Is there any compiler flag that we can use to entirely obfuscate string literals?Quick example, an app contains urls for different servers:fileprivate extension Environment { var url: String { switch self { case .dev: return "https://mydevserver.com/api" case .prod: return "https://myprodserver.com/api" } }But once the binary is compiled, it's quite easy to just open it and see the string inside.https://i.ibb.co/3M2zX0F/Screen-Shot.pngInitially, I thought this was just related to Swift literals, but further testing indicates that it also happens to Obj-C string literals.Shouldn't the compiled code be a safe binary, at least obfuscating any literals inside the code base?I would rather not take the path of manipulating the string in the code base, like using it encrypted, base64, or scrambled string literals mixing parts of string, etc...

Hello,I have been developing an iOS and macOS application that requires me to configure an LDAP address book programmatically. I have achieved this goal in my macOS application where I created a .mobileconfig file dynamically and installed it to system preferences.I want the same behavior for my iOS application but the .mobilconfig file I created for macOS is not working for iOS even if I add it manually.Is there any other way to programmatically configure LDAP in iOS?If so, Kindly help.Regards,Souvanik

Hi,we are currently trying to test universal links also on our development server which is behind a VPN. From my understanding, correct if I am wrong, I thought it is enough that during app installation, the corresponding device (iPhone) is also connected via VPN so that iOS is able to download the AASA file?But at the moment I am not able to test this successfully. So my question is, is that possible in general to put the file on a server which is only reachable via VPN, and if yes, what could be the error?Best regardsChris

HiI'm using the new CryptoKit to generate a 6 or 8 digit TOTP code. Anyone been successful doing this?Using Xcode 11 BETA 5, targeting iOS 13 and Swift 5.1. Here is a snippet of generating an TOTP via CommonCrypto versus CryptoKit in playground (BETA). The base32Decode function returns Data.import CryptoKit import CommonCrypto import Foundation let period = TimeInterval(30) let digits = 6 let secret = base32Decode(value: "5FAA5JZ7WHO5WDNN")! var counter = UInt64(Date().timeIntervalSince1970 / period).bigEndian func cryptoKitOTP() { // Generate the key based on the counter. let key = SymmetricKey(data: Data(bytes: &counter, count: MemoryLayout.size(ofValue: counter))) let hash = HMAC<Insecure.SHA1>.authenticationCode(for: secret, using: key) var truncatedHash = hash.withUnsafeBytes { ptr -> UInt32 in let offset = ptr[hash.byteCount - 1] & 0x0f let truncatedHashPtr = ptr.baseAddress! + Int(offset) return truncatedHashPtr.bindMemory(to: UInt32.self, capacity: 1).pointee } truncatedHash = UInt32(bigEndian: truncatedHash) truncatedHash = truncatedHash & 0x7FFF_FFFF truncatedHash = truncatedHash % UInt32(pow(10, Float(digits))) print("CryptoKit OTP value: \(String(format: "%0*u", digits, truncatedHash))") } func commonCryptoOTP() { let key = Data(bytes: &counter, count: MemoryLayout.size(ofValue: counter)) let (hashAlgorithm, hashLength) = (CCHmacAlgorithm(kCCHmacAlgSHA1), Int(CC_SHA1_DIGEST_LENGTH)) let hashPtr = UnsafeMutablePointer.allocate(capacity: Int(hashLength)) defer { hashPtr.deallocate() } secret.withUnsafeBytes { secretBytes in // Generate the key from the counter value. counterData.withUnsafeBytes { counterBytes in CCHmac(hashAlgorithm, secretBytes.baseAddress, secret.count, counterBytes.baseAddress, key.count, hashPtr) } } let hash = Data(bytes: hashPtr, count: Int(hashLength)) var truncatedHash = hash.withUnsafeBytes { ptr -> UInt32 in let offset = ptr[hash.count - 1] & 0x0F let truncatedHashPtr = ptr.baseAddress! + Int(offset) return truncatedHashPtr.bindMemory(to: UInt32.self, capacity: 1).pointee } truncatedHash = UInt32(bigEndian: truncatedHash) truncatedHash = truncatedHash & 0x7FFF_FFFF truncatedHash = truncatedHash % UInt32(pow(10, Float(digits))) print("CommonCrypto OTP value: \(String(format: "%0*u", digits, truncatedHash))") } func otp() { commonCryptoOTP() cryptoKitOTP() } otp()The output based on now as in 2:28pm is: CommonCrypto OTP value: 819944 CryptoKit OTP value: 745890To confirm the OTP value, I used oathtool which you can brew install to generate an array of TOTP's. For example:oathtool --totp --base32 5FAA5JZ7WHO5WDNN -w 10Craig

Can someone please shed some light on the usage of `.or` & `.and` flags? Though I am able to get the accomplish the entended result using `.userPresence`, I am trying to wrap my head around how to use `.or` & `.and`. Can someone please provide an example on correct usages of these options?

Hello!I'm working on a security software showing basic security hygiene of managed computers and one of the parameters gathered is whether the screensaver is protected with password.On 10.12 I could read this settings from com.apple.screensaver plist, but starting from 10.13 this plist doesn't contain this value.I also don't want to use apple script because starting from Mojave it asks for special authorization, and also gives wrong result on 10.13.Are there any other options in achieving this?Thanks in advance!

Hi,I'm working on the output of method `distinguishedNames` that available under challenge.protectionSpace when my application receieve callback from the server (didReceieveChallenge) of type NSURLAuthenticationMethodClientCertificate. In this case the server ask for certificate from the client that was signed by issuer from the issuersList provided by the server.The method challenge.protectionSpace.distinguishedNames returns as a DER encoded data, and I wish to decode it and get the issuer distiguished name.Since openssl is no longer native mac code, i turned to SecAsn1Decode and realized that it also expect to have a template of the DER format (SecAsn1Template).. so I pretty much need to have the formatted layout before I want to decode an instance formatted in this way.Conceptually, I'm not sure I understand why this template is really needed, because the DER format explain the format by itself.I've tested my assumption by copying the output of distinguishedNames and using asn.1 online converter to human readble text, and it revealed the format by itself.here's the input :30 81 8E 31 0B 30 09 06 03 55 04 06 13 02 49 4931 0F 30 0D 06 03 55 04 08 0C 06 62 62 62 62 626C 31 0C 30 0A 06 03 55 04 07 0C 03 54 4C 56 310B 30 09 06 03 55 04 0A 0C 02 54 53 31 1E 30 1C06 03 55 04 0B 0C 15 43 41 5F 63 65 72 74 69 6669 63 61 74 65 5F 73 65 72 76 65 72 31 1B 30 1906 03 55 04 03 0C 12 62 62 62 62 62 73 5F 4D 6163 42 6F 6F 6B 5F 50 72 6F 31 16 30 14 06 09 2A86 48 86 F7 0D 01 09 01 16 07 7A 40 7A 2E 63 6F6Dand the output :SEQUENCE (7 elem) SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 2.5.4.6 countryName (X.520 DN component) PrintableString II SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 2.5.4.8 stateOrProvinceName (X.520 DN component) UTF8String bbbbbl SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 2.5.4.7 localityName (X.520 DN component) UTF8String TLV SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 2.5.4.10 organizationName (X.520 DN component) UTF8String TS SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 2.5.4.11 organizationalUnitName (X.520 DN component) UTF8String CA_certificate_server SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 2.5.4.3 commonName (X.520 DN component) UTF8String bbbbbs_MacBook_Pro SET (1 elem) SEQUENCE (2 elem) OBJECT IDENTIFIER 1.2.840.113549.1.9.1 emailAddress (PKCS #9. Deprecated, use an altName extension instead) IA5String z@z.comSo perhaps anyone can thing of a good reason why is the template is needed ? and if so, how do i generate it for my specific example.Thanks !

Hi,We have deployed the Intune MAM/MDM in our organisation for iPhone (iOS) and Android devices, in this policy we have enabled the data protection that user will not be able to paste copied data from policy managed app (e.g. MS Outlook, OneDrive, Teams etc).Now due to this we are not able to paste copied data in iOS contact apps, As per the Microsoft we have to exclude this iOS native contact apps by adding URL protocol in Intune MAM policy.We are requesting you to please share the URL protocol for iOS contact app so we can exclude this app.Ref:-https://docs.microsoft.com/en-us/intune/apps/app-protection-policy-settings-ios#data-transfer-exemptionshttps://docs.microsoft.com/en-us/intune/apps/app-protection-policies-exception (Refer section “iOS data transfer exceptions”)

Per https://support.apple.com/en-us/HT211025Quoting:"In our ongoing efforts to improve web security for our users, Apple is reducing the maximum allowed lifetimes of TLS server certificates [to 398 days]" [...]"This change will not affect certificates issued from user-added or administrator-added Root CAs."Questions:What defines "user-added or administrator-added Root CAs"?How do we get our hands on a version of Safari now to test/prepare for this change? What version(s) of Safari honors this change?Note, I've asked a similar question on StackExchange: https://apple.stackexchange.com/questions/384033

/usr/bin/codesign --force --sign 0CC6....97 --entitlements /Users/<home>/Library/Developer/Xcode/DerivedData/testcodesignin01-goacjvxyeavzuvdynuqnejjbaqjo/Build/Intermediates.noindex/testcodesignin01.build/Debug-iphoneos/testcodesignin01.build/testcodesignin01.app.xcent --timestamp=none /Users/<home>/Library/Developer/Xcode/DerivedData/testcodesignin01-goacjvxyeavzuvdynuqnejjbaqjo/Build/Products/Debug-iphoneos/testcodesignin01.appWarning: unable to build chain to self-signed root for signer "Apple Development: <myappacountemail> (myaccountid)"/Users/<home>/Library/Developer/Xcode/DerivedData/testcodesignin01-goacjvxyeavzuvdynuqnejjbaqjo/Build/Products/Debug-iphoneos/testcodesignin01.app: errSecInternalComponent

Error in Xcode 10.3 on macOS 10.15.3 on executing command SecCodeCopyGuestWithAttributes for macOS Cocoa application.[logging-persist] os_unix.c:43353: (0) open(/var/db/DetachedSignatures) - Undefined error: 0The file /var/db/DetachedSignatures does not exist. Any reason why? How to fix this?

Hey there,I'm having trouble with an macOS app and it's connected privileged helper tool. It looks like there is a problem with the new TCC - Files And Folders security layer. The console says pretty clear:-[TCCDAccessIdentity staticCode]: static code for: identifier /Library/PrivilegedHelperTools/com.my.HelperTool, type: 1: 0x7fdd0b61d300 at /Library/PrivilegedHelperTools/com.my.HelperToolRefusing TCCAccessRequest for service kTCCServiceSystemPolicyDownloadsFolder from client /Library/PrivilegedHelperTools/com.my.HelperTool in background sessionResetting permissions via tccutil didn't help. The app and the helper tool is successfully codesigned and notarized (but not sandboxed). Any tips how to satisfy TCC? Anything I can check? Any documentation beside WWDC 2019 – Advances in macOS Security?Btw. I'm on Catalina 10.15.4thanks a lot,Gary

Hello,I have a local WebSocket server running inside an iOS app on iOS 13+. I'm using Swift NIO Transport Services for the server.I'm using NWProtocolTLS.Options from Network framework to specify TLS options for my server.I am providing my server as an XCFramework and want to let users to be able to specify different parameters when launching the server.For specifiying the TLS supported version, everything is working fine by using :public func sec_protocol_options_set_max_tls_protocol_version(_ options: sec_protocol_options_t, _ version: tls_protocol_version_t) public func sec_protocol_options_set_min_tls_protocol_version(_ options: sec_protocol_options_t, _ version: tls_protocol_version_t)But I also want to be able to specify some cipher suites. I saw that I can use :public func sec_protocol_options_append_tls_ciphersuite(_ options: sec_protocol_options_t, _ ciphersuite: tls_ciphersuite_t)But it seems that some cipher suites are enabled by default and I can't restrict the cipher suites just to the ones I want, I can just append others.NWProtocolTLS.Options class has an init() function which states "Initializes a default set of TLS connection options" on Apple documentation.So my question is, is there a way to know what TLS parameters this initialization does ? Especially the list of cipher suites enabled by default ? Because I can't find any information about it from my research. I used a tool to test handshake with my server to discover the cipher suites supported and enabled by default but I don't think it is a good way to be sure about this information.And is there a way to specify only cipher suites I want to be supported by my server by using NWProtocolTLS.Options ?Thank you in advance,Christophe

Hi all,I have been able to reproduce a scenario where apps/files do not open when I subscribe to ES_EVENT_TYPE_AUTH_OPEN and set caching to true while authorizing the opening of a file by responding to es_respond_flags_result(,,,).In details, If I subscribe to ES_EVENT_TYPE_AUTH_OPEN event and set bool cache = true in es_respond_flags_result(,,,)es_handler_block_t file_cbk = ^(es_client_t *client, const es_message_t *msg) { log_event_message(msg); // just to log events to the console int32_t flag = msg->event.open.fflag; // getting the file-opening mask es_respond_result_t res = es_respond_flags_result(client, msg, flag, true); // simply allowing all files to open and cache the result if (ES_RESPOND_RESULT_SUCCESS != res) LOG_ERROR("es_respond_auth_result: %d", res); };Whatever application or file that I open leads me to some EPERM popup, "The Application cannot be opened" and complete unresponsiveness of the machine with occasional spinning beach balls. As you can see, I am not doing any sort of processing with the file event messages (apart from just logging to the console) - I'm simply allowing all file open operations and caching the results.This issue with es_respond_flags_result(,,,) only appears if I cache the event result; without caching everything works as expected. However, if I subscribe to ES_EVENT_TYPE_AUTH_EXEC event and respond using es_respond_auth_result(,,,) authorizing the execution of a process with the caching parameter set to true, everything seems to work gracefully.I am completely new to Objective C so there's a high chance of doing something wrong - please LMK if I am handling the event messages in an undesired fashion and suggest me the way it should be handled. If this is a known/duplicate issue, please point me to the relevant ticket or guide me on the way forward.Also added a 2 min screen recording illustrating the issue (Unlisted video): https://youtu.be/R9zSpHk72_QLooking forward to your help and support...Thanks!Uddalak

Hello,I'm currently trying (in Swift, iOS 13+) to reproduce an end to end communication mechanism inspired by apps like SignalApp or iMessage. But there is something I don't see how to do. When encrypting a new message the idea for a better forward secrecy and post-compromise security implies the use of not 1 but 3 or 4 DH shared secrets to compute the symmetric key (here is the part of the SignalApp protocol documentation that explains that part https://signal.org/docs/specifications/x3dh#sending-the-initial-message). But I don't think this is currently possible with CryptoKit since I don't see any way to combine multiple CryptoKit.SharedSecret together. Or am I missing something ?I could use a third party library for that of course, but I would rather not if it's possible.Thank you ! (and sorry for my english :s)

The Endpoint Security framework provides open auth event. However certain application may just open a file to check size, access, but not read the content. Our use case is geared toward apply security when the application actually reads the content. Could Apple engineer confirm if there is any plan to support this? Had raised enhancement request long time back (Feedback FB6484629). Just thought of checking if there any update on the same. Any suggestions/comments?

Running the sample "Juice" app, which demos the Sign In With Apple flow, doesn't seem to work with Xcode 12 beta and iOS 14 beta on the simulator (worked fine on the non-beta versions and on a real device with iOS 14 beta). Once the password for the device's Apple ID is entered, the wheel in the password field just keeps spinning. No error messages and nothing handed back over to the app from the ASAuthorizationController. Anyone else seeing this problem ? Are there any workarounds ?

Hi, I'm trying to verify the signature in the sample provided here: https://developer.apple.com/documentation/storekit/skadnetwork/verifying_an_install_validation_postback I created the following files: apple.pub ----BEGIN PUBLIC KEY MEkwEwYHKoZIzj0CAQYIKoZIzj0DAQEDMgAEMyHD625uvsmGq4C43cQ9BnfN2xsl VT5V1nOmAMP6qaRRUll3PB1JYmgSm+62sosG----END PUBLIC KEY 2. signature.bin Contains base64 decoding of MDYCGQCsQ4y8d4BlYU9b8Qb9BPWPi+ixk/OiRysCGQDZZ8fpJnuqs9my8iSQVbJO/oU1AXUROYU= 3. message.bin Contains the '\u2063' delimited string: 0⁣com.example⁣42⁣525463029⁣6aafb7a5-0170-41b5-bbe4-fe71dedf1e28⁣1⁣1234567891 But trying to verify the signature using the command below returns "Verification Failure": openssl dgst -sha256 -verify apple.pub -signature signature.bin message.bin What's the problem and how can the signature be verified using openssl?

Is there any documentation about the server to server notification, specifically what sort of data Apple servers send to our server when there is an update to users who used Sign in with Apple?

Is it mandatory to ask an app user for his location for the purpose of GDPR or CCPA ?