How can I write a sandbox for iOS in purpose of check ing vulnerabilities? - iphone

I need to write a sandbox for iOS. The goal is to monitor malicious app. It need to have the capability of moving apps on my iPhone into my sandbox and monitor malicious app if there is.
I only need that as a simulation meaning I’ll write two apps one malicious and one safe and while trying to move them into my sandbox I need to send some info about the apps to my back-end that checks for vulnerability.
I only care about understanding how to create this sand box and have this communication with those two apps. Any idea from where should I start?

Related

avoiding app store subscription (and implementing your own)

We're building a cloud service that will enable users using misc mobile devices (iPhones, Androids, new Nokias...) to sync their data to the cloud. We plan to charge for the device cloud sync capability through a monthly subscription on our website. Our users will pay a single monthly subscription and then use the service across all their devices, regardless of the platform. Users without subscription will be able to use parts of the app without the cloud sync.
Will the kind folks at the AppStore accept this kind of behavior since we're in a way avoiding the in app purchases - the app will be free, and the user will be paying for the service on our website.
I am aware that the Kindle app for iOS uses the same behavior, so I am guessing this should be possible. From what I saw here:
Will Appstore accept this kind of application?
it should be applicable in my case. Does anyone else have any additional info regarding this?
As far as I know yes as spotify, mog and other music streaming services all behave this way

Monitoring the other Apps from one app in iPhone

I need to create and App that will run in the background and will monitor the user's behavior in term of applications installed, opened and deleted.
i.e Application will save the information in the database that at what time user has installed/opened/deleted an application in iphone.
I wonder if its possible and Apple will allow this??
I tried to google on it but did not get anything, i know if its possible then it would be possible by multiasking only??
Can any one please help me on the same.
Brn
Not possible. Your app can only run when the user chooses to (except for a limited sub-set of tasks like VoIP, etc).
Your app can know nothing about other apps.
iOS apps are sandboxed. I wouldn't say impossible but certainly not allowed. You'd have to find a security hole to give you root access first. Oh, and notify us when you do ;).
Edit:
Maybe it wasn't clear in my post but I was at least half joking. Not sure why you want to do what you want to do. I can imagine the following scenarios:
1) Your company wants to monitor everything their users do on their phones. In that case I would either
a) lock them down and only allow app installation through a company portal (enterprise distribution is possible in iOS) OR
b) forget about iOS alltogether. Blackberry would probably be closer to what you want, although I don't really have experience with that platform. Also, its future is not sure.
2) You're trying to do something illegitimate. Because of iOS's locked down nature it won't be easy. See how few successful attacks there have been in the last years - and that's for a highly successful platform where an attack could be high paying both in terms of money and reputation.

iPhone app autostart without jailbreak

I am new to iPhone apps developing. Just need my app to do some cyclic job (like a cron). Doing this that way prevent from overconsuming battery.
As I realized I could use /System/Library/LaunchDaemons, but I am not sure if I could use it without jailbreaking iPhone?
As you cannot write outside your designated application area on a non-jailbroken phone, you will not be able to access that path. Neither does Apple seem to encourage or support this kind of service as even keeping an active app in the background is impossible except for a few corner cases (location-aware, voip, ...) [on non-jailbroken devices on course].
You might consider (depending on the case) using Push notifications, specifically remote push notifications. These are issued from your server to apple servers which in turn notify the target phone whenever it is online. The user then has the option to dive into your app again which can display/handle the data. This is a method to resolve many cases where one might resort to polling, e.g. instant message scenarios. Of course this requires that it fits your application profile and that you have a server under your control that can handle the required task and that the app merely displays some information.

How do I upload files using http/ftp to iphone/ipad? (Eg. ifile, goodreader)

Is there any good advice on uploading files to the device? I've seen many apps create a http server on 80 or 8080 to upload files. Does that mean I have to implement a server too?
Are there any 3rd-party libraries? (Preferably open-source and non-GPL)
EDIT: I am going to upgrade files in the app for specific devices in a corporate environment, so the ipad pulling files from a central server is also an alternative. But I would have to send messages to these ipads to tell them to fetch those files.
But I would have to send messages to
these ipads to tell them to fetch
those files.
Push Notification Programming Guide
Or mail with custom URL scheme for launching your application.
iOS Application Programming Guide - Implementing Custom URL Schemes
I assume what you want is a kind of automatic update. An app do something by order from server without user's manual operation.
I don't know enterprise-license specific feature of iOS. But I believe there's no such enterprise-specific APIs. And as I know, automatic update is almost impossible. Because,
There is no system-level support for automatic update. (yet?)
So messaging and fetching feature should be implemented in app.
But no app is guaranteed to run in background for long time.
And also user can turn off any app at any time.
There is no way to send message to an app which is not running.
Even you can send, there is no way to address each client form the server.
If your app is running, sending message or commanding them to fetch or do anything is just a simple work. The problem is there is no regular way to force them always keep alive. Even under situations like OS reboot or abnormal termination.
However there is an alternative. Just registering app as VOIP app like Skype. OS does not keep the app running too, but will monitor specific socket port, and will wake your app when the socket receives some message. For more details, see here: http://developer.apple.com/library/ios/documentation/iphone/conceptual/iphoneosprogrammingguide/BackgroundExecution/BackgroundExecution.html#//apple_ref/doc/uid/TP40007072-CH5-SW15
In AppStore, an app using VOIP for other purpose like automatic update will not be passed, but you have no need to concern about it.
And other way to send message to device without running app is push notification. This is a feature supported in system-level. But this is not designed to commanding app. This is designed to send textual message. So If your app is not running, the message will be displayed to user. However, you can guide the user to start the app by sending push notification.
As a final option, you can request some feature to Apple for enterprise environment. If your company is big enough to get an enterprise license, Apple will consider your feature request seriously.
If you decided to use VOIP method, I'm sorry I can't help you any more. I have no experience of implementing this kind of app. But it should not so hard.
However hard part is server. It definitely require custom server program which keeps TCP/IP connection. Regular HTTP server cannot be used. Because HTTP itself is designed as not to keep TCP/IP connection. You have to build this kind of server yourself from scratch. You'll have to handle lower level TCP/IP transmissions.
There are a few solutions(both of free/commercial) for this kind of server, but none of are popular because this kind of server regularly needs full customization. So there's nothing to re-use or share.
However I believe this is most suitable implementation for your app.
If you can satisfy automatic update only when the app is running, you can archive it by polling server status from the client periodically.
This is easy to implement because you can use regular HTTP servers for this. Client connect and download recent updates from central server periodically. If there is a new update, just fetch and do what you want. And the app is launched, just check the update at first. Prevent all operation until update applied.
This is regular way. Most of applications are built with this method. In this case, you have no need to implement server or hard thing.
However applying speed of update is depend on polling period.
(Edit)
I couldn't care about private APIs. Because your app is not for AppStore, so you can use private API's freely. (This is different thing with jail-breaking. There are so many hidden features by excluded from documentation) I don't know about private APIs, but it's possible there is some API which enable the support for keep-alive of the app.
However, this reverse engineering work is so painful unless you're born to hack.
You may try to use the following open-source in your project:
http://code.google.com/p/cocoahttpserver/
https://github.com/robin/cocoa-web-resource/wiki
Apple has some sample code on their website that details exactly what you're looking for:
http://developer.apple.com/library/mac/samplecode/CocoaHTTPServer/CocoaHTTPServer.zip
So you have a couple options:
You could distribute your app wirelessly within your organization and push new content out as app updates. Apple provides this option to their Enterprise Developers.
Wireless App Distribution
iPhone enables enterprises to securely host and wirelessly distribute in-house apps to employees over Wi-Fi and 3G. Apps can be updated without requiring users to connect to their computers. In-house apps can be hosted on any web server accessible to users. Users simply tap on a URL to install apps wirelessly without needing to connect to their computers.
The alternative is you configure the app to fetch the updated data. You describe adding an HTTP server to the iOS device, but there's no way the server can receive data when the app isn't running. Given your needs, it would probably work better to embed a web client in your app instead.
If I was in your shoes (and option #1 didn't work), I'd use ASIHTTPRequest to check with a server at launch/daily. If there are new updates, the app could then either prompt the user that there are new data files to download, or it could just silently download them in a background thread.
UPDATED: Perhaps I should have been more explicit about how to do #2. You can configure the download so it isn't interrupted when the user quits the app (you don't need to do a Voip hack). Check out the Completing a Finite Length Task in the Background section in the iOS Programming Guide.
There are http server sample codes from Apple and open source community such as cocoahttpserver TouchHTTPD.
You can upload file to the http server on iphone.
Here's a blog and screen-shots about running cocoahttpserver and upload file to iphone.
The Python CGIHTTPServer allows you to create a server in 0 lines of code:
jcomeau#intrepid:~/rentacoder/bin2txt$ python -m CGIHTTPServer
Serving HTTP on 0.0.0.0 port 8000 ...
Actually implementing a script to parse the input and save the file would take a little more effort.
[later]
OK, so forget about that, Apple doesn't allow it. See Local server on iPad for the iPad at least.

UI less application in iOS4

I'm new to mac/iOS development. I'm thinking of to develop a UI less application by using existing Apps/Libraries.
I want to know whether following things will be possible to make or not, it will be great if someone provides me some insight.
Here are my questions:
Is it possible to show/hook additional buttons on existing contacts
-> contacts view (some additional buttons under FaceTime button)?
Is it possible to route some messages to SMS inbox? where the user
feels like he received/sent the real SMS?
In short: no.
In somewhat longer: iOS applications run in a sandbox that rather severely limits their ability to interact with the outside world. This is for the purpose of protecting the user's security and experience using the device. It MIGHT be possible to accomplish both of those things if you were running on a jailbroken device and using non-public APIS (though frankly I doubt you'd be able to add buttons to the existing contacts list by any means at all). But such an app couldn't be sold in Apple's app store.