IOS Application Forensic Technique - Information Disclosure Due to Poor Programming

IOS Application Forensic Technique - Information Disclosure Due to Poor Programming - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: IOS Application Forensic Technique - Information Disclosure Due to Poor Programming (/Thread-IOS-Application-Forensic-Technique-Information-Disclosure-Due-to-Poor-Programming)

IOS Application Forensic Technique - Information Disclosure Due to Poor Programming - Adorapuff - 09-26-2014

IOS Application Forensic Technique
Information Disclosure Due to Poor Programming

Abstract: When developers create "secure" IOS applications with passcode locks to prevent other users from seeing sensitive content and store them within the NSUSERDEFAULTS, the password can be revealed or modified to grant unauthorized access to the sensitive information.

Prerequisites:
IOS Device
iExplorer: http://www.macroplant.com/iexplorer/
At least one of the vulnerable applications listed below, or try and find one on your own, its not hard, just get like 5 private apps for notes and pictures and test on them.

Vulnerable Applications:
Private Photo Vault
Wil add more later once I find my list

Tutorial
Open the vulnerable app, and create a passcode
Plug device in, open iExplorer, click on the vuln app under apps
Browse to library>preferences
There will be 1-2 plists. If there are 2 you will see com.apple.PeoplePicker.plist open the other one.
Inside the plist look for a key such as pin or password with your passcode in the value. If its not there, well then the app isn't vulnerable but if it is, that's the password you can log in with.
Now, if the password is stored in an MD5 or any hash you can identify, don't bother decrypting it. Save the original pass, hash your own pass, replace the old one, save it, close the app, kill multitasking, and login with your new password.

Why this is possible:
Developers who create IOS apps are supposed to store passwords in the keychain, which many smart ones do, but plenty of these secure private apps aren't focused on security like they claim they are, and store the password in NSUSERDEFAULTS which is easier, but publicly accessible and modifiable.

Bonus:
If the password is not there, sometimes there is a BOOL such as firstLaunch=FALSE, if you change it to true, it will have you create a new passcode, and reveal the sensitive information.

RE: IOS Application Forensic Technique - Information Disclosure Due to Poor Programming - Eclipse - 09-26-2014

This is a great example of when common sense and human stupidity come together and the internet makes fun. Nice tutorial Adorapuff.

RE: IOS Application Forensic Technique - Information Disclosure Due to Poor Programming - Painkiller - 09-26-2014

Thank you for the tutorial, Adorapuff.

RE: IOS Application Forensic Technique - Information Disclosure Due to Poor Programming - Adorapuff - 09-26-2014

(09-26-2014, 06:48 PM)Painkiller Wrote: Thank you for the tutorial, Adorapuff.

Anytime, I got more coming soon.