Best practices for iOS applications security

Question

When thinking about iPhone/iPad applications security, I can notice that there is:

• Widely available hacking tools allow filesystem access
• Network interception, men in the middle attack

==> data theft threat

and also:

• Availability of hacking tools that allow to freely share a paid app with friends/community (seen in Cydia)
• Availability of hacking tools that allow to get in app purchases without paying (seen in Cydia, and heard that it doesn't work with any app)

==> Revenue loss threat

So I am wondering #1 what are best practices to get a better security in iOS application? Also, #2 what are best ways to reduce revenue loss and minimise hacking exposure?

for #1 I've seen some WWDC slides about security 1 2 3 4 + apple docs

and I can say that between theses best practices there are:

• Using APIs Offering Data Protection (like NSFileManager with NSFileProtectionKey attribute)
• Using Keychain
• Protecting sensitive data with SSL and using certificates

for #2 I think that using a business model based on free application, then in app purchase with Store Receipts verification can be the model with minimum revenue loss.

What are your best practices for security, and best way to minimise app hacking chances?

Answer 1

#1 what are best practices to get a better security in iOS application?

Appropriate data security is highly dependent on the nature of the information. Is it long-lived or short-lived? Is it a general credential that can be used to open other things, or a single piece of data? Is the potential loss privacy, financial, or safety? Determining the appropriate protections requires a specific case and has no general answer. But you ask for best practices and there are several. None of them are perfect or unbreakable. But they are best practice. Here are a few:

• Store sensitive information in Keychain
• Set Data Protection to NSFileProtectionComplete wherever possible.
• Do not store sensitive data you don't actually need, or for longer than you need.
• Store application-specific authentication tokens rather than passwords.
• Use HTTPS to verify the server you are contacting. Never accept an invalid or untrusted certificate.
• When connecting to your own server, validate that the service presents a certificate that you have signed, not just "a trusted certificate."

This is just a smattering of approaches, but they set the basic tone:

• Use the built-in APIs to store things. As Apple improves security, you get the benefits for free.
• Avoid storing sensitive information at all and minimize the sensitivity of what you do store.
• Verify the services you communicate with.

#2 what are best ways to reduce revenue loss and minimise hacking exposure?

This has been discussed many times on SO. This answer includes links to several of the other discussions:

Secure https encryption for iPhone app to webpage

The short answer is: worry about your customers, not your non-customers. Many pirates will never, ever pay you money, so your time and money are better spent helping your actual customers want to pay you, and making it easy for them to do so. Focus on making more money rather than protecting yourself from money that you could never have. Never, ever, tick off a paying customer in your efforts to chastise a non-paying customer. Revenge is a sucker's game and a waste of resources.

There are two great ways to avoid piracy:

• Don't publish.
• Publish junk no one wants.

There are some basic things you can do that are worth it just, as they say, to keep honest people honest (some are discussed in the various linked discussions). But don't lie awake nights worrying about how to thwart pirates. Lie awake worrying about how to amaze your customers.

And always remember: Apple spends more money than most of us have ever seen in our lives trying to secure the iPhone. Still it's jailbroken. Think about what your budget is going to achieve.