iOS Data Security: Secure File Apps for

Unmanaged Devices
To finish our discussion of securing data on unmanaged devices, lets focus on three categories of apps
designed for secure file access:
Sandboxed file browsers and mobile file gateways
While messaging apps generally do a good job of handling email, they dont necessarily link into file
servers or integrate into enterprise encryption. Secure file management apps skip messaging and focus
on access to enterprise file repositories. They support the following core features:
Use of either iOS Data Protection or their own embedded encryption.
A secure connection to the file repository (which may require a VPN for remote access to
internal sources).
Support for the iOS document viewer to view supported document types (iWork, Microsoft
Office, PDF, etc.).
Authentication and authorization to enable or restrict access on a per-user, per-device basis.
Ability to restrict or allow Open In to control file movement to other apps.
There are a few different flavors. Most require server components or plugins to repositories like Microsoft
SharePoint. If the tool doesnt isolate documents by restricting the Open In feature, it is not suitable
for enterprise use.
Sandboxed file browser: These allow connections to enterprise file shares using standard
connections and store the downloaded documents in an encrypted container. Most use Data
Protection rather than to their own encryption scheme. They are usually read-only, although
some support annotation of PDF files.
Sandboxed cloud file browser: Instead of relying on direct network connections to enterprise
file stores, these apps access cloud storage repositories and are specific to their cloud service.
Mobile file management gateway: This is a more refined extension of the sandboxed file
browser. Rather than allowing access directly to file repositories, mobile devices connect to the
gateway using a sandboxed app and are then given access to files through the gateway. These
support more granular policies, monitoring, and directory integration. They often also support
multiple mobile platforms (yes, there is a world outside Apple).
Document management system extensions: These are similar to a mobile file management
gateway, but instead of a separate server they run as plugins to an existing document
management system. Users connect directly to the document management system (such as
SharePoint) via the extension/plugin, which might be centrally managed.
Some of these tools support commenting and annotating files (usually restricted to PDFs) but we know
expanded document editing is on the roadmap.
Sandboxed mobile file encryption apps
Mobile computing is one of the big drivers of cloud computing, and cloud storage is, in turn, expanding
use of encryption. Encryption apps extend on the sandboxed file browser by integrating with enterprise
encryption. They expand on the file browser by:
Maintaining file and document isolation in the sandbox.
Transparently decrypting files accessed by the app (when integrated into an enterprise
encryption scheme and key management server).
Accepting files from other apps via Open In and keeping them encrypted in private storage,
then enabling protected access to such files.
Support for connections to common cloud storage platforms such as Box.net and Dropbox.
The big division in this category is between apps designed to open files passed to them by other
applications, such as encrypted mail attachments, versus those that integrate directly into cloud storage
or other file browsers. Some tools also support decryption of password protected files versus those
managed using centralized enterprise keys.
When integrated with enterprise key management, the entire process of accessing encrypted files on iOS
is completely transparent to the user. They go into the app, which connects to the file store, and files are
stored within the apps secure data store and decrypted as needed. The documents can then be
restricted so they are only usable within the app, as with our other sandboxing examples. Some apps also
support encryption of files from other apps.
This actually provides more protection than normal desktop encryption because its far easier to isolate
documents and keep them within the app.
Mobile Enterprise Digital Rights Management
The next option for handling files securely on unmanaged devices expands on encryption into Digital
Rights Management. EDRM provides more granular controls that travel with the documents, getting
closer to information-centric security. The easiest way to distinguish between an encryption app and
EDRM on iOS is:
An encrypted document opened in a sandbox may be isolated in that app, but isnt generally
protected when accessed on other systems which also have access (such as a laptop or
desktop). Protection is binary, like a lockbox controlling only who can access the file. We rely
on the sandbox app for additional controls, such as restricting movement into other apps
usually on an all-or-nothing basis).
An EDRM protected document stays encrypted, but can only be opened by applications that
respect the more granular controls applied to the file (including compatible mobile apps). This
allows a wide range of control including who can open the file, who can edit it, who can
forward it via email, which devices can access it, and even time limits for access.
Encryption is for trusted users and environments, while EDRM also supports untrusted environments.
In the mobile space EDRM is better for protecting files you want to share externally and still protect
while encryption is generally only suitable for internal use, or securely transmitting documents, but unable
to restrict what they can do once they have it. EDRM is very oriented towards office documents, while
encryption is better for arbitrary files.
Mobile EDRM requires a server or service to manage the keys. The rights themselves are embedded in
the documents. There are a variety of potential deployment models, including:
Mobile file gateway
File server/SharePoint integration
Email client integration
Email server integration
Microsoft Office integration
To simplify this a bit: documents can either be manually protected when you create them in Office or
email them, when you upload them to an EDRM-enabled file gateway/storage platform, or automatically
when you save them into a protected directory or email them to a certain destination.
The documents can only be read using the vendors proprietary solution (app), which enforces all the
rights. Some tools integrate into Microsofts Windows Rights Management (RMS) service or another
EDRM platform which is integrated into Office.
Rights you can manage on a per file basis generally include:
Who can read a file.
Who can edit a file (with the same annotation/commenting limitations we see in most iOS apps,
although that should be changing soon).
Who can transfer a file out of the sandbox (Open In).
Who can print a file.
Who can share a file (allow others to read it).
How long the file is accessible.
Who can copy/paste out of the file.
Unless you allow users to remove rights (or copy/paste out of the document), content is always encrypted
and protected as it moves around different locations, users, and platforms. Rights are tied directly to
users in enterprise environments through directory servers, so there is little sharing of credentials to allow
access. If you want to exchange protected documents with external users you have them download the
(usually free) app and send them the file, then use an alternate authentication and authorization model,
such as federation.
For external users or mobile users without VPN access, your keys and rights management server must to
be Internet accessible perhaps hosted by a SaaS provider.
Sandboxed file browsers, mobile encryption, and mobile EDRM all use the same basic model a
sandboxed app for handling files with different degrees of security, flexibility, and integration.
This covers all our options for unmanaged devices, nearly all of which also come into play on partially-
managed or fully-managed devices which we will cover in our next post, followed by advice on how to
choose a strategy.
Rich
Download & Resources
Sign up fro our newsletter to get the latest updates.

Submit

View our FREE mini-courses!


Discounted Boot Camps
IOS Application Security Part 20 Local Data Storage
(NSUserDefaults, CoreData, Sqlite, Plist files)



In this article, we will look at the different ways in which applicatons can store data locally on the
device and look at how secure these methods are.
We will be performing some of these demonstrations in a sample app that you can download
from my github account. For the CoreData example, you can download the sample app
from here
One of the other things that we will doing different in this example is that we will be running the
application on the IOS simulator using Xcode rather than on the device and hence will be
analyzing the application on our computer rather than on the device. This is just to demonstrate
that you can perform all the steps performed before in previous articles on your system as well
by running the application via Xcode. Optionally, you can simply run the application on your
device using the steps mentioned here.
NSUserDefaults
One of the most common ways of saving user preferences and properties in an application is by
using NSUserDefaults. The information stored in NSUserDefaults persists even if you close the
application and start it again. One of the examples of saving information in NSUserDefaults is
the logged in state of the user. We can save the logged in state of the user (YES or NO) in
NSUserDefaults so that when the user closes the application and starts it again, the application
can fetch data from NSUserDefaults and display different UI to the user depending on whether
he is logged in or not. Some applications also use this feature to save confidential information
like the users access token so that the next time the application launches, they can just use that
access token to authenticate the user again.
Download the sample application from my github page and run it. You will get this view. Now
enter some info in the text field related to NSUserDefaults and tap the button that says Save in
NSUserDefaults. This will save the data to NSUserDefaults.

What most people do not realize is that the data saved by NSUserDefaults is not encrypted and
can be easily viewed from the application bundle. It is stored in a plist file with the name as
the bundle Id of the application. First of all, we must find the application bundle for our
application. Since we are running the application on our system, we can find our applications on
the path /Users/$username/Library/Application Support/iPhone Simulator/$ios version of
simulator/Applications/. In my case, the location is
Users/prateekgianchandani/Library/Application Support/iPhone Simulator/6.1/Applications
Once we go to that directory, we can see a bunch of applications. These are all the application
that we run via Xcode for that particular IOS version. We can find our application by the date
modified tag as it would have the latest modified date.

Go inside the app bundle. All the contents saved by NSUserDefaults is saved inside a plist file
that can be found under Library -> Preferences -> $AppBundleId.plist as shown in the image
below.

Open up the plist file and you can easily view the contents of the file.

Sometimes, the plist files can be in binary format and hence not easily viewable at first. You can
either convert it into xml format using the plutil utility or just view the application in a device
using the tool iExplorer.
Plist Files
Another common way of storing data is in the plist files. Plist files should always be used for
saving information that is not confidential as they are unencrypted and can be easily be fetched
even from a non-jailbroken device. There have beenvulnerabilities reported where big
companies have been found to store condifential data like Access tokens, Usernames and
passwords in plist files. In the demo app, lets enter the information for plist and tap on Save in
plist file.

Here is the code for saving data to the plist file.
[plain]
NSArray *paths =
NSSearchPathForDirectoriesInDomains(NSDocumentDirectory,NSUserDomainMask,YES);
NSString *documentsDirectory = [paths objectAtIndex:0];
NSString *filePath = [documentsDirectory stringByAppendingString:@"/userInfo.plist"];
NSMutableDictionary* plist = [[NSMutableDictionary alloc] init];
[plist setValue:self.usernameTextField.text forKey:@"username"];
[plist setValue:self.passwordTextField.text forKey:@"passwprd"];
[plist writeToFile:filePath atomically:YES];
[/plain]
Want to learn more?? The InfoSec Institute Web Application Penetration
Testing Boot Campfocuses on preparing you for the real world of Web App
Pen Testing through extensive lab exercises, thought provoking lectures led
by an expert instructor. We review of the entire body of knowledge as it
pertains to web application pen testing through a high-energy seminar
approach.

The Web Application Penetration Testing course from InfoSec Institute is a
totally hands-on learning experience. From the first day to the last day, you
will learn the ins and outs of Web App Pen Testing by attending thought
provoking lectures led by an expert instructor. Every lecture is directly
followed up by a comprehensive lab exercise (we also set up and provide lab
workstations so you don't waste valuable class time installing tools and apps).
Benefits to you are:
Get CWAPT Certified
Learn the Secrets of Web App Pen Testing in a totally hands-on
classroom environment
Learn how to exploit and defend real-world web apps: not just silly
sample code
Complete the 83 Step "Web App Pen Test Methodology", and bring a
copy back to work with you
Learn how perform OWASP Top 10 Assessments: for PCI DSS
compliance
VIEW WEB APP PEN TEST
As you can see from the code, you can always specify a custom path for the plist file. We can
then search the entire application bundle for all plist files. In this case, we find a file named
userinfo.plist inside the application bundle.

As we can see, it contains the user/pass combination that we had entered in the fields before.

CoreData and Sqlite files
Since CoreData basically uses Sqlite internally to save information, we are only going to cover
CoreData here. If you dont know what CoreData is , here is a screenshot from Apples
documentation about CoreData.


So basically, CoreData can be used to create a model, manage relationships between different
types of objects, save the data locally, and fetch them from the local cache whenever you want
with queries. In this tutorial, we will be using a sample application from github. Once you run it
you will see that is is just a simple RSS feed.

This application uses Core Data to save its information. It is important to note that the Core Data
framework internally uses Sql queries to store its data and hence all the files are stored as .db
files. Lets go to the app bundle for this app and look at where this information is stored. In the
app bundle for this application, you can see that there is a file named MyCoreData.sqlite.

Lets analyze it using sqlite3. In my case, the location of the sqlite file is at ~/Library/Application
Support/iPhone Simulator/6.1/Applications/51038055-3CEC-4D90-98B8-
A70BF12C7E9D/Documents.

As we can see, there is a table named ZSTORIES. In Core Data, every table name is appended
with Z at the beginning. This means that the entity name is actually STORIES as we can clearly
see from the source files in the project.

We can easily dump all the values from this table. Make sure the headers are on.

As we can see, by default, all the data stored in CoreData is unencrypted and can be easily
fetched out. Therefore, we should not use CoreData for saving confidential information ever.
There are libraries available that act as a wrapper over CoreData and claim to save encrypted
dat. There are other implementations as well that store encrypted data on the device without
using CoreData. For e.g the Salesforce Mobile SDK use a feature known as SmartStore that
can store encrypted data on the device in the form of Soups.
Keychain
Some developers dont prefer to save data in the Keychain because it is not that straightforward
to implement . However, saving info in the Keychain is probably the most secure way of storing
data on a non-jailbroken device. On a jailbroken device however, nothing is secure. Here is an
article that demonstrates how easy it can be to save data in the keychain using simple wrapper
classes. Basically, the code for saving data in the keychain is just like saving data with
NSUserDefaults with this wrapper. Here is a snippet of code that saves a string to the keychain.
Notice that the syntax looks very similar to using NSUserDefaults.
[plain]
PDKeychainBindings *bindings = [PDKeychainBindings sharedKeychainBindings];
[bindings setObject:@"XYZ" forKey:@"authToken"];
[/plain]
And here is a small snippet for fetching data from the keychain.
[plain]
PDKeychainBindings *bindings = [PDKeychainBindings sharedKeychainBindings];
NSLog(@"Auth token is %@",[bindings objectForKey:@"authToken"]]);
[/plain]
Small Tricks
As we discussed before, no information is safe on a jailbroken device. The attacker can get info
from Plist files, dump your entire keychain, replace method implementations and can pretty
much do anything he wants. But the developer can surely use some small tricks to make sure
that the script kiddies find it difficult to get the information they want from the application. It is
possible to encrypt files while saving them locally on the device. Here is an article that talks
about that in good detail. Or you can just make it difficult for them to figure out the correct
information. For e.g lets consider the example of saving the authentication token for a particular
user on the keychain. A script kiddie will just try and use the auth token dumped from the
keychain and try to hijack the session of the user. If we can just reverse the auth token before
saving it on the keychain, the attacker wouldnt know that the actual auth token is actually
reverese of the one stored in the keychain. He can surely trace every call in your application
and figure it out, but such simple techniques will help keep the script kiddies guessing for
enough time that they will start looking for vulnerabilites in other applications. Another such
example of these small tricks could be appending a constant string to the actual value before
saving it.
In the next article, we will look at runtime analysis using GDB.
By Prateek Gianchandani|October 18th, 2013|Application Security|0 Comments