Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Review and enhance iOS Binary Protections #1894

Closed
cpholguera opened this issue Apr 8, 2021 · 2 comments · Fixed by #1925
Closed

Review and enhance iOS Binary Protections #1894

cpholguera opened this issue Apr 8, 2021 · 2 comments · Fixed by #1925
Assignees
Labels

Comments

@cpholguera
Copy link
Collaborator

Task

enhance the following Test Case:

https://github.com/OWASP/owasp-mstg/blob/master/Document/0x06i-Testing-Code-Quality-and-Build-Settings.md#make-sure-that-free-security-features-are-activated-mstg-code-9

using this article:

https://sensepost.com/blog/2021/on-ios-binary-protections/

Summary

The decision regarding which protections can and should be enabled is heavily influenced based on if Swiftlang is involved and whether the target binary is an executable or a library.

  • PIE – Add the -fPIC compiler flag to the projects build settings. This will only be applicable to the main executable.
  • ARC – This will be automatically enabled for Swift only projects (via the swiftc compiler), and added by setting YES to the Objective-C Automatic Reference Counting section in the projects configuration.
  • Canary – Enabled by adding the -fstack-protector-all compiler flag to Objective-C projects. If Swift is involved its possible to have it enabled when the library is a hybrid of Objective-C and Swift, but it could show as disabled which is okay.
  • Both static and dynamic analysis are possible
@su-vikas
Copy link
Collaborator

You can assign this to me

@cpholguera
Copy link
Collaborator Author

This will also make a nice replacement for what was removed in #1900

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants