL certificates presented. – Many of the apps (90%) contained several non-SSL links – 50% of the apps are vulnerable to JavaScript injections via insecure UIWebView implementations. Reference: http://blog.ioactive.com/2014/01/personal-banking-apps-leak-info-through.html
  5. 5. So, what can we use? • Security Awareness and Education – OWASP Top 10 Mobile Risks – iGoat, DVIA • Secure Development – OWASP Top 10 Mobile Controls – iOS Developer Cheat Sheet – iMAS • Security Testing – iOS Application Security Testing Cheat Sheet – Anything else? Reference: OWASP Mobile Security Project
  6. 6. Security Testing Tools for iOS Apps • Free Tools – Dynamic Analysis Tools, Pen-testing frameworks: iAuditor, iNalyzer, snoop-it, Introspy-iOS • Commercial Tools – Static Security Analysis Tools & Service: Veracode, Cxsuite, Fortify, AppScan Source and maybe more …
  7. 7. Motivations • No free security source code analysis tools • A lot of manual work for security testing • Can't fully depend on grep and scripts. • Security coding guideline doesn’t work well by itself • Introduce an early detection tool
  8. 8. Xcode Plug-in • We extend security on Xcode with our plug-in – Centralize developer-friendly security features on the IDE – Provide a solution to avoid making vulnerabilities – Detect vulnerabilities at earlier phases of development – Cut down the cost of manual security testing
  9. 9. Intro of Xcode plug-in development • Choose “Bundle” as a template and “Cocoa” as a Framework • Configure build settings (XCGCReady, XCPluginHasUI, XC4Compatible, Deployment Location, Wrapper Extension, etc.) • Create a Class • Build • Relaunch Xcode
  10. 10. Xcode plug-in development continues … • Internal Frameworks – IDEKit, IDEFoundation /Applications/Xcode.app/Contents/Frameworks/ – DVTKit, DVTFoundation /Applications/Xcode.app/Contents/SharedFrameworks/ – IDESourceEditor, IDEQuickHelp, Xcode3UI, etc. /Applications/Xcode.app/Contents/PlugIns/ – DevToolsCore, etc. /Applications/Xcode.app/Contents/OtherFrameworks/ – WebKit, etc. /Applications/Xcode.app/Developer/Platforms/MacOSX.platform/D eveloper/SDKs/MacOSX[ver].sdk/System/Library/Frameworks/
  11. 11. Xcode plug-in development continues … • Obtain internal class information with class- dump to look for useful Class, Methods, Properties @interface IDESourceCodeEditor : IDEEditor <NSTextViewDelegate, NSMenuDelegate, NSPopoverDelegate, …> … + (id)keyPathsForValuesAffectingIsWorkspaceBuilding; + (void)revertStateWithDictionary:(id)arg1 withSourceTextView:(id)arg2 withEditorDocument:(id)arg3; + (void)commitStateToDictionary:(id)arg1 withSourceTextView:(id)arg2; + (long long)version; + (void)configureStateSavingObjectPersistenceByName:(id)arg1; @property(retain) IDESingleFileProcessingToolbarController *singleFileProcessingToolbarController; // … @property(retain) IDEAnalyzerResultsExplorer *analyzerResultsExplorer; // … @property(retain, nonatomic) DVTSourceExpression *mouseOverExpression; // … @property(retain) IDESourceCodeEditorContainerView *containerView; // … @property(retain) DVTSourceTextView *textView; // … …
  12. 12. Available Xcode Plug-ins • XVim • Injection • BBUncrustifyPlugin • Xcode Fixins • XcodeColors • OMColorSense • KSImageNamed-Xcode • XcodeExplorer etc.
  13. 13. XSecurity • XSecurity – Quick Security Help with built-in Security Guidelines – Real-time Vulnerability Notifications – Static Analysis with Clang Static Analyzer
  14. 14. Feature 1: Quick Security Help • Quick Help – Display concise reference documentation without taking focus away from the file you’re editing.
  15. 15. Feature 1: Quick Security Help • Quick Security Help – Add security guidelines in reference documentation. – Added to both Quick Help Inspector and the Quick Help Window – Can automatically display and hide the inspector area.
  16. 16. Feature 1: Quick Security Help Quick Help Window Quick Help Inspector
  17. 17. Feature 2: Real-time Vulnerability Notifications • Real-time Vulnerability Notifications – Show the vulnerability as it is being created. – Instant bug know-how to developers. – Early prevention.
  18. 18. Feature 2: Real-time Vulnerability Notifications • Detection Triggers – When the source is modified. – When switching between source files. • Methodology – Research parts of Xcode, how it works. – Categorize vulnerabilities according to characteristics. – Heavy use of RegEx
  19. 19. Feature 2: Real-time Vulnerability Notifications
  20. 20. Feature 3: Clang Static Security Analyzer • Clang – A compiler front-end for C family languages – It uses LLVM as its back end – Creates an abstract syntax tree (AST) of the code – LLVM Community (Mainly professionals from Apple, Google, ARM, Intel, etc.)
  21. 21. Feature 3: Clang Static Security Analyzer • Clang Static Analyzer – A source code analysis tool that can find bugs in C, C++ and Objective-C programs. – Can run from CLI and within Xcode – 100% open source and part of Clang project • Alternative static code analysis tool: OCLint
  22. 22. Feature 3: Clang Static Security Analyzer • It boils down to checkers – Static analyzer engine can do path-sensitive exploration of the program. – Checkers implement the logic for bug detection – And, construct bug reports. – Well-documented http://clang-analyzer.llvm.org/checker_dev_manual.html
  23. 23. Feature 3: Clang Static Security Analyzer • Analyzer in action
  24. 24. Feature 3: Clang Static Security Analyzer • CI with Security Checkers
  25. 25. Detectable Vulnerabilities Category Vulnerability Real-time Checker Insecure Data Storage Insecure Keychain Storage ● ● Insecure NSUserDefaults Usage ● ● Unencrypted Data in plist File ● Insecure Permanent Credential Storage ● ● Insufficient Transport Layer Security Ignores Certificate Validation Errors ● ● Security Decisions Via Untrusted Inputs Abusing URL Schemes ● ● Side Channel Data Leakage Leaking Web Caches ● Leaking Logs ● ● Leaking Pasteboard ● Client Side Injection SQL Injection (SQLite) ●
  26. 26. XSecurity Project • XSecurity Project https://github.com/XSecurity/ @prj_xsecurity
  27. 27. Future Plans • We aim to… – Make configurations flexible or customizable guideline in Quick Security Help – Have an option to select rules – Improve reporting functionalities – Develop more rules for real-time vulnerability notifications and checkers
  28. 28. Next vulnerabilities Category Vulnerability Insufficient Transport Layer Security Data Transport Over Unencrypted Channel Query String for Sensitive Data Certificate Unpinning Sensitive Information Disclosure Hard Coded Sensitive Information Query String for Sensitive Data Broken Cryptography Use Vulnerable Encryption Algorithms Poor Authorization & Authentication Invalid Usage of Persistent Identifier Insecure OAuth implementation Client Side Injection Cross Site Scripting
  29. 29. Questions?
  30. 30. Thank you
  31. 31. References • References – OWASP Mobile Security Project – Mac Developer Library – The LLVM project – OCLint – Clang Scan-Build Jenkins Plugin
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×