The document discusses research conducted by Gregg Ganley and Gavin Black at MITRE in FY13-14 on iOS mobile application security. It describes their work on a tool called iMAS (iOS Mobile Application Security) which aims to provide additional security controls and containment for native iOS applications. iMAS addresses vulnerabilities related to runtime access, device access, application access, data at rest, and threats from app stores/malware. It utilizes techniques like encrypted code modules, forced inlining, secure MDM and more to raise security levels above standard iOS but below a fully customized/rooted mobile device environment. The document outlines the motivation, capabilities and future research directions for the iMAS project.

1. FY13 -14 MITRE Research
Research Team: Gregg Ganley(PI) and Gavin Black
Approved for Public Release: Case #13-2148

2. 


–

© 2013 The MITRE Corporation. All rights reserved.
Approved for Public Release: Case #13-2148

3. © 2013 The MITRE Corporation. All rights reserved.
Approved for Public Release: Case #13-2148

4. 
–
–
–
–

–
–
–
–
–
–

© 2013 The MITRE Corporation. All rights reserved.
Approved for Public Release: Case #13-2148

5. 

–
–



–
–
–

–
–
–
© 2013 The MITRE Corporation. All rights reserved.
Approved for Public Release: Case #13-2148

6. 



7. 4 Digit Passcode
Native iOS Application
App Signing
App Store
System components:
RAM and Debugger
Jailbreak / Root
Access
User Auth
App Access
Keychain
Flash Data Storage
SSH / Debugger
iOS Core Services
iOS
Internet
iPhone / iPad Hardware
Vulnerable Areas
Approved for Public Release: Case #13-2148

8. iMAS Secure Application Container
iMAS
Native iOS Application
Secure MDM
Control
AppPassword
Passcode
Check
Security-Check Encrypted Core
Data
Jailbreak / debugger
attach
AppIntegrity
Check
AppSignature Encrypted RAM Memory Check
Check
Disk
Secure Foundation
OpenSSL FIPS
Dynamic App Bundling
ECM
Encrypted Code
Modules










Off Device Trust Check



iOS
iPhone / iPad Hardware
App Store
Malware
SSH / Debugger


iOS Core Services
Enterprise
App Store



Tolerable
Security Risk
Open Source
github.com/project-imas
Approved for Public Release: Case #13-2148

9. Developer Access
Apple Only
Apple Only
© 2013 The MITRE Corporation. All rights reserved.
Approved for Public Release: Case #13-2148

10. DoD CIO Report FY11

50% (12) iMAS Applicable
© 2013 The MITRE Corporation. All rights reserved.
Approved for Public Release: Case #13-2148

11. 60% (6) iMAS Apply
Approved for Public Release: Case #13-2148

12. Security
Controls
Open Source
iOS w/iMAS
Art of the Possible (2014+)
iMAS
iOS w/iMAS
with or without COTS
iMAS (Sep 2014)
Sept 2013 level
iMAS (Sep 2013)
iOS w/COTS
App
MDM Containers
iOS
iOS v4/5
iOS v6
iMAS
iMAS controls raise security
levels, bringing it closer to the
Art of the Possible
State of the Art (Sep 2013)
Consumer
Unclassified (Internet)
iMAS (Sep 2014)
State of the Art (Sep 2013)
Enterprise
Enterprise+
Sensitive (NIPRNET/MITRE)
Mobile App Classification Level
Approved for Public Release: Case #13-2148
Classified (SIPRNET/JWICS)

13. Approved for Public Release: Case #13-2148

14. Run-time:
Device Access:
4 Digit Passcode
RAM and Debugger
Passcode
Check
Jailbreak / Root
Access
App Access:
Security-Check
Jailbreak / debugger
attach
None
Memory
Security
AppPassword
Encrypted RAM
Disk
Data At Rest:
AppStore / Malware:
App Tampering
Forced-inlining
AppIntegrity
Check
Encrypted Code
Modules (ECM)
Data in Transit:
Keychain
CoreData
Encrypted Core
Data
Lightning Connector
iMAS
Secure Foundation
OpenSSL / FIPS
MDM Remote Control
Vulnerable Areas
Future Research
Approved for Public Release: Case #13-2148

15. 
–
–

–
–
–

–
–
Approved for Public Release: Case #13-2148

16. 
–
–

–
–

–
Approved for Public Release: Case #13-2148

17. 
–
–
–


–

Approved for Public Release: Case #13-2148

18. 

–
–
 always_inline
–
–
void debug_check()__attribute__((always_inline));

–
–

(-finline-limit)
always_inline
Approved for Public Release: Case #13-2148

19. 
Passcode
Check
AppPassword








Security-Check Encrypted Core
Data
Jailbreak / debugger
attach
Secure Foundation
OpenSSL
OpenSSL FIPS Forced-inlining
Memory
Security
MDM Remote
Control
iMAS


AppIntegrity
Check
Encrypted Code Secure MDM
Modules (ECM) Remote Control

Encrypted RAM
Disk
Dynamic App
Bundling
Off-device Trust
Check
© 2013 The MITRE Corporation. All rights reserved.
Approved for Public Release: Case #13-2148

20. Approved for Public Release: Case #13-2148

21. 






Approved for Public Release: Case #13-2148

22. Approved for Public Release: Case #13-2148

23. Approved for Public Release: Case #13-2148

24. Approved for Public Release: Case #13-2148

25. •
iMAS Possibilities:
Apple Push
Notification Servers
Find limitations
Of MDM
specification
•
•
Single sign on app
Remote App lock
•
•
Remote App password reset
Remote Jailbreak reporting
Understand and test
low level command
structure
iOS Device
iMAS
App
3. JSON formatted commands and acknowledgements
Open Source
MDM Server
0. Device Enrollment (Root Certificate, Enroll.mobileconfig)
Ability to secure
individual apps
Provide scripts
and guidance for
initial setup
Approved for Public Release: Case #13-2148
Maintain and
enhance
open source
MDM server

26. Approved for Public Release: Case #13-2148

27. 



–
–
Approved for Public Release: Case #13-2148

28. 



–





AppPassword
–
–
Secure Foundation
OpenSSL / FIPS

Security-Check

Memory
Security
Jailbreak / debugger
attach
Approved for Public Release: Case #13-2148


30. Approved for Public Release: Case #13-2148

33. Approved for Public Release: Case #13-2148

34. 
–
–

–
–





–

35. 



36. …
…
© 2013 The MITRE Corporation. All rights reserved.
Approved for Public Release: Case #13-2148

37. Approved for Public Release: Case #13-2148

38. 

–




–
–
–
–
–
Approved for Public Release: Case #13-2148

39. 


–
Approved for Public Release: Case #13-2148

41. iMAS - iOS Mobile Application Security
Github:
https://project-imas.github.com
POC:
MITRE, Bedford MA
Gregg Ganley
781-271-2739
gganley@mitre.org
Please !
Gavin Black
• Share iMAS with SW Devs
781-271-4771
• Visit and Discover
gblack@mitre.org
• Download and Experiment
• Feedback and push requests
© 201312/17/2013 6:50 PM
The MITRE Corporation. All rights reserved.
Approved for Public Release: Case #13-2148

42. Approved for Public Release: Case #13-2148

43. 

–

–
–
–

–
–



44. FY12
MITRE Internal Research - MIP
mobile Patient Health Reader
© 2013 The MITRE Corporation. All rights reserved.
Approved for Public Release: Case #13-2148

45. 
–
–
–

–


–
–
© 2013 The MITRE Corporation. All rights reserved.
Approved for Public Release: Case #13-2148

46. 



–

–
■
•
•
© 2013 The MITRE Corporation. All rights reserved.
Approved for Public Release: Case #13-2148

47. Gregg Ganley Gavin Black








Approved for Public Release: Case #13-2148

48. iMAS Secure Application Container
iMAS
Native iOS Application
App Signing
Config
Profile
Extended App level
Passcode
App Store
Jailbreak
Detect /
Disable
RAM / Debugger
lib / techniques
Encrypted App
Files and keychain
Internet
SSH / Debugger




iOS Core Services
iOS
iPhone / iPad Hardware
Open Source Community


Approved for Public Release: Case #13-2148
Tolerable Security Risk

49. 

ECM
DynamicLib
Builder
iOS App
ECM
Plaintext
DynamicLib
ciphertext
DynamicLib
.dylib
• Protected Functionality
• Secured with ECM App Key

• At Install User
enters ECM App
Key
• Encrypted w/User
app password
ECM Decoder
iMAS Security
In Use:
Critical
Functionality
Encrypted
iOS App
iOS App
ECM
DynamicLib
ECM
ECM Decoder
DynamicLib
ECM Decoder
iMAS Security
Invulnerable to Decompiling
iMAS Security
User Enters app
password
ECM
DynamicLib
ECM Decoder
iMAS Security
At Rest:
iOS App
Critical Functionality
Unlocked
Approved for Public Release: Case #13-2148