Evaluation of the iOS security concept with a focus on code signing

Astract:

Over the years, Apple introduced a wide range of security mechanisms on iOS devices. This thesis takes a critical look at some of the key aspects of these security mechanisms and evaluates them. A detailed look is taken at the code signing mechanisms preventing loading unsigned code resources. An attack using built-in vulnerabilities and return-oriented programming to execute unsigned code logic is presented. Simulating these vulnerabilities, this attack is implemented as a testing environment for running unsigned code logic inside an iOS application. Using this testing environment, experiments are conducted to measure the impact of such an attack. The results are that despite the code signing mechanisms present in iOS applications, the loading and execution of new functionality is possible. This allows for successful execution of malicious and term-violating code logic with a broad range of possibilities.