Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Analyzing iOS applications is not the most trivial process, as said applications are distributed (via the iOS App Store) in an encrypted format.

I've not done much with mobile but have RE'd a bunch on the PC, and there an application which attempts to obfuscate its code in any way (e.g. classic case being a packed EXE) already warrants suspicion. At least there I always have the ability to open a file in a hex editor or even debugger for further inspection. IMHO this locked-down nature of platforms that makes it difficult for you to analyse the behaviour of the device which you ostensibly own is a huge obstacle to freedom and privacy in general. Ditto for all the other stuff like IoT which often communicates without your knowledge (and the traffic is encrypted, again ostensibly for protection on the Internet --- which it does do --- but with no way to inspect it locally).

It's true that not everyone has the skills to inspect, and that's a classic excuse for locking it down; but by making it harder to even get started and restricting that to "approved" people, there's even fewer motivated to try. The nature of Apple's platform is already disturbingly close to the situation in Stallman's classic story over 20 years ago: https://www.gnu.org/philosophy/right-to-read.en.html



Huh? That doesn't sound like you've done much RE at all. On PC contrary to their Mac counterparts virtually all shareware was PE protected from simple UPX which was often used to just compress the executables to more sophisticated polymorphic code with import obfuscation.

I've been out of the domain for a while but pretty much all shareware licensing was doing interesting things. It was more or less an arms race and a pretty fun one on top of that.

IoT which communicates without your knowledge is one thing but IoT that used alternative encryption because e.g. stock bluetooth was easily sniffable is another. You don't want anyone to be able to just sniff your health monitoring data.


Would be nicer of you to add "or we've been RE'ing different stuff" to your "doesn't sound like you've done much RE at all".




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: