How to make iOS application tamper-evident?

Question

I am working on a project (mobile app) where I need to monitor adversary actions. So, my question is how can I make iOS app tamper-evident?

e.g.

• Whenever any adversary try to tamper code then system should alert admin for these actions
• and block that adversary
• If user tries to install app on rooted device then system can detect that.
• System should able to monitor adversary actions.

I found solution for android like ProGuard, SafetyNet but did not found anything for iOS.

Answer 1

Apart from detecting jailbroken device, and obfuscating code (as @itechnician mentioned), you can:

• Detect if debugger is attached: https://developer.apple.com/library/content/qa/qa1361/_index.html
• Check the load commands in Mach-O header to check if there's anything injected
• Check code integrity

Anyway, all of these can be easily bypassed when on jailbroken device (even the check if it's jailbroken). The best way is to use multiple techniques including obfuscation, to make tampering as hard as possible (so it's not worth it). But I'm not sure if you could make fully tamper-proof app.

You might find these links useful:

https://www.coredump.gr/articles/ios-anti-debugging-protections-part-1/ https://www.raywenderlich.com/45645/ios-app-security-analysis-part-1 http://resources.infosecinstitute.com/ios-application-security-part-31-problem-using-third-party-libraries-securing-apps/

This book is a bit old, but still useful: http://shop.oreilly.com/product/0636920023234.do

Here are opensource ObjC obfuscators/string encryptors:

• https://github.com/Polidea/ios-class-guard
• https://github.com/FutureWorkshops/Objc-Obfuscator
• https://github.com/pjebs/Obfuscator-iOS

Answer 2

I've used this JailBreak detection in one of my project.

With this, you can prevent the possibility.

    if ([DTTJailbreakDetection isJailbroken]) {

// your custom activity and business logic here
    }

Also, In precise you can use the below snippet:

BOOL isJailbroken()
{
#if !(TARGET_IPHONE_SIMULATOR)

   if ([[NSFileManager defaultManager] fileExistsAtPath:@"/Applications/Cydia.app"] ||
       [[NSFileManager defaultManager] fileExistsAtPath:@"/Library/MobileSubstrate/MobileSubstrate.dylib"] ||
       [[NSFileManager defaultManager] fileExistsAtPath:@"/bin/bash"] ||
       [[NSFileManager defaultManager] fileExistsAtPath:@"/usr/sbin/sshd"] ||
       [[NSFileManager defaultManager] fileExistsAtPath:@"/etc/apt"] ||
       [[NSFileManager defaultManager] fileExistsAtPath:@"/private/var/lib/apt/"] ||
       [[UIApplication sharedApplication] canOpenURL:[NSURL URLWithString:@"cydia://package/com.example.package"]])  {
         return YES;
   }

   FILE *f = NULL ;
   if ((f = fopen("/bin/bash", "r")) ||
      (f = fopen("/Applications/Cydia.app", "r")) ||
      (f = fopen("/Library/MobileSubstrate/MobileSubstrate.dylib", "r")) ||
      (f = fopen("/usr/sbin/sshd", "r")) ||
      (f = fopen("/etc/apt", "r")))  {
         fclose(f);
         return YES;
   }
   fclose(f);

   NSError *error;
   NSString *stringToBeWritten = @"This is a test.";
   [stringToBeWritten writeToFile:@"/private/jailbreak.txt" atomically:YES encoding:NSUTF8StringEncoding error:&error];
   [[NSFileManager defaultManager] removeItemAtPath:@"/private/jailbreak.txt" error:nil];
   if(error == nil)
   {
      return YES;
   }

#endif

   return NO;
}

Also , Obfuscation in iOS - objective C you can use this open source-library and for Methods & Classes.