Abstract:On modern operating systems, applications under the same user are separated from each other, for the purpose of protecting them against malware and compromised programs. Given the complexity of today's OSes, less clear is whether such isolation is effective against different kind of cross-app resource access attacks (called XARA in our research). To better understand the problem, on the less-studied Apple platforms, we conducted a systematic security analysis on MAC OS~X and iOS. Our research leads to the discovery of a series of high-impact security weaknesses, which enable a sandboxed malicious app, approved by the Apple Stores, to gain unauthorized access to other apps' sensitive data. More specifically, we found that the inter-app interaction services, including the keychain, WebSocket and NSConnection on OS~X and URL Scheme on the MAC OS and iOS, can all be exploited by the malware to steal such confidential information as the passwords for iCloud, email and bank, and the secret token of Evernote. Further, the design of the app sandbox on OS~X was found to be vulnerable, exposing an app's private directory to the sandboxed malware that hijacks its Apple Bundle ID. As a result, sensitive user data, like the notes and user contacts under Evernote and photos under WeChat, have all been disclosed. Fundamentally, these problems are caused by the lack of app-to-app and app-to-OS authentications. To better understand their impacts, we developed a scanner that automatically analyzes the binaries of MAC OS and iOS apps to determine whether proper protection is missing in their code. Running it on hundreds of binaries, we confirmed the pervasiveness of the weaknesses among high-impact Apple apps. Since the issues may not be easily fixed, we built a simple program that detects exploit attempts on OS~X, helping protect vulnerable apps before the problems can be fully addressed.

Analysis of sysdiagnose in iOS 15 to identify the sending phone number of AirDrop data

Mid: Tracing Screen Photos Via Moiré Patterns

On Tracing Screen Photos-A Moiré Pattern-based Approach

Digital Forensics Security Analysis on iOS Devices

MagAttack - Guessing Application Launching and Operation via Smartphone.

Droid Analytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

Forensic analysis of iOS binary cookie files

DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

Recovering Residual Forensic Data from Smartphone Interactions with Cloud Storage Providers

Toward social media forensics through development of iOS analyzers for evidence collection and analysis

A Bleeding Digital Heart: Identifying Residual Data Generation from Smartphone Applications Interacting with Medical Devices

MAC Address De-Anonymisation

Robust Smartphone App Identification via Encrypted Network Traffic Analysis

Acoustic Fingerprinting Revisited: Generate Stable Device ID Stealthily with Inaudible Sound

A forensic analysis of AnyDesk Remote Access application by using various forensic tools and techniques

AirGuard -- Protecting Android Users From Stalking Attacks By Apple Find My Devices

Handoff All Your Privacy: A Review of Apple's Bluetooth Low Energy Continuity Protocol

Forensic Artefact Discovery and Attribution from Android Cryptocurrency Wallet Applications

The development of a mobile app‐focused deduplication strategy for the Apple Heart Study that informs recommendations for future digital trials

DEMO: Extracting Physical-Layer BLE Advertisement Information from Broadcom and Cypress Chips

Unauthorized Cross-App Resource Access on MAC OS X and iOS