iOS Data Security: Secure File Apps for Unmanaged DevicesTo finish our discussion of securing data on unmanaged devices, let’s focus on three categories of apps

designed for secure file access:

Sandboxed file browsers and mobile file gatewaysWhile messaging apps generally do a good job of handling email, they don’t necessarily link into file

servers or integrate into enterprise encryption. Secure file management apps skip messaging and focus

on access to enterprise file repositories. They support the following core features: Use of either iOS Data Protection or their own embedded encryption.

A secure connection to the file repository (which may require a VPN for remote access to internal sources).

Support for the iOS document viewer to view supported document types (iWork, Microsoft Office, PDF, etc.).

Authentication and authorization to enable or restrict access on a per-user, per-device basis.

Ability to restrict or allow “Open In…” to control file movement to other apps.

There are a few different flavors. Most require server components or plugins to repositories like Microsoft

SharePoint. If the tool doesn’t isolate documents by restricting the “Open In…” feature, it is not suitable

for enterprise use. Sandboxed file browser: These allow connections to enterprise file shares using standard

connections and store the downloaded documents in an encrypted container. Most use Data Protection rather than to their own encryption scheme. They are usually read-only, although some support annotation of PDF files.

Sandboxed cloud file browser: Instead of relying on direct network connections to enterprise file stores, these apps access cloud storage repositories and are specific to their cloud service.

Mobile file management gateway: This is a more refined extension of the sandboxed file browser. Rather than allowing access directly to file repositories, mobile devices connect to the gateway using a sandboxed app and are then given access to files through the gateway. These support more granular policies, monitoring, and directory integration. They often also support multiple mobile platforms (yes, there is a world outside Apple).

Document management system extensions: These are similar to a mobile file management gateway, but instead of a separate server they run as plugins to an existing document management system. Users connect directly to the document management system (such as SharePoint) via the extension/plugin, which might be centrally managed.

Some of these tools support commenting and annotating files (usually restricted to PDFs) but we know

expanded document editing is on the roadmap.

Sandboxed mobile file encryption appsMobile computing is one of the big drivers of cloud computing, and cloud storage is, in turn, expanding

use of encryption. Encryption apps extend on the sandboxed file browser by integrating with enterprise

encryption. They expand on the file browser by: Maintaining file and document isolation in the sandbox.

Transparently decrypting files accessed by the app (when integrated into an enterprise encryption scheme and key management server).

Accepting files from other apps via “Open In…” and keeping them encrypted in private storage, then enabling protected access to such files.

Support for connections to common cloud storage platforms such as Box.net and Dropbox.

The big division in this category is between apps designed to open files passed to them by other

applications, such as encrypted mail attachments, versus those that integrate directly into cloud storage

or other file browsers. Some tools also support decryption of password protected files versus those

managed using centralized enterprise keys.

When integrated with enterprise key management, the entire process of accessing encrypted files on iOS

is completely transparent to the user. They go into the app, which connects to the file store, and files are

stored within the app’s secure data store and decrypted as needed. The documents can then be

restricted so they are only usable within the app, as with our other sandboxing examples. Some apps also

support encryption of files from other apps.

This actually provides more protection than normal desktop encryption because it’s far easier to isolate

documents and keep them within the app.

Mobile Enterprise Digital Rights ManagementThe next option for handling files securely on unmanaged devices expands on encryption into Digital

Rights Management. EDRM provides more granular controls that travel with the documents, getting

closer to information-centric security. The easiest way to distinguish between an encryption app and

EDRM on iOS is: An encrypted document opened in a sandbox may be isolated in that app, but isn’t generally

protected when accessed on other systems which also have access (such as a laptop or desktop). Protection is binary, like a lockbox – controlling only who can access the file. We rely on the sandbox app for additional controls, such as restricting movement into other apps – usually on an all-or-nothing basis).

An EDRM protected document stays encrypted, but can only be opened by applications that respect the more granular controls applied to the file (including compatible mobile apps). This allows a wide range of control – including who can open the file, who can edit it, who can forward it via email, which devices can access it, and even time limits for access.

Encryption is for trusted users and environments, while EDRM also supports untrusted environments.

In the mobile space EDRM is better for protecting files you want to share externally and still protect –

while encryption is generally only suitable for internal use, or securely transmitting documents, but unable

to restrict what they can do once they have it. EDRM is very oriented towards office documents, while

encryption is better for arbitrary files.

Mobile EDRM requires a server or service to manage the keys. The rights themselves are embedded in

the documents. There are a variety of potential deployment models, including: Mobile file gateway

File server/SharePoint integration

Email client integration

Email server integration

Microsoft Office integration

To simplify this a bit: documents can either be manually protected when you create them in Office or

email them, when you upload them to an EDRM-enabled file gateway/storage platform, or automatically

when you save them into a protected directory or email them to a certain destination.

The documents can only be read using the vendor’s proprietary solution (app), which enforces all the

rights. Some tools integrate into Microsoft’s Windows Rights Management (RMS) service or another

EDRM platform which is integrated into Office.

Rights you can manage on a per file basis generally include: Who can read a file.

Who can edit a file (with the same annotation/commenting limitations we see in most iOS apps, although that should be changing soon).

Who can transfer a file out of the sandbox (“Open In…”).

Who can print a file.

Who can share a file (allow others to read it).

How long the file is accessible.

Who can copy/paste out of the file.

Unless you allow users to remove rights (or copy/paste out of the document), content is always encrypted

and protected as it moves around different locations, users, and platforms. Rights are tied directly to

users in enterprise environments through directory servers, so there is little sharing of credentials to allow

access. If you want to exchange protected documents with external users you have them download the

(usually free) app and send them the file, then use an alternate authentication and authorization model,

such as federation.

For external users or mobile users without VPN access, your keys and rights management server must to

be Internet accessible – perhaps hosted by a SaaS provider.

Sandboxed file browsers, mobile encryption, and mobile EDRM all use the same basic model – a

sandboxed app for handling files – with different degrees of security, flexibility, and integration.

This covers all our options for unmanaged devices, nearly all of which also come into play on partially-

managed or fully-managed devices… which we will cover in our next post, followed by advice on how to

choose a strategy.

—Rich

Download & ResourcesSign up fro our newsletter to get the latest updates.

 

Submit

View our FREE mini-courses!

Discounted Boot Camps

IOS Application Security Part 20 – Local Data Storage (NSUserDefaults, CoreData, Sqlite, Plist files)

  

 

 

In this article, we will look at the different ways in which applicatons can store data locally on the

device and look at how secure these methods are.

We will be performing some of these demonstrations in a sample app that you can download

from my github account. For the CoreData example, you can download the sample app

from here

One of the other things that we will doing different in this example is that we will be running the

application on the IOS simulator using Xcode rather than on the device and hence will be

analyzing the application on our computer rather than on the device. This is just to demonstrate

that you can perform all the steps performed before in previous articles on your system as well

by running the application via Xcode. Optionally, you can simply run the application on your

device using the steps mentioned here.

NSUserDefaults

One of the most common ways of saving user preferences and properties in an application is by

using NSUserDefaults. The information stored in NSUserDefaults persists even if you close the

application and start it again. One of the examples of saving information in NSUserDefaults is

the logged in state of the user. We can save the logged in state of the user (YES or NO) in

NSUserDefaults so that when the user closes the application and starts it again, the application

can fetch data from NSUserDefaults and display different UI to the user depending on whether

he is logged in or not. Some applications also use this feature to save confidential information

like the user’s access token so that the next time the application launches, they can just use that

access token to authenticate the user again.

Download the sample application from my github page and run it. You will get this view. Now

enter some info in the text field related to NSUserDefaults and tap the button that says Save in

NSUserDefaults. This will save the data to NSUserDefaults.

What most people do not realize is that the data saved by NSUserDefaults is not encrypted and

can be easily viewed from the application bundle. It is stored in a plist file with the name as

the bundle Id of the application. First of all, we must find the application bundle for our

application. Since we are running the application on our system, we can find our applications on

the path /Users/$username/Library/Application Support/iPhone Simulator/$ios version of

simulator/Applications/. In my case, the location is

“Users/prateekgianchandani/Library/Application Support/iPhone Simulator/6.1/Applications”

Once we go to that directory, we can see a bunch of applications. These are all the application

that we run via Xcode for that particular IOS version. We can find our application by the date

modified tag as it would have the latest modified date.

Go inside the app bundle. All the contents saved by NSUserDefaults is saved inside a plist file

that can be found under Library -> Preferences -> $AppBundleId.plist as shown in the image

below.

Open up the plist file and you can easily view the contents of the file.

Sometimes, the plist files can be in binary format and hence not easily viewable at first. You can

either convert it into xml format using the plutil utility or just view the application in a device

using the tool iExplorer.

Plist Files

Another common way of storing data is in the plist files. Plist files should always be used for

saving information that is not confidential as they are unencrypted and can be easily be fetched

even from a non-jailbroken device. There have beenvulnerabilities reported where big

companies have been found to store condifential data like Access tokens, Usernames and

passwords in plist files. In the demo app, lets enter the information for plist and tap on Save in

plist file.

Here is the code for saving data to the plist file.

[plain]

NSArray *paths =

NSSearchPathForDirectoriesInDomains(NSDocumentDirectory,NSUserDomainMask,YES);

NSString *documentsDirectory = [paths objectAtIndex:0];

NSString *filePath = [documentsDirectory stringByAppendingString:@"/userInfo.plist"];

NSMutableDictionary* plist = [[NSMutableDictionary alloc] init];

[plist setValue:self.usernameTextField.text forKey:@"username"];

[plist setValue:self.passwordTextField.text forKey:@"passwprd"];

[plist writeToFile:filePath atomically:YES];

[/plain]

Want to learn more?? The InfoSec Institute Web Application Penetration Testing Boot Campfocuses on preparing you for the real world of Web App Pen Testing through extensive lab exercises, thought provoking lectures led by an expert instructor. We review of the entire body of knowledge as it pertains to web application pen testing through a high-energy seminar approach. 

The Web Application Penetration Testing course from InfoSec Institute is a totally hands-on learning experience. From the first day to the last day, you will learn the ins and outs of Web App Pen Testing by attending thought provoking lectures led by an expert instructor. Every lecture is directly followed up by a comprehensive lab exercise (we also set up and provide lab workstations so you don't waste valuable class time installing tools and apps). Benefits to you are:

Get CWAPT Certified Learn the Secrets of Web App Pen Testing in a totally hands-on

classroom environment Learn how to exploit and defend real-world web apps: not just silly

sample code Complete the 83 Step "Web App Pen Test Methodology", and bring a

copy back to work with you Learn how perform OWASP Top 10 Assessments: for PCI DSS

compliance

VIEW WEB APP PEN TEST

As you can see from the code, you can always specify a custom path for the plist file. We can

then search the entire application bundle for all plist files. In this case, we find a file named

userinfo.plist inside the application bundle.

As we can see, it contains the user/pass combination that we had entered in the fields before.

CoreData and Sqlite files

Since CoreData basically uses Sqlite internally to save information, we are only going to cover

CoreData here. If you don’t know what CoreData is , here is a screenshot from Apple’s

documentation about CoreData.

So basically, CoreData can be used to create a model, manage relationships between different

types of objects, save the data locally, and fetch them from the local cache whenever you want

with queries. In this tutorial, we will be using a sample application from github. Once you run it

you will see that is is just a simple RSS feed.

This application uses Core Data to save its information. It is important to note that the Core Data

framework internally uses Sql queries to store its data and hence all the files are stored as .db

files. Let’s go to the app bundle for this app and look at where this information is stored. In the

app bundle for this application, you can see that there is a file named MyCoreData.sqlite.

Let’s analyze it using sqlite3. In my case, the location of the sqlite file is at ~/Library/Application

Support/iPhone

Simulator/6.1/Applications/51038055-3CEC-4D90-98B8-A70BF12C7E9D/Documents.

As we can see, there is a table named ZSTORIES. In Core Data, every table name is appended

with Z at the beginning. This means that the entity name is actually STORIES as we can clearly

see from the source files in the project.

We can easily dump all the values from this table. Make sure the headers are on.

As we can see, by default, all the data stored in CoreData is unencrypted and can be easily

fetched out. Therefore, we should not use CoreData for saving confidential information ever.

There are libraries available that act as a wrapper over CoreData and claim to save encrypted

dat. There are other implementations as well that store encrypted data on the device without

using CoreData. For e.g the Salesforce Mobile SDK use a feature known as SmartStore that

can store encrypted data on the device in the form of Soups.

Keychain

Some developers don’t prefer to save data in the Keychain because it is not that straightforward

to implement . However, saving info in the Keychain is probably the most secure way of storing

data on a non-jailbroken device. On a jailbroken device however, nothing is secure. Here is an

article that demonstrates how easy it can be to save data in the keychain using simple wrapper

classes. Basically, the code for saving data in the keychain is just like saving data with

NSUserDefaults with this wrapper. Here is a snippet of code that saves a string to the keychain.

Notice that the syntax looks very similar to using NSUserDefaults.

[plain]

PDKeychainBindings *bindings = [PDKeychainBindings sharedKeychainBindings];

[bindings setObject:@"XYZ" forKey:@"authToken"];

[/plain]

And here is a small snippet for fetching data from the keychain.

[plain]

PDKeychainBindings *bindings = [PDKeychainBindings sharedKeychainBindings];

NSLog(@"Auth token is %@",[bindings objectForKey:@"authToken"]]);

[/plain]

Small Tricks

As we discussed before, no information is safe on a jailbroken device. The attacker can get info

from Plist files, dump your entire keychain, replace method implementations and can pretty

much do anything he wants. But the developer can surely use some small tricks to make sure

that the script kiddies find it difficult to get the information they want from the application. It is

possible to encrypt files while saving them locally on the device. Here is an article that talks

about that in good detail. Or you can just make it difficult for them to figure out the correct

information. For e.g let’s consider the example of saving the authentication token for a particular

user on the keychain. A script kiddie will just try and use the auth token dumped from the

keychain and try to hijack the session of the user. If we can just reverse the auth token before

saving it on the keychain, the attacker wouldn’t know that the actual auth token is actually

reverese of the one stored in the keychain. He can surely trace every call in your application

and figure it out, but such simple techniques will help keep the script kiddies guessing for

enough time that they will start looking for vulnerabilites in other applications. Another such

example of these small tricks could be appending a constant string to the actual value before

saving it.

In the next article, we will look at runtime analysis using GDB.

By Prateek Gianchandani|October 18th, 2013|Application Security|0 Comments