iOS and Android security: Differences you need to knowNowSecure
NowSecure Director of Research David Weistein recently spoke at the Security by Design Meetup in Washington, DC. This presentation offers information about risks impacting mobile and the differences between iOS and Android security.
Recap here: https://www.nowsecure.com/blog/2016/08/24/android-buckles-down-and-ios-opens-up-trends-in-platform-security-affecting-developers/
Talk delivered by Chema Alonso at RootedCON Satellite (Saturday 12th of September 2015) about how to do hacking & pentesting using dorks over Tacyt, a Big Data of Android Apps
La labor de gestionar la seguridad de una empresa suele ser como bailar sobre el alambre. Hay que permitir que el negocio siga funcionando, estar a la última, proteger lo ya implantado e innovar en cosas nuevas. Eso sí, de forma más eficiente cada año y con menos presupuesto. Todo ello, con el objetivo de no que no pase nada. La conclusión de esto es que al final siempre queda Long Hanging Fruit para que cualquiera se aproveche.
The Road To Defendable Systems - Emirates NBDSaumil Shah
"Attack is a technical problem, defense is a political problem". For several years, cyber security has been misjudged as risk reduction. On one hand, business applications and architectures are growing rapidly. On the other hand, the cyber security organisation is struggling to be able to defend them in today's rapidly evolving threat landscape.
This talk explores the gap in thought between the owner and the defender of today's business applications and what needs to be done to bridge it. We shall present proactive steps and measures to overcome the last hurdle in building defendable systems.
How to know if your iPhone is hacked? Check these 5 points now!iFixScreens
With phones becoming an increasingly important part of our life, it is really important to keep a check on its integrity. Compared to Android phones, iPhones are difficult to hack. If you think that your iPhone is hacked, or want to know if your iPhone is hacked or not? Just follow the below steps!
Cazando Cibercriminales con: OSINT + Cloud Computing + Big DataChema Alonso
Diapositivas de la presentación impartida por Chema Alonso durante el congreso CELAES 2015 el 15 de Octubre en Panamá. En ella se habla de cómo en Eleven Paths y Telefónica se utilizan las tecnologías Tacyt, Sinfonier y Faast para luchar contra el e-crime.
Deception in Cyber Security (League of Women in Cyber Security)Phillip Maddux
Presented on August 23, 2017 at the League of Women in Cyber Security meetup (https://www.meetup.com/League-of-Women-in-Cybersecurity/events/242071337/). his talk will provide an intro to honeypots and their benefits, an intro to deception in cyber security, and an overview of HoneyPy and HoneyDB.
iOS and Android security: Differences you need to knowNowSecure
NowSecure Director of Research David Weistein recently spoke at the Security by Design Meetup in Washington, DC. This presentation offers information about risks impacting mobile and the differences between iOS and Android security.
Recap here: https://www.nowsecure.com/blog/2016/08/24/android-buckles-down-and-ios-opens-up-trends-in-platform-security-affecting-developers/
Talk delivered by Chema Alonso at RootedCON Satellite (Saturday 12th of September 2015) about how to do hacking & pentesting using dorks over Tacyt, a Big Data of Android Apps
La labor de gestionar la seguridad de una empresa suele ser como bailar sobre el alambre. Hay que permitir que el negocio siga funcionando, estar a la última, proteger lo ya implantado e innovar en cosas nuevas. Eso sí, de forma más eficiente cada año y con menos presupuesto. Todo ello, con el objetivo de no que no pase nada. La conclusión de esto es que al final siempre queda Long Hanging Fruit para que cualquiera se aproveche.
The Road To Defendable Systems - Emirates NBDSaumil Shah
"Attack is a technical problem, defense is a political problem". For several years, cyber security has been misjudged as risk reduction. On one hand, business applications and architectures are growing rapidly. On the other hand, the cyber security organisation is struggling to be able to defend them in today's rapidly evolving threat landscape.
This talk explores the gap in thought between the owner and the defender of today's business applications and what needs to be done to bridge it. We shall present proactive steps and measures to overcome the last hurdle in building defendable systems.
How to know if your iPhone is hacked? Check these 5 points now!iFixScreens
With phones becoming an increasingly important part of our life, it is really important to keep a check on its integrity. Compared to Android phones, iPhones are difficult to hack. If you think that your iPhone is hacked, or want to know if your iPhone is hacked or not? Just follow the below steps!
Cazando Cibercriminales con: OSINT + Cloud Computing + Big DataChema Alonso
Diapositivas de la presentación impartida por Chema Alonso durante el congreso CELAES 2015 el 15 de Octubre en Panamá. En ella se habla de cómo en Eleven Paths y Telefónica se utilizan las tecnologías Tacyt, Sinfonier y Faast para luchar contra el e-crime.
Deception in Cyber Security (League of Women in Cyber Security)Phillip Maddux
Presented on August 23, 2017 at the League of Women in Cyber Security meetup (https://www.meetup.com/League-of-Women-in-Cybersecurity/events/242071337/). his talk will provide an intro to honeypots and their benefits, an intro to deception in cyber security, and an overview of HoneyPy and HoneyDB.
TK Keanini shares his views on the current state of cybersecurity, explaining the challenges, why it's difficult for security professionals to keep up and his recommendations for changing the game.
Malware on Smartphones and Tablets - The Inconvenient TruthAGILLY
De nombreux entreprises, à travers leurs responsables informatiques et DSI ne reconnaissent toujours pas les logiciels malveillants mobiles comme une menace imminente. Selon une étude de Duo Security, un tiers des utilisateurs mobiles Android n'utilisent ne verrouillent pas l'écran de leurs appareils à l'aide d'un Mot de Passe, et la plupart ne prennent aucunes mesures de sécurité. En outre, les responsables informatiques et DSI déploient de nouvelles applications vers leurs clients et employés sans y intégrer de mesure de sécurité favorisant l'authentification et la mitigation des menaces.
Cependant, les logiciels malveillants mobiles ont évolué au fil des dernières années et constituent aujourd'hui des menaces réelle. Business Insider a noté que ces menaces sont désormais équivalentes à celles des PC en terme de distribution et de niveau de risque.
This presentation is based on the security and encryption measures adopted by Apple for its iPhones.
It was submitted to RTU, Kota during final year seminars.
Smart Bombs: Mobile Vulnerability and ExploitationTom Eston
Kevin Johnson, John Sawyer and Tom Eston have spent quite a bit of time evaluating mobile applications in their respective jobs. In this presentation they will provide the audience an understanding of how to evaluate mobile applications, examples of how things have been done wrong and an understanding of how you can perform this testing within your organization.
This talk will work with applications from the top three main platforms; iOS, Android and Blackberry. Kevin, Tom and John have used a variety of the top 25 applications for each of these platforms to provide real world examples of the problems applications face.
Fragments-Plug the vulnerabilities in your AppAppsecco
Appsecco presented on the common mistakes that developers make when building mobile apps.
This session covered how these mistakes make your app vulnerable to attack and abuse? How an attacker perceives security of mobile app?
https://youtu.be/EzC86gWVPZk
Debunking the Top 5 Myths About Mobile AppSecNowSecure
Originally presented June 24, 2019
https://www.nowsecure.com/resource/debunking-the-top-5-myths-about-mobile-appsec/
It’s hard to believe that mobile app stores are more than a decade old yet some crazy misconceptions about mobile application security still linger.
Have you heard these before?
- Testing mobile apps is the same as web apps
- SAST is good enough for mobile, you don’t need DAST
- Mobile apps are secure because Apple and Google security test them
- Outsourcing a penetration test once per year is sufficient to mitigate risk
Sort fact from fiction and learn how to ensure your mobile appsec program is on the right track. You may discover some surprising things about modern mobile application security.
CASE STUDY - Ironclad Messaging & Secure App Dev for Regulated IndustriesNowSecure
Originally Presenter October 18, 2018
Enterprise-grade ephemeral messaging provider Vaporstream knows firsthand that security needs to be built into the software development lifecycle rather than bolted on. Serving highly regulated industries such as federal government, energy, financial services and healthcare, Vaporstream’s leakproof communication platform provides the highest level of assurance that compliance professionals require. Vaporstream partners with NowSecure to test and certify its Android and iOS mobile messaging apps.
This case study webinar covers how Vaporstream adheres to a rigorous secure app lifecycle in order to meet customer expectations for secure communications:
+ Designing a secure app architecture & development process
+ Incorporating security testing into the release cycle
+ Comprehensive penetration testing
CocoaConf Austin 2014 | Demystifying Security Best PracticesMutual Mobile
Presentation from Conrad Stoll, Consulting Architect, Mutual Mobile at CocoaConf Mini Austin 2014.
We are expected to secure our software. Products are judged by the quality of the user experience, and the absence of security issues. Security is about being responsible with a user’s information. The type of information your app handles defines how secure it needs to be.

Not everyone is building a banking app. Security is all about making tradeoffs. Every app we build has an appropriate balance between security and usability.
View this security best practices presentation to see 14 things you can do to build more secure software.
Originally presented on 12/5/2017
To close out the 2017 webinar season, our mobile security expert panel will review the top mobile threats of 2017 (e.g., Cloudbleed, Bootstomp, Broadpwn, and more) and then debate what’s next in mobile app security and mobile app security testing for 2018. See the slides from this spirited discussion of the security ramifications of the new iPhone X, iOS 11, Android 8, the latest innovations in the mobile app security testing, and more. Compare your mobile app security and mobile app security testing initiatives with what our experts say should be your top priorities in 2018.
Build a Security Portfolio That Strengthens Your Security PostureSplunk
All data is security relevant – whether you are an IT or security professional, it is important to gain context into all your data to understand your environment, quickly hunt for and investigate potential threats in your environment, and take action to remediate.
The OWASP Mobile Top 10 is a nice start for any developer or a security professional, but the road is still ahead and there is so much to do to destroy most of the possible doors that hackers can use to find out about app’s vulnerabilities. We look forward to the OWASP to continue their work, but let’s not stay on the sidelines!
Bringing Government and Enterprise Security Controls to the Android EndpointHamilton Turner
Why are endpoint security controls on Android devices so lacking when compared to their laptop counterparts? What are the technical challenges to securing Android, and what should you be aware of before signing onto an MDM platform claiming to add security to your business devices.
The fundamentals of Android and iOS app securityNowSecure
Looking for a high-intensity bootcamp covering the basics of secure mobile development? This slideshare was originally presented by mobile security expert and NowSecure CEO Andrew Hoog for a 60-minute workshop at Security by Design covering the following topics:
+ Introduction to identifying security flaws in mobile apps (and how to avoid them)
+ Examples of secure and insecure mobile apps and how to secure them
+ Overview of secure mobile development based on the NowSecure Secure Mobile Development Best Practices
TK Keanini shares his views on the current state of cybersecurity, explaining the challenges, why it's difficult for security professionals to keep up and his recommendations for changing the game.
Malware on Smartphones and Tablets - The Inconvenient TruthAGILLY
De nombreux entreprises, à travers leurs responsables informatiques et DSI ne reconnaissent toujours pas les logiciels malveillants mobiles comme une menace imminente. Selon une étude de Duo Security, un tiers des utilisateurs mobiles Android n'utilisent ne verrouillent pas l'écran de leurs appareils à l'aide d'un Mot de Passe, et la plupart ne prennent aucunes mesures de sécurité. En outre, les responsables informatiques et DSI déploient de nouvelles applications vers leurs clients et employés sans y intégrer de mesure de sécurité favorisant l'authentification et la mitigation des menaces.
Cependant, les logiciels malveillants mobiles ont évolué au fil des dernières années et constituent aujourd'hui des menaces réelle. Business Insider a noté que ces menaces sont désormais équivalentes à celles des PC en terme de distribution et de niveau de risque.
This presentation is based on the security and encryption measures adopted by Apple for its iPhones.
It was submitted to RTU, Kota during final year seminars.
Smart Bombs: Mobile Vulnerability and ExploitationTom Eston
Kevin Johnson, John Sawyer and Tom Eston have spent quite a bit of time evaluating mobile applications in their respective jobs. In this presentation they will provide the audience an understanding of how to evaluate mobile applications, examples of how things have been done wrong and an understanding of how you can perform this testing within your organization.
This talk will work with applications from the top three main platforms; iOS, Android and Blackberry. Kevin, Tom and John have used a variety of the top 25 applications for each of these platforms to provide real world examples of the problems applications face.
Fragments-Plug the vulnerabilities in your AppAppsecco
Appsecco presented on the common mistakes that developers make when building mobile apps.
This session covered how these mistakes make your app vulnerable to attack and abuse? How an attacker perceives security of mobile app?
https://youtu.be/EzC86gWVPZk
Debunking the Top 5 Myths About Mobile AppSecNowSecure
Originally presented June 24, 2019
https://www.nowsecure.com/resource/debunking-the-top-5-myths-about-mobile-appsec/
It’s hard to believe that mobile app stores are more than a decade old yet some crazy misconceptions about mobile application security still linger.
Have you heard these before?
- Testing mobile apps is the same as web apps
- SAST is good enough for mobile, you don’t need DAST
- Mobile apps are secure because Apple and Google security test them
- Outsourcing a penetration test once per year is sufficient to mitigate risk
Sort fact from fiction and learn how to ensure your mobile appsec program is on the right track. You may discover some surprising things about modern mobile application security.
CASE STUDY - Ironclad Messaging & Secure App Dev for Regulated IndustriesNowSecure
Originally Presenter October 18, 2018
Enterprise-grade ephemeral messaging provider Vaporstream knows firsthand that security needs to be built into the software development lifecycle rather than bolted on. Serving highly regulated industries such as federal government, energy, financial services and healthcare, Vaporstream’s leakproof communication platform provides the highest level of assurance that compliance professionals require. Vaporstream partners with NowSecure to test and certify its Android and iOS mobile messaging apps.
This case study webinar covers how Vaporstream adheres to a rigorous secure app lifecycle in order to meet customer expectations for secure communications:
+ Designing a secure app architecture & development process
+ Incorporating security testing into the release cycle
+ Comprehensive penetration testing
CocoaConf Austin 2014 | Demystifying Security Best PracticesMutual Mobile
Presentation from Conrad Stoll, Consulting Architect, Mutual Mobile at CocoaConf Mini Austin 2014.
We are expected to secure our software. Products are judged by the quality of the user experience, and the absence of security issues. Security is about being responsible with a user’s information. The type of information your app handles defines how secure it needs to be.

Not everyone is building a banking app. Security is all about making tradeoffs. Every app we build has an appropriate balance between security and usability.
View this security best practices presentation to see 14 things you can do to build more secure software.
Originally presented on 12/5/2017
To close out the 2017 webinar season, our mobile security expert panel will review the top mobile threats of 2017 (e.g., Cloudbleed, Bootstomp, Broadpwn, and more) and then debate what’s next in mobile app security and mobile app security testing for 2018. See the slides from this spirited discussion of the security ramifications of the new iPhone X, iOS 11, Android 8, the latest innovations in the mobile app security testing, and more. Compare your mobile app security and mobile app security testing initiatives with what our experts say should be your top priorities in 2018.
Build a Security Portfolio That Strengthens Your Security PostureSplunk
All data is security relevant – whether you are an IT or security professional, it is important to gain context into all your data to understand your environment, quickly hunt for and investigate potential threats in your environment, and take action to remediate.
The OWASP Mobile Top 10 is a nice start for any developer or a security professional, but the road is still ahead and there is so much to do to destroy most of the possible doors that hackers can use to find out about app’s vulnerabilities. We look forward to the OWASP to continue their work, but let’s not stay on the sidelines!
Bringing Government and Enterprise Security Controls to the Android EndpointHamilton Turner
Why are endpoint security controls on Android devices so lacking when compared to their laptop counterparts? What are the technical challenges to securing Android, and what should you be aware of before signing onto an MDM platform claiming to add security to your business devices.
The fundamentals of Android and iOS app securityNowSecure
Looking for a high-intensity bootcamp covering the basics of secure mobile development? This slideshare was originally presented by mobile security expert and NowSecure CEO Andrew Hoog for a 60-minute workshop at Security by Design covering the following topics:
+ Introduction to identifying security flaws in mobile apps (and how to avoid them)
+ Examples of secure and insecure mobile apps and how to secure them
+ Overview of secure mobile development based on the NowSecure Secure Mobile Development Best Practices
Mobile Penetration Testing: Episode 1 - The Forensic MenaceNowSecure
This is Episode 1 of a trilogy on mobile penetration testing - forensic analysis of data at rest on the device.
Episode 2 - Return of the Network/Back-end
http://www.slideshare.net/nowsecure/mobile-penetration-testing-episode-ii-attack-of-the-code
Episode 3 - Attack of the Code
http://www.slideshare.net/nowsecure/mobile-penetration-testing-episode-iii-attack-of-the-code
Ever faster agile development and a wide gap across development and security teams are 2 of the main reasons you want to entirely automate all aspects of API security: code scans, infra scans, security testing, automatic policies deployment and deployment of lightweight, secure enforcement points (PEPs). Let's shift left!
Presentation given at APIDays Paris in Jan 2018.
Threat Hunting, Detection, and Incident Response in the CloudBen Johnson
SaaS and IaaS are new frontiers for a lot of security teams. We'll explore some thoughts at how you might approach some of these areas of your environment from a hunting or IR perspective. This was from a Sans webinar on 2019-09-25.
The Dev, Sec and Ops of API Security - API World42Crunch
The enterprise use of APIs is growing exponentially. Companies face a difficult choice. They must shift towards a software-based, digital approach to service and product delivery – or get left behind. Agile development, business pressure and the complexity of API security have made security teams life very complicated. And to make matters more complicated, the adoption of microservices architectures has multiplied the number of API endpoints that you have to protect.
Downside: The more APIs, the higher the security risk!
API security flaws are injected at many different levels of the API lifecycle: in requirements, development, deployment and monitoring. It is proven that detecting and fixing vulnerabilities during production or post-release time is up to 30 times more difficult than earlier in the API lifecycle. Security should be easy to considered at requirements phase, applied during development by attaching pre-defined policies to APIs and ensuring that security tests are performed as part of the continuous delivery of the APIs.
Upside: We’ll prep you with all the knowledge and tools you need to implement an automated, end-to-end API Security process that will get your dev, sec and ops teams speaking the same language.
In this presentation you will learn:
Security risks at each stage of the API lifecycle, and how to mitigate them.
How to implement an end-to-end automated API security model that development, security and operations teams will love.
How to think positive! Why a positive security model works.
Mitigating the Top 5 Cloud Security ThreatsBitglass
By now you are likely familiar with Cloud Access Security Brokers (CASBs) and understand how they fit into your broader security and cloud strategy. What should organizations be looking for in a CASB? What capabilities are here or on the horizon that can provide improved data protection in the cloud?
Bitglass and (ISC)2 presents the final episode of the CASB series where we will examine where cloud security is headed, discussing agentless and agent-based solutions, the growing number of cloud apps in use and the importance of easy deployment. Learn why cross-app security will become increasingly valuable as organizations look to third-party solutions for deep visibility, behavior analytics, and more.
6. MOBILE IS DIFFERENT.
✓ USE CASES
✓ HIGHLY TAILORED OS’S
✓ FRAGMENTED HARDWARE
(SIZE / SHAPE / CAPABILITIES)
✓ AMOUNT OF “ALIVE” TIME
✓ DEVELOPMENT PARADIGMS
55. USE NAMED PASTEBOARD INSTEAD OF
GENERAL, OR CLEAR IT WHEN APP RESIGNS
BLUR OR SCRUB SCREENS ON RESIGN
DISABLE AUTOCOMPLETE ON TEXT FIELDS,
AND USE SECURE ENTRY WHEN APPROPRIATE
MITIGATE
67. ✗ CORE DATA USES SQLITE, WHICH
CAN BE READ BY TOOLS EASILY
✗ CORE DATA BY DEFAULT USES:
PROBLEMS
NSFileProtectionCompleteUntilFirstUserAuthentication
80. ๏ APPLE WATCH USES APP GROUPS FOR
SHARED CONTAINER STORAGE
✗ APP GROUPS DON’T OFFER FREE
SECURITY JUST BECAUSE THEY IN A
DIFFERENT DIRECTORY
PROBLEMS
82. 1. DON’T STORE SENSITIVE DATA IN THE CLEAR
2. CLEAN UP WHEN APP RESIGNS
3. CORE DATA DEFAULT PROTECTION IS NOT
COMPLETE
4. KEYCHAIN IS THE GENERALLY ACCEPTED METHOD
FOR PROTECTING SECRETS LOCALLY
5. USE TouchID, IT IS SWEET
6. DON’T LET NEW SHINY THINGS LIKE APPLE WATCH
FOG YOUR SECURITY MIND!
7. EVALUATE WHETHER STORING SENSITIVE INFO
LOCALLY IS EVEN A GOOD IDEA
93. ⚠ NSURLSession CACHES REQUESTS
IN CACHE.DB BY DEFAULT
✓ CHANGE THE SESSION POLICY TO
NSURLRequestReloadIgnoringCacheData
✓ HANDLE willCacheResponse:
URL CACHE
94. ✓ IF YOU USE THEM, KEEP THEM UP-TO-DATE
✓ WARNING: BE AWARE OF PRIVACY POLICIES
AND “OPT OUT” OPTIONS
✓ DEVELOPERS WILL SEND THE DARNDEST
THINGS BACK TO THEIR SERVERS (LIKE WHAT
YOU ATE TODAY, AND WHERE)
✓ COULD ALSO BE DATA STORAGE CONCERN
ANALYTICS LIBRARIES
97. ✓ iBEACONS ARE BLUETOOTH LE
BROADCASTERS
✓ SENDS UUID, MAJOR, MINOR
VERSIONS
✓ THAT’S IT…
BEACON SECURITY
98. ✓ CAN BE SPOOFED
✓ WITHOUT AUTHENTICATION LAYER,
CAN BE “REPURPOSED”
✓ DO YOU CARE? IT ALL DEPENDS ON
WHAT THE APP DOES
BEACON SECURITY
99. ๏ STACY’S SHOES APP IS VERY POPULAR
๏ APP HAS ANALYTICS RIDING ON HTTP 😱
๏ APP USES BEACONS WHILE THEY ARE IN
THE RETAIL STOREFRONT
๏ APP SENDS BACK ALL SORTS OF PII…
HERE’S A RIDICULOUS
SCENARIO
100. ๏ HACKER FINDS THIS OUT
๏ HACKER SITS ON WIFI IN HEAVY POPULATED
COFFEE HOUSE
๏ HACKER SPOOFS STACY’S iBEACON TO COERCE
THE APP TO SPILL ITS GUTS FROM THE COFFEE
SHOP WIFI…
๏ YEAH… I TOLD YOU RIDICULOUS
RIDICULOUSNESS
CONTINUED
101. ✓ BUY BEACONS THAT PROVIDE
SECURE UUIDs (rotating)
✓ APP WILL REQUIRE SPECIAL API
AND INTERNET ACCESS
MITIGATION
104. ! GETS YOU MOVING QUICKLY
! CAN USE COCOAPODS TO KEEP
LIBRARIES UP TO DATE
" LIMITS YOUR ABILITY TO
TROUBLESHOOT
" OPENS YOU UP TO RISK OUT OF YOUR
CONTROL
3RD PARTY CODE
105. 1. APPLE SECURE CODING GUIDE
2. iOS SECURITY GUIDE
3. THE SWIFT PROGRAMMING
LANGUAGE
4. OWASP MOBILE SECURITY PROJECT
5. THE INTERNET
FURTHER READING