Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm making an iPhone app that will communicate with my server over HTTPS. Important authentication information that is programmed into the app (for accessing app-specific content) will be sent to the server. If someone creates a fake SSL certificate that is installed on their device (the certificate looks like it is from my website) and points my domain name to their computer's IP address, is it possible for them to capture the authentication information and any other information that is initially sent to the server? Thanks for your help.

share|improve this question

1 Answer 1

up vote 5 down vote accepted

This question would probably be better asked over on IT security (you would have to give a bit more information on the predicted attack vector though).

Generally speaking if someone forges (a) the IP of your host, and (b) a certificate that your application finds acceptable - Yes. They can capture anything sent over that connection.

This is part of why you should not encode sensitive authentication information in your application.
The other part is that you should remember your users will be downloading this app to their PCs to install on their iPhones (the magic of the iTunes store), and they can just run a decompiler against it and start picking through looking for interesting strings.


The user's machine is a hostile environment. Do not trust them with anything sensitive.

share|improve this answer
    
Thanks a lot! Do you think it would be safer if the app and server both knew an algorithm that generated a random value, and unless the app was able to receive this value from the server, refuse to work? Also, is it possible for someone to decompile the app, take this out, and recompile it? I'm very nervous about this (for school), so I want to cover everything. Thanks for your help! –  Jack Humphries Mar 28 '12 at 20:17
2  
@jackhumphries WRT your comments to Voretaq: Yes, though you'd want to be sure that you weren't just swapping one "secret" stored in the app bundle ready to be decoded for another. Yes of course; if it can be made by someone then it can always be unpicked and put back toghether again by someone else. Though hopefully your mutual handshake would detect a compromised client and refuse to talk to it. (You could always transmit version number and a hash based on the compiled binary to the server, any attempt to alter and recompile the client would change the hash and you'd see it was incorrect). –  RobM Mar 28 '12 at 20:37
    
@RobMoir Hashing is what I'll do then to prevent the server to talking to compromised apps. I'll also take steps to prevent the app from talking to a fake server. Thanks a lot! –  Jack Humphries Mar 28 '12 at 20:43
    
@RobMoir One more thing. Just out of curiosity, if I programmed the IP address of my server instead of the DNS name, would this work (assume information cannot be retrieved from decompiled app)? They can't spoof the correct DNS information then. Thanks a lot. –  Jack Humphries Mar 28 '12 at 21:16
    
@JackHumphries - not worth it. There's no such thing as "hack proof", there's "making the cost of hacking too high without making the cost of protecting your app/data/whatever equally high". And coding an IP address - something that can very easily change over an app's lifecycle - into an app is a bad idea because you've broken every client running your s/w if you ever do need to change the IP address. And besides, IP addresses can be spoofed too. –  RobM Mar 28 '12 at 22:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.