{"id":1413,"date":"2014-11-14T15:00:08","date_gmt":"2014-11-14T07:00:08","guid":{"rendered":"http:\/\/wx.wosign.com\/?p=1413"},"modified":"2014-11-19T14:57:00","modified_gmt":"2014-11-19T06:57:00","slug":"%e4%b8%aa%e4%ba%ba%e9%93%b6%e8%a1%8c%e4%b8%9a%e5%8a%a1%e5%ba%94%e7%94%a8%e7%a8%8b%e5%ba%8f%e9%80%9a%e8%bf%87%e7%94%b5%e8%af%9d%e6%b3%84%e6%bc%8f%e4%bf%a1%e6%81%af","status":"publish","type":"post","link":"https:\/\/wx.wosign.com\/?p=1413","title":{"rendered":"iOS\u5e73\u53f0\u4e2a\u4eba\u7f51\u94f6APP\u7684\u5b89\u5168\u6d4b\u8bd5\u62a5\u544a"},"content":{"rendered":"

 <\/p>\n

Personal banking apps leak info through phone<\/p>\n

By Ariel Sanchez\u00a0<\/em><\/p>\n

\u51e0\u5e74\u6765\u6211\u4e00\u76f4\u5728\u9605\u8bfb\u6709\u5173\u5bb6\u5ead\u94f6\u884c\u5e94\u7528\u7a0b\u5e8f\u7684\u7f3a\u9677\uff0c\u4f46\u6211\u5f88\u6000\u7591\u3002\u8001\u5b9e\u8bf4\uff0c\u5f53\u6211\u5f00\u59cb\u7814\u7a76\u6211\u4e0d\u6307\u671b\u80fd\u627e\u5230\u4efb\u4f55\u6709\u610f\u4e49\u7684\u7ed3\u679c\u3002<\/p>\n

\u6211\u4eec\u7684\u76ee\u6807\u662f\u6267\u884c\u9ed1\u76d2\u548c\u9759\u6001\u5206\u6790\u5168\u7403\u79fb\u52a8\u5bb6\u5ead\u94f6\u884c\u5e94\u7528\u7a0b\u5e8f\u3002\u672c\u7814\u7a76\u4f7f\u7528iPhone \/ ipad\u8bbe\u5907\u6d4b\u8bd5\u524d60\u5927\u5168\u7403\u6700\u5177\u5f71\u54cd\u529b\u7684\u94f6\u884c\u4e2d\u768440\u5bb6\u5bb6\u5ead\u94f6\u884c\u5e94\u7528\u7a0b\u5e8f\u3002<\/p>\n

\u4e3a\u4e86\u83b7\u5f97\u4e00\u4e2a\u5168\u7403\u6027\u7684\u56fd\u5bb6\u5b89\u5168\u89c2\uff0c\u6765\u81ea\u4e0b\u5217\u56fd\u5bb6\u7684\u4e00\u4e9b\u66f4\u91cd\u8981\u7684\u94f6\u884c\u88ab\u7eb3\u5165\u7814\u7a76\uff1a<\/p>\n

\"1\"<\/a><\/p>\n

\u76f8\u5173\u95ee\u9898<\/strong><\/p>\n

\u672c\u7814\u7a76\u662f\u572840\u5c0f\u65f6\u5185\u5b8c\u6210\uff08\u4e0d\u8fde\u7eed\u7684\uff09\u3002<\/p>\n

\u4e3a\u4e86\u4fdd\u62a4\u8fd9\u4e9b\u5e94\u7528\u7a0b\u5e8f\u7684\u6240\u6709\u8005\u53ca\u5176\u7528\u6237\uff0c\u672c\u7814\u7a76\u6ca1\u6709\u516c\u5e03\u53d1\u73b0\u7684\u6f0f\u6d1e\u4ee5\u53ca\u5229\u7528\u5b83\u4eec\u7684\u65b9\u6cd5<\/p>\n

\u6240\u6709\u7684\u6d4b\u8bd5\u90fd\u53ea\u5728\u5e94\u7528\u7a0b\u5e8f\uff08\u5ba2\u6237\u7aef\uff09\u4e0a\u6267\u884c\uff1b\u7814\u7a76\u6392\u9664\u4e86\u4efb\u4f55\u670d\u52a1\u5668\u7aef\u7684\u6d4b\u8bd5\u3002<\/p>\n

\u5df2\u7ecf\u8054\u7cfb\u4e86\u4e00\u4e9b\u53d7\u5f71\u54cd\u7684\u94f6\u884c\u5e76\u63d0\u4ea4\u4e86\u6f0f\u6d1e\u62a5\u544a<\/p>\n

 <\/p>\n

\u8bd5\u9a8c<\/strong><\/p>\n

\u4ee5\u4e0b\u4e3a\u6bcf\u4e2a\u5e94\u7528\u7a0b\u5e8f\u8fdb\u884c\u6d4b\u8bd5\uff1a<\/p>\n

\u4f20\u8f93\u5b89\u5168<\/p>\n

\u660e\u6587\u6d41\u91cf<\/p>\n

\u4e0d\u5f53\u7684\u4f1a\u8bdd\u5904\u7406<\/p>\n

\u6b63\u786e\u9a8c\u8bc1SSL\u8bc1\u4e66<\/p>\n

\u7f16\u8bd1\u5668\u7684\u4fdd\u62a4<\/p>\n

\u53cd\u7834\u89e3\u4fdd\u62a4<\/p>\n

PIE\u7f16\u8bd1<\/p>\n

\u7528stack cookies\u7f16\u8bd1<\/p>\n

\u81ea\u52a8\u5f15\u7528\u8ba1\u6570<\/p>\n

uiwebviews<\/p>\n

\u6570\u636e\u9a8c\u8bc1\uff08\u8f93\u5165\uff0c\u8f93\u51fa\uff09<\/p>\n

\u5206\u6790UIWebView\u7684\u5b9e\u73b0<\/p>\n

\u4e0d\u5b89\u5168\u7684\u6570\u636e\u5b58\u50a8<\/p>\n

SQLlite\u6570\u636e\u5e93<\/p>\n

\u6587\u4ef6\u7f13\u5b58<\/p>\n

\u68c0\u67e5\u5c5e\u6027\u5217\u8868\u6587\u4ef6<\/p>\n

\u8bf7\u68c0\u67e5\u65e5\u5fd7\u6587\u4ef6<\/p>\n

Logging<\/p>\n

\u81ea\u5b9a\u4e49\u65e5\u5fd7<\/p>\n

nslog\u62a5\u8868<\/p>\n

\u5d29\u6e83\u62a5\u544a\u6587\u4ef6<\/p>\n

\u4e8c\u5143\u5206\u6790<\/p>\n

\u5206\u89e3\u5e94\u7528<\/p>\n

\u68c0\u6d4b\u7684\u6c47\u7f16\u4ee3\u7801\u4fdd\u62a4\u6df7\u6dc6<\/p>\n

\u68c0\u6d4b\u9632\u7be1\u6539\u4fdd\u62a4<\/p>\n

\u68c0\u6d4b\u53cd\u8c03\u8bd5\u4fdd\u62a4<\/p>\n

\u534f\u8bae\u5904\u7406\u7a0b\u5e8f<\/p>\n

\u5ba2\u6237\u7aef\u6ce8\u5165<\/p>\n

\u7b2c\u4e09\u65b9\u7684\u5e93<\/p>\n

 <\/p>\n

\u6982\u8981<\/strong><\/p>\n

\"2\"<\/p>\n

\u6240\u6709\u7684\u5e94\u7528\u7a0b\u5e8f\u53ef\u4ee5\u5b89\u88c5\u4e00\u4e2a\u8d8a\u72f1\u7684iOS\u8bbe\u5907\u3002\u8fd9\u6709\u52a9\u4e8e\u52a0\u5feb\u9759\u6001\u9ed1\u76d2\u5206\u6790\u3002<\/p>\n

\u9ed1\u76d2\u5206\u6790\u7ed3\u679c<\/strong><\/p>\n

\u4e0b\u5217\u5de5\u5177\u7528\u4e8e\u9ed1\u76d2\u5206\u6790\uff1a<\/p>\n

otool (object file displaying tool)[1]<\/sup><\/p>\n

Burp pro (proxy tool)[2]<\/sup><\/p>\n

ssh (Secure Shell)<\/p>\n

 <\/p>\n

 <\/p>\n

40%\u7ecf\u5ba1\u6838\u7a0b\u5e8f\u7684APP\u6ca1\u6709\u4f7f\u7528SSL\u8bc1\u4e66\u9a8c\u8bc1\u771f\u5b9e\u6027\u5c31\u63d0\u4ea4\u4e86\u3002\u8fd9\u4f7f\u5f97\u4ed6\u4eec\u5bb9\u6613\u53d7\u5230\u4e2d\u95f4\u4eba\u653b\u51fb\u3002[ 3 ]<\/p>\n

\u4e00\u4e9b\u5e94\u7528\u7a0b\u5e8f\uff08\u5c0f\u4e8e20%\uff09\u6ca1\u6709\u4f4d\u7f6e\u72ec\u7acb\u7684\u53ef\u6267\u884c\u7a0b\u5e8f\uff08PIE\uff09\u548c\u5806\u6808\u6ea2\u51fa\u4fdd\u62a4\u529f\u80fd\u3002\u8fd9\u53ef\u80fd\u6709\u52a9\u4e8e\u51cf\u8f7b\u5185\u5b58\u6cc4\u6f0f\u653b\u51fb\u7684\u98ce\u9669\u3002<\/p>\n

 <\/p>\n\n\n\n
>#otool \u2013hv MobileBank\u624b\u673a\u94f6\u884cMach headermagic cputype cpusubtype\u00a0 caps\u00a0\u00a0\u00a0 filetype ncmds sizeofcmds\u00a0\u00a0\u00a0\u00a0\u00a0 flagsMH_MAGIC\u00a0\u00a0\u00a0\u00a0 ARM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 V6\u00a0 0x00\u00a0\u00a0\u00a0\u00a0 EXECUTE\u00a0\u00a0\u00a0 24\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 3288\u00a0\u00a0 NOUNDEFSDYLDLINK PREBOUND TWOLEVEL<\/p>\n

 <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

\u8bb8\u591a\u5e94\u7528\u7a0b\u5e8f\uff0890%\uff09\u5305\u542b\u51e0\u4e2a\u65e0SSL\u7684\u94fe\u63a5\u8d2f\u7a7f\u5728\u5e94\u7528\u4e2d\u3002\u8fd9\u5141\u8bb8\u653b\u51fb\u8005\u622a\u83b7\u6d41\u91cf\uff0c\u6ce8\u5165\u4efb\u610fJavaScript \/ HTML\u4ee3\u7801\uff0c\u8bd5\u56fe\u521b\u5efa\u4e86\u4e00\u4e2a\u865a\u5047\u7684\u767b\u5f55\u63d0\u793a\u6216\u7c7b\u4f3c\u7684\u9a97\u5c40\u3002<\/p>\n

 <\/p>\n

\u6b64\u5916\uff0c\u53d1\u73b050%\u7684\u7a0b\u5e8f\u5f88\u5bb9\u6613\u901a\u8fc7UIwebview\u53d7\u5230JavaScript \u6ce8\u5165\u653b\u51fb\uff0c\u901a\u8fc7\u4e0d\u5b89\u5168\u6ce8\u5c04\u7684<\/p>\n

UIWebView JavaScript\u5b9e\u73b0\u3002\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0b\uff0c\u539f\u751fiOS\u529f\u80fd\u88ab\u66b4\u9732\uff0c\u5141\u8bb8\u53d7\u5bb3\u8005\u7684\u8bbe\u5907\u53d1\u9001\u77ed\u4fe1\u6216\u7535\u5b50\u90ae\u4ef6\u3002<\/p>\n

\"3\"<\/p>\n

\u4e00\u79cd\u65b0\u7684\u7f51\u7edc\u9493\u9c7c\u653b\u51fb\u5df2\u7ecf\u53d8\u7684\u5f88\u6d41\u884c\uff0c\u53d7\u5bb3\u8005\u56e0\u4e3a\u7f51\u4e0a\u94f6\u884c\u5bc6\u7801\u5df2\u8fc7\u671f\uff0c\u800c\u6309\u63d0\u793a\u8f93\u5165\u81ea\u5df1\u7684\u7528\u6237\u540d\u548c\u5bc6\u7801\u3002\u653b\u51fb\u8005\u7a83\u53d6\u53d7\u5bb3\u8005\u7684\u51ed\u8bc1\u5e76\u5b8c\u5168\u83b7\u5f97\u4e86\u8bbf\u95ee\u7528\u6237\u5e10\u6237\u7684\u6743\u9650\u3002<\/p>\n

\u4e0b\u9762\u7684\u793a\u4f8b\u663e\u793a\u5176\u4e2d\u5bb6\u5ead\u94f6\u884c\u5e94\u7528\u8106\u5f31\u7684UIWebView\u5b9e\u73b0\u3002\u5b83\u5141\u8bb8\u4e00\u4e2a\u865a\u5047\u7684HTML\u5f62\u5f0f\u88ab\u6ce8\u5165\u653b\u51fb\u8005\u5229\u7528\u6765\u8bf1\u9a97\u7528\u6237\u8f93\u5165\u4ed6\u4eec\u7684\u7528\u6237\u540d\u548c\u5bc6\u7801\uff0c\u7136\u540e\u628a\u4ed6\u4eec\u7684\u51ed\u636e\u53d1\u9001\u5230\u6076\u610f\u7f51\u7ad9\u3002<\/p>\n

\"4\"<\/a> \"5\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

\u53e6\u5916\u4e00\u4e2a\u5f15\u8d77\u6211\u6ce8\u610f\u800c\u505a\u7684\u7814\u7a76\uff0c\u662f70%\u7684APP\u6ca1\u6709\u66ff\u4ee3\u8ba4\u8bc1\u7684\u89e3\u51b3\u65b9\u6848\uff0c\u5982\u591a\u56e0\u7d20\u8ba4\u8bc1\uff0c\u53ef\u80fd\u6709\u52a9\u4e8e\u51cf\u8f7b\u9493\u9c7c\u653b\u51fb\u7684\u98ce\u9669\u3002<\/p>\n

\u5927\u591a\u6570\u7531\u5e94\u7528\u7a0b\u5e8f\u4ea7\u751f\u7684\u65e5\u5fd7\u6587\u4ef6\u66b4\u9732\u654f\u611f\u4fe1\u606f\uff0c\u5982\u5d29\u6e83\u62a5\u544a\u3002\u8fd9\u79cd\u4fe1\u606f\u53ef\u80fd\u88ab\u6cc4\u9732\uff0c\u5e2e\u52a9\u653b\u51fb\u8005\u5229\u75280day \u6f0f\u6d1e\u5e94\u7528\u5bfb\u627e\u548c\u5f00\u53d1\u9488\u5bf9\u76ee\u6807\u7528\u6237\u7684\u5e94\u7528\u3002<\/p>\n

\"6\"<\/p>\n

 <\/p>\n

\u5927\u591a\u6570\u5e94\u7528\u7a0b\u5e8f\u901a\u8fc7\u82f9\u679c\u7cfb\u7edf\u65e5\u5fd7\u516c\u5f00\u654f\u611f\u4fe1\u606f\u3002\u4e0b\u9762\u7684\u4f8b\u5b50\u662f\u4ece\u63a7\u5236\u53f0\u7cfb\u7edf\u4f7f\u7528iPhone\u914d\u7f6e\u5b9e\u7528\u5de5\u5177\uff08IPCU\uff09\u3002\u8eab\u4efd\u9a8c\u8bc1\u8fc7\u7a0b\u7684\u5e94\u7528\u7a0b\u5e8f\u8f6c\u50a8\u7684\u7528\u6237\u51ed\u636e\u3002<\/p>\n

 <\/p>\n\n\n\n
\u2026<\/em>CA_DEBUG_TRANSACTIONS=1 in environment to log backtraces.<\/em>Jun 22 16:20:37 Test Bankapp[2390] <Warning>: <v:Envelope xmlns:i=”http:\/\/www.w3.org\/2001\/XMLSchema-instance” xmlns:d=”http:\/\/www.w3.org\/2001\/XMLSchema” xmlns:c=”http:\/\/schemas.xmlsoap.org\/soap\/encoding\/” xmlns:v=”http:\/\/schemas.xmlsoap.org\/soap\/envelope\/”><\/em><v:Header \/><\/em><v:Body><\/em><n0:loginWithRole id=”o0″ c:root=”1″ xmlns:n0=”http:\/\/mobile.services.xxxxxxxxx.com\/”><\/em><\/p>\n

<in0 i:type=”d:string”>USER-ID<\/in1><\/em><\/p>\n

<in1 i:type=”d:string”>XRS<\/in2><\/em><\/p>\n

<in2 i:type=”d:string”>PASSWORD<\/in3><\/em><\/p>\n

<in3 i:type=”d:string”>xxxxxxxx<\/in4><\/em><\/p>\n

<\/n0:loginWithRole><\/em><\/p>\n

<\/v:Body><\/em><\/p>\n

<\/v:Envelope><\/em><\/p>\n

Jun 22 16:20:37 Test Bankapp[2390] <Warning>: ]]]]]]]]]]]]] wxxx.xxxxx.com<\/em><\/p>\n

Jun 22 16:20:42 Test Bankapp[2390] <Warning>: RETURNED:<\/em><\/p>\n

Jun 22 16:20:42 Test Bankapp [2390] <Warning>: CoreAnimation: warning, deleted thread with uncommitted CATransaction; set CA_DEBUG_TRANSACTIONS=1 in environment to log backtraces.<\/em><\/p>\n

\u2026<\/em><\/p>\n

 <\/p>\n

 <\/p>\n

Static Analysis Results<\/p>\n

 <\/p>\n

The following tools were used for the static analysis and decryption:<\/p>\n

IDA PRO (disassembler tool) [4]<\/sup><\/p>\n

Clutch (cracking utility) [5]<\/sup><\/p>\n

objc-helper-plugin-ida [6]<\/sup><\/p>\n

ssh (Secure Shell)<\/p>\n

gdb (debugger tool)<\/p>\n

IPCU [7]<\/sup><\/p>\n

 <\/p>\n

The binary code of each app was decrypting using Clutch. A combination of decrypted code and code disassembled with IDA PRO was used to analyze the application.<\/p>\n

 <\/p>\n

Hardcoded development credentials were found in the code.<\/p>\n

 <\/p>\n

__text:00056350\u00a0 ADD \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R0, PC ; selRef_sMobileBankingURLDBTestEnv__<\/em><\/p>\n

__text:00056352 MOVT.W\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R2, #0x46<\/em><\/p>\n

__text:00056356 ADD \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R2, PC\u00a0 ; “https:\/\/mob_user:T3stepwd@db.internal\/internal\/db\/start.do?login=mobileEvn”<\/em><\/p>\n

__text:00056358 LDR \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R1, [R0] ; “setMobileBankingURLDBTestEnv_iPad_mobil”…<\/em><\/p>\n

__text:0005635A MOV \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R0, R4<\/em><\/p>\n

__text:0005635C BLX \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 _objc_msgSend<\/em><\/p>\n

__text:00056360 MOV \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R0, (selRef_setMobileBankingURLDBTestEnvWithValue_iPad_mobileT_ – 0x56370) ; selRef_setMobileBankingURLDBTestEnvWithValue_iPad_mobileT_<\/em><\/p>\n

__text:00056368 MOVW\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R2, #0xFA8A<\/em><\/p>\n

__text:0005636C ADD \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R0, PC ; selRef_setMobileBankingURLDBTestEnvWithValue_i_mobileT_<\/em><\/p>\n

__text:0005636E MOVT.W\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R2, #0x46<\/em><\/p>\n

__text:00056372 ADD \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R2, PC\u00a0 ; “https:\/\/mob_user:T3stepwd@db.internal\/internal\/db\/start.do?login=mobileEvn&branch=%@&account=%@&subaccount=%@”<\/em><\/p>\n

__text:00056374 LDR \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R1, [R0] ; “setMobileBankingURLDBTestEnvWith_i”…<\/em><\/p>\n

__text:00056376 MOV \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R0, R4<\/em><\/p>\n

__text:00056378 BLX \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 _objc_msgSend<\/em><\/p>\n

 <\/p>\n

 <\/p>\n

By using hardcoded credentials, an attacker could gain access to the development infrastructure of the bank and infest the application with malware causing a massive infection for all of the application\u2019s users.<\/p>\n

 <\/p>\n

Internal functionality exposed via plaintext connections (HTTP) could allow an attacker with access to the network traffic to intercept or tamper with data.<\/p>\n

 <\/p>\n

__text:0000C980 ADD \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R2, PC\u00a0 ; “http:\/\/%@\/news\/?version=%u”<\/em><\/p>\n

__text:0000C982 MOVT.W\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R3, #9<\/em><\/p>\n

__text:0000C986 LDR \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R1, [R1] ; “stringWithFormat:”<\/em><\/p>\n

__text:0000C988 ADD \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R3, PC\u00a0 ; “Mecreditbank.com”<\/em><\/p>\n

__text:0000C98A STMEA.W \u00a0 \u00a0 \u00a0 \u00a0 SP, {R0,R5}<\/em><\/p>\n

__text:0000C98E MOV \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R0, R4<\/em><\/p>\n

__text:0000C990 BLX \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 _objc_msgSend<\/em><\/p>\n

__text:0000C994 MOV \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R2, R0<\/em><\/p>\n

…<\/em><\/p>\n

__text:0001AA70 LDR \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R4, [R2] ; _OBJC_CLASS_$_NSString<\/em><\/p>\n

__text:0001AA72 BLX \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 _objc_msgSend<\/em><\/p>\n

__text:0001AA76 MOV \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R1, (selRef_stringWithFormat_ – 0x1AA8A) ; selRef_stringWithFormat_<\/em><\/p>\n

__text:0001AA7E MOV \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R2, (cfstr_HttpAtmsOpList – 0x1AA8C) ; “http:\/\/%@\/atms\/?locale=%@&version=%u”<\/em><\/p>\n

__text:0001AA86 ADD \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R1, PC; selRef_stringWithFormat_<\/em><\/p>\n

__text:0001AA88 ADD \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R2, PC; “http:\/\/%@\/atms\/version=%u”<\/em><\/p>\n

__text:0001AA8A<\/em><\/p>\n

__text:0001AA8A loc_1AA8A \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ; CODE XREF: -[BranchesViewController processingVersion:]+146j<\/em><\/p>\n

__text:0001AA8A MOVW\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R3, #0x218C<\/em><\/p>\n

__text:0001AA8E LDR \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R1, [R1]<\/em><\/p>\n

__text:0001AA90 MOVT.W\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R3, #8<\/em><\/p>\n

__text:0001AA94 STMEA.W \u00a0 \u00a0 \u00a0 \u00a0 SP, {R0,R5}<\/em><\/p>\n

__text:0001AA98 ADD \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R3, PC\u00a0 ; “Mecreditbank.com”<\/em><\/p>\n

__text:0001AA9A MOV \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 R0, R4<\/em><\/p>\n

__text:0001AA9C BLX \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 _objc_msgSend<\/em><\/p>\n

 <\/p>\n

 <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

\u6b64\u5916\uff0c20%\u7684\u7a0b\u5e8f\u901a\u8fc7http\u660e\u6587\u53d1\u9001\u5e10\u6237\u6fc0\u6d3b\u7801\u3002\u5373\u4f7f\u8fd9\u4e2a\u529f\u80fd\u662f\u6709\u9650\u7684\u521d\u59cb\u5e10\u6237\u8bbe\u7f6e\uff0c\u76f8\u5173\u98ce\u9669\u4e5f\u5f88\u9ad8\u3002\u5982\u679c\u653b\u51fb\u8005\u62e6\u622a\u6d41\u91cf\uff0c\u4ed6\u53ef\u4ee5\u52ab\u6301\u4f1a\u8bdd\uff0c\u7a83\u53d6\u53d7\u5bb3\u8005\u7684\u5e10\u6237\uff0c\u6ca1\u6709\u4efb\u4f55\u901a\u77e5\u548c\u8bc1\u636e\u80fd\u68c0\u6d4b\u5230\u653b\u51fb\u3002<\/p>\n

\u5728\u6bcf\u4e2a\u5e94\u7528\u7a0b\u5e8f\u7684\u6587\u4ef6\u7cfb\u7edf\u7684\u4ed4\u7ec6\u7814\u7a76\u540e\uff0c\u4ed6\u4eec\u4e2d\u7684\u4e00\u4e9b\u4eba\u4f7f\u7528\u4e86\u4e00\u4e2a\u672a\u52a0\u5bc6\u7684SQLite\u6570\u636e\u5e93\u548c\u5b58\u50a8\u654f\u611f\u4fe1\u606f\uff0c\u5982\u5ba2\u6237\u7684\u94f6\u884c\u8d26\u6237\u4fe1\u606f\u548c\u4ea4\u6613\u5386\u53f2\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6f0f\u6d1e\u8fdc\u7a0b\u8bbf\u95ee\u8fd9\u4e2a\u6570\u636e\uff0c\u6216\u5982\u679c\u4ed6\u4eec\u6709\u8bbe\u5907\u7684\u7269\u7406\u901a\u9053\uff0c\u53ef\u4ee5\u4e3a\u5b89\u88c5\u8d8a\u72f1\u8f6f\u4ef6\u7a83\u53d6\u4ece\u53d7\u5bb3\u8005\u7684\u8bbe\u5907\u4e0a\u7684\u6587\u4ef6\u7cfb\u7edf\u7684\u4fe1\u606f\u3002<\/p>\n

 <\/p>\n

\u4e0b\u9762\u7684\u4f8b\u5b50\u5c55\u793a\u4e86\u4eceAPP\u7684\u6587\u4ef6\u7cfb\u7edf\u4e2d\u83b7\u53d6\u4e00\u4e2aSQLite\u6570\u636e\u5e93\u5b58\u50a8\u7684\u672a\u52a0\u5bc6\u7684\u94f6\u884c\u8d26\u6237\u8d44\u6599\u3002<\/p>\n

\"7\"<\/p>\n

\u5176\u4ed6\u955c\u50cf\u4fe1\u606f\u6cc4\u9732\u88ab\u53d1\u73b0\uff0c\u5305\u62ec:<\/p>\n\n\n\n
Internal IP addresses:__data:0008B590 _TakeMeToLocationURL DCD cfstr_Http10_1_4_133<\/em>__data:0008B590 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ; DATA XREF: -[NavigationView viewDidLoad]+80o<\/em>__data:0008B590 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ; __nl_symbol_ptr:_TakeMeToLocationURL_ptro<\/em>__data:0008B590 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ; “http:\/\/100.10.1.13:8080\/WebTestProject\/PingTest.jsp”<\/em>Internal file system paths:__cstring:000CC724 aUsersXXXXPro DCB “\/Users\/Scott\/projects\/HM_iphone\/src\/HBMonthView.m”,0<\/em><\/p>\n

 <\/p>\n

 <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

\u5c3d\u7ba1\u62ab\u9732\u8fd9\u4e9b\u4fe1\u606f\u4e0d\u4f1a\u5bf9\u5176\u6240\u6709\u8005\u4ea7\u751f\u91cd\u5927\u5f71\u54cd\uff0c\u4f46\u653b\u51fb\u8005\u6536\u96c6\u4e86\u8bb8\u591a\u8fd9\u4e9b\u6f0f\u6d1e\u53ef\u4ee5\u66f4\u597d\u5730\u7406\u89e3\u5185\u90e8\u5e03\u5c40\u7684\u5e94\u7528\u7a0b\u5e8f\u548c\u670d\u52a1\u5668\u7aef\u7684\u57fa\u7840\u8bbe\u65bd\u3002\u8fd9\u4f7f\u653b\u51fb\u8005\u53ef\u4ee5\u542f\u52a8\u7279\u5b9a\u653b\u51fb\u5ba2\u6237\u7aef\u548c\u670d\u52a1\u5668\u7aef\u7684\u76ee\u6807\u5e94\u7528\u3002<\/p>\n

 <\/p>\n

\u7ed3\u8bba<\/strong><\/p>\n

 <\/p>\n

\u4ece\u9632\u5b88\u7684\u89d2\u5ea6\u6765\u770b\uff0c\u4ee5\u4e0b\u5efa\u8bae\u53ef\u4ee5\u51cf\u8f7b\u6700\u5e38\u89c1\u7684\u7f3a\u9677\uff1a<\/p>\n

\u786e\u4fdd\u6240\u6709\u7684\u8fde\u63a5\u90fd\u4f7f\u7528\u5b89\u5168\u4f20\u8f93\u534f\u8bae\u8fdb\u884c<\/p>\n

\u7531\u5ba2\u6237\u7aef\u5e94\u7528\u7a0b\u5e8f\u6267\u884c\u7684SSL\u8bc1\u4e66\u68c0\u67e5<\/p>\n

\u901a\u8fc7iOS\u6570\u636e\u4fdd\u62a4API\u52a0\u5bc6\u4fdd\u62a4\u5b58\u50a8\u5728\u5ba2\u6237\u7aef\u7684\u654f\u611f\u6570\u636e<\/p>\n

\u63d0\u9ad8\u989d\u5916\u7684\u68c0\u67e5\u68c0\u6d4b\u8bbe\u5907\u8d8a\u72f1<\/p>\n

\u6df7\u6dc6\u6c47\u7f16\u4ee3\u7801\u548c\u4f7f\u7528\u53cd\u8c03\u8bd5\u6280\u5de7\uff0c\u7f13\u6162\u7684\u653b\u51fb\u8005\u7684\u8fdb\u5c55\u65f6\uff0c\u4ed6\u4eec\u8bd5\u56fe\u9006\u5411\u4ee3\u7801<\/p>\n

\u5220\u9664\u6240\u6709\u8c03\u8bd5\u8bed\u53e5\u548c\u7b26\u53f7<\/p>\n

\u4ece\u751f\u4ea7\u5e94\u7528\u5220\u9664\u6240\u6709\u53d1\u5c55\u4fe1\u606f<\/p>\n

\u5bb6\u5ead\u94f6\u884c\u5e94\u7528\u7a0b\u5e8f\u5df2\u88ab\u5e94\u7528\u4e8e\u79fb\u52a8\u8bbe\u5907\uff0c\u5982\u667a\u80fd\u624b\u673a\u548c\u5e73\u677f\u7535\u8111\uff0c\u521b\u9020\u4e86\u5b89\u5168\u7684\u5168\u7403\u91d1\u878d\u516c\u53f8\u662f\u4e00\u4e2a\u91cd\u5927\u7684\u6311\u6218\u3002<\/p>\n

 <\/p>\n

 <\/p>\n

\u8fd9\u9879\u7814\u7a76\u8868\u660e\uff0c\u91d1\u878d\u4e1a\u5e94\u63d0\u9ad8\u79fb\u52a8\u94f6\u884c\u89e3\u51b3\u65b9\u6848\u7684\u5b89\u5168\u6807\u51c6\u3002<\/p>\n

 <\/p>\n

\u53c2\u8003\u6587\u732e\uff1a<\/strong><\/p>\n

[1]http:\/\/developer.apple.com\/library\/mac\/#documentation\/Darwin\/Reference\/ManPages\/man1\/otool.1.html<\/a><\/p>\n

[2] http:\/\/portswigger.net\/burp\/editions.html<\/a><\/p>\n

[3] https:\/\/www.owasp.org\/index.php\/Man-in-the-middle_attack<\/a><\/p>\n

[4] https:\/\/www.hex-rays.com\/products\/ida\/<\/a><\/p>\n

[5] https:\/\/www.appaddict.org\/forum\/index.php?\/topic\/40-how-to-crack-ios-apps\/<\/a><\/p>\n

[6] https:\/\/github.com\/zynamics\/objc-helper-plugin-ida<\/a><\/p>\n

[7] http:\/\/support.apple.com\/downloads\/#iphone%20configuration%20utility<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

\u672c\u6587\u7531liaoxj2046\u7ffb\u8bd1\u6574\u7406\uff0c\u8f6c\u8f7d\u8bf7\u6ce8\u660e\u8bd1\u6587\u94fe\u63a5http:\/\/wx.wosign.com\/?p=1413<\/a><\/p>\n

\u539f\u6587http:\/\/blog.ioactive.com\/2014\/01\/personal-banking-apps-leak-info-through.html<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

  Personal banking apps leak info through phone By … Read more<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[],"tags":[],"_links":{"self":[{"href":"https:\/\/wx.wosign.com\/index.php?rest_route=\/wp\/v2\/posts\/1413"}],"collection":[{"href":"https:\/\/wx.wosign.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wx.wosign.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wx.wosign.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/wx.wosign.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1413"}],"version-history":[{"count":8,"href":"https:\/\/wx.wosign.com\/index.php?rest_route=\/wp\/v2\/posts\/1413\/revisions"}],"predecessor-version":[{"id":1433,"href":"https:\/\/wx.wosign.com\/index.php?rest_route=\/wp\/v2\/posts\/1413\/revisions\/1433"}],"wp:attachment":[{"href":"https:\/\/wx.wosign.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wx.wosign.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1413"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wx.wosign.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}