iOS Data Security: Secure File Apps for Unmanaged Devices To finish our discussion of securing data on unmanaged devices, let’s focus on three categories of apps designed for secure file access: Sandboxed file browsers and mobile file gateways While messaging apps generally do a good job of handling email, they don’t necessarily link into file servers or integrate into enterprise encryption. Secure file management apps skip messaging and focus on access to enterprise file repositories. They support the following core features: Use of either iOS Data Protection or their own embedded encryption. A secure connection to the file repository (which may require a VPN for remote access to internal sources). Support for the iOS document viewer to view supported document types (iWork, Microsoft Office, PDF, etc.). Authentication and authorization to enable or restrict access on a per- user, per-device basis. Ability to restrict or allow “Open In…” to control file movement to other apps. There are a few different flavors. Most require server components or plugins to repositories like Microsoft SharePoint. If the tool doesn’t isolate documents by restricting the “Open In…” feature, it is not suitable for enterprise use. Sandboxed file browser: These allow connections to enterprise file shares using standard connections and store the downloaded documents in an encrypted container. Most use Data Protection rather than to their own encryption scheme. They are usually read-only, although some support annotation of PDF files. Sandboxed cloud file browser: Instead of relying on direct network connections to enterprise file stores, these apps access cloud storage repositories and are specific to their cloud service. Mobile file management gateway: This is a more refined extension of the sandboxed file browser. Rather than allowing access directly to file repositories, mobile devices connect to the gateway using a sandboxed app and are then given access to files through the gateway. These support more granular policies, monitoring, and directory integration. They often also support multiple mobile platforms (yes, there is a world outside Apple).
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
iOS Data Security: Secure File Apps for Unmanaged DevicesTo finish our discussion of securing data on unmanaged devices, let’s focus on three categories of apps
designed for secure file access:
Sandboxed file browsers and mobile file gatewaysWhile messaging apps generally do a good job of handling email, they don’t necessarily link into file
servers or integrate into enterprise encryption. Secure file management apps skip messaging and focus
on access to enterprise file repositories. They support the following core features: Use of either iOS Data Protection or their own embedded encryption.
A secure connection to the file repository (which may require a VPN for remote access to internal sources).
Support for the iOS document viewer to view supported document types (iWork, Microsoft Office, PDF, etc.).
Authentication and authorization to enable or restrict access on a per-user, per-device basis.
Ability to restrict or allow “Open In…” to control file movement to other apps.
There are a few different flavors. Most require server components or plugins to repositories like Microsoft
SharePoint. If the tool doesn’t isolate documents by restricting the “Open In…” feature, it is not suitable
for enterprise use. Sandboxed file browser: These allow connections to enterprise file shares using standard
connections and store the downloaded documents in an encrypted container. Most use Data Protection rather than to their own encryption scheme. They are usually read-only, although some support annotation of PDF files.
Sandboxed cloud file browser: Instead of relying on direct network connections to enterprise file stores, these apps access cloud storage repositories and are specific to their cloud service.
Mobile file management gateway: This is a more refined extension of the sandboxed file browser. Rather than allowing access directly to file repositories, mobile devices connect to the gateway using a sandboxed app and are then given access to files through the gateway. These support more granular policies, monitoring, and directory integration. They often also support multiple mobile platforms (yes, there is a world outside Apple).
Document management system extensions: These are similar to a mobile file management gateway, but instead of a separate server they run as plugins to an existing document management system. Users connect directly to the document management system (such as SharePoint) via the extension/plugin, which might be centrally managed.
Some of these tools support commenting and annotating files (usually restricted to PDFs) but we know
expanded document editing is on the roadmap.
Sandboxed mobile file encryption appsMobile computing is one of the big drivers of cloud computing, and cloud storage is, in turn, expanding
use of encryption. Encryption apps extend on the sandboxed file browser by integrating with enterprise
encryption. They expand on the file browser by: Maintaining file and document isolation in the sandbox.
Transparently decrypting files accessed by the app (when integrated into an enterprise encryption scheme and key management server).
Accepting files from other apps via “Open In…” and keeping them encrypted in private storage, then enabling protected access to such files.
Support for connections to common cloud storage platforms such as Box.net and Dropbox.
The big division in this category is between apps designed to open files passed to them by other
applications, such as encrypted mail attachments, versus those that integrate directly into cloud storage
or other file browsers. Some tools also support decryption of password protected files versus those
managed using centralized enterprise keys.
When integrated with enterprise key management, the entire process of accessing encrypted files on iOS
is completely transparent to the user. They go into the app, which connects to the file store, and files are
stored within the app’s secure data store and decrypted as needed. The documents can then be
restricted so they are only usable within the app, as with our other sandboxing examples. Some apps also
support encryption of files from other apps.
This actually provides more protection than normal desktop encryption because it’s far easier to isolate
documents and keep them within the app.
Mobile Enterprise Digital Rights ManagementThe next option for handling files securely on unmanaged devices expands on encryption into Digital
Rights Management. EDRM provides more granular controls that travel with the documents, getting
closer to information-centric security. The easiest way to distinguish between an encryption app and
EDRM on iOS is: An encrypted document opened in a sandbox may be isolated in that app, but isn’t generally
protected when accessed on other systems which also have access (such as a laptop or desktop). Protection is binary, like a lockbox – controlling only who can access the file. We rely on the sandbox app for additional controls, such as restricting movement into other apps – usually on an all-or-nothing basis).
An EDRM protected document stays encrypted, but can only be opened by applications that respect the more granular controls applied to the file (including compatible mobile apps). This allows a wide range of control – including who can open the file, who can edit it, who can forward it via email, which devices can access it, and even time limits for access.
Encryption is for trusted users and environments, while EDRM also supports untrusted environments.
In the mobile space EDRM is better for protecting files you want to share externally and still protect –
while encryption is generally only suitable for internal use, or securely transmitting documents, but unable
to restrict what they can do once they have it. EDRM is very oriented towards office documents, while
encryption is better for arbitrary files.
Mobile EDRM requires a server or service to manage the keys. The rights themselves are embedded in
the documents. There are a variety of potential deployment models, including: Mobile file gateway
File server/SharePoint integration
Email client integration
Email server integration
Microsoft Office integration
To simplify this a bit: documents can either be manually protected when you create them in Office or
email them, when you upload them to an EDRM-enabled file gateway/storage platform, or automatically
when you save them into a protected directory or email them to a certain destination.
The documents can only be read using the vendor’s proprietary solution (app), which enforces all the
rights. Some tools integrate into Microsoft’s Windows Rights Management (RMS) service or another
EDRM platform which is integrated into Office.
Rights you can manage on a per file basis generally include: Who can read a file.
Who can edit a file (with the same annotation/commenting limitations we see in most iOS apps, although that should be changing soon).
Who can transfer a file out of the sandbox (“Open In…”).
Who can print a file.
Who can share a file (allow others to read it).
How long the file is accessible.
Who can copy/paste out of the file.
Unless you allow users to remove rights (or copy/paste out of the document), content is always encrypted
and protected as it moves around different locations, users, and platforms. Rights are tied directly to
users in enterprise environments through directory servers, so there is little sharing of credentials to allow
access. If you want to exchange protected documents with external users you have them download the
(usually free) app and send them the file, then use an alternate authentication and authorization model,
such as federation.
For external users or mobile users without VPN access, your keys and rights management server must to
be Internet accessible – perhaps hosted by a SaaS provider.
Sandboxed file browsers, mobile encryption, and mobile EDRM all use the same basic model – a
sandboxed app for handling files – with different degrees of security, flexibility, and integration.
This covers all our options for unmanaged devices, nearly all of which also come into play on partially-
managed or fully-managed devices… which we will cover in our next post, followed by advice on how to
choose a strategy.
—Rich
Download & ResourcesSign up fro our newsletter to get the latest updates.
Submit
View our FREE mini-courses!
Discounted Boot Camps
IOS Application Security Part 20 – Local Data Storage (NSUserDefaults, CoreData, Sqlite, Plist files)
In this article, we will look at the different ways in which applicatons can store data locally on the
device and look at how secure these methods are.
We will be performing some of these demonstrations in a sample app that you can download
from my github account. For the CoreData example, you can download the sample app
from here
One of the other things that we will doing different in this example is that we will be running the
application on the IOS simulator using Xcode rather than on the device and hence will be
analyzing the application on our computer rather than on the device. This is just to demonstrate
that you can perform all the steps performed before in previous articles on your system as well
by running the application via Xcode. Optionally, you can simply run the application on your
device using the steps mentioned here.
NSUserDefaults
One of the most common ways of saving user preferences and properties in an application is by
using NSUserDefaults. The information stored in NSUserDefaults persists even if you close the
application and start it again. One of the examples of saving information in NSUserDefaults is
the logged in state of the user. We can save the logged in state of the user (YES or NO) in
NSUserDefaults so that when the user closes the application and starts it again, the application
can fetch data from NSUserDefaults and display different UI to the user depending on whether
he is logged in or not. Some applications also use this feature to save confidential information
like the user’s access token so that the next time the application launches, they can just use that
access token to authenticate the user again.
Download the sample application from my github page and run it. You will get this view. Now
enter some info in the text field related to NSUserDefaults and tap the button that says Save in
NSUserDefaults. This will save the data to NSUserDefaults.
What most people do not realize is that the data saved by NSUserDefaults is not encrypted and
can be easily viewed from the application bundle. It is stored in a plist file with the name as
the bundle Id of the application. First of all, we must find the application bundle for our
application. Since we are running the application on our system, we can find our applications on
the path /Users/$username/Library/Application Support/iPhone Simulator/$ios version of
simulator/Applications/. In my case, the location is
Want to learn more?? The InfoSec Institute Web Application Penetration Testing Boot Campfocuses on preparing you for the real world of Web App Pen Testing through extensive lab exercises, thought provoking lectures led by an expert instructor. We review of the entire body of knowledge as it pertains to web application pen testing through a high-energy seminar approach.
The Web Application Penetration Testing course from InfoSec Institute is a totally hands-on learning experience. From the first day to the last day, you will learn the ins and outs of Web App Pen Testing by attending thought provoking lectures led by an expert instructor. Every lecture is directly followed up by a comprehensive lab exercise (we also set up and provide lab workstations so you don't waste valuable class time installing tools and apps). Benefits to you are:
Get CWAPT Certified Learn the Secrets of Web App Pen Testing in a totally hands-on
classroom environment Learn how to exploit and defend real-world web apps: not just silly
sample code Complete the 83 Step "Web App Pen Test Methodology", and bring a
copy back to work with you Learn how perform OWASP Top 10 Assessments: for PCI DSS
compliance
VIEW WEB APP PEN TEST
As you can see from the code, you can always specify a custom path for the plist file. We can
then search the entire application bundle for all plist files. In this case, we find a file named
userinfo.plist inside the application bundle.
As we can see, it contains the user/pass combination that we had entered in the fields before.
CoreData and Sqlite files
Since CoreData basically uses Sqlite internally to save information, we are only going to cover
CoreData here. If you don’t know what CoreData is , here is a screenshot from Apple’s
documentation about CoreData.
So basically, CoreData can be used to create a model, manage relationships between different
types of objects, save the data locally, and fetch them from the local cache whenever you want
with queries. In this tutorial, we will be using a sample application from github. Once you run it