Automated Binary Analysis on iOS - A Case Study on Cryptographic Misuse in iOS Applications

Johannes Feichtner, David Missmann, Raphael Spreitzer

Research output: Chapter in Book/Report/Conference proceedingConference paperpeer-review


A wide range of mobile applications for Apple's iOS platform process sensitive data and, therefore, rely on protective mechanisms natively provided by the operating system. A wrong application of cryptography or security-critical APIs, however, exposes secrets to unrelated parties and undermines the overall security.

We introduce an approach for uncovering cryptographic misuse in iOS applications. We present a way to decompile 64-bit ARM binaries to their LLVM intermediate representation (IR). Based on the reverse-engineered code, static program slicing is applied to determine the data flow in relevant code segments. For this analysis to be most accurate, we propose an adapted version of Andersen's pointer analysis, capable of handling decompiled LLVM IR code with type information recovered from the binary. To finally highlight the improper usage of cryptographic APIs, a set of predefined security rules is checked against the extracted execution paths. As a result, we are not only able to confirm the existence of problematic statements in iOS applications but can also pinpoint their origin.

To evaluate the applicability of our solution and to disclose possible weaknesses, we conducted a manual and automated inspection on a set of iOS applications that include cryptographic functionality. We found that 343 out of 417 applications (82%) are subject to at least one security misconception. Among the most common flaws are the usage of non-random initialization vectors and constant encryption keys as input to cryptographic primitives.
Original languageEnglish
Title of host publicationProceedings of the 11th ACM Conference on Security & Privacy in Wireless and Mobile Networks
Place of PublicationNew York
PublisherAssociation of Computing Machinery
Number of pages12
ISBN (Print)978-1-4503-5731-9
Publication statusPublished - 2018
EventACM Conference on Security and Privacy in Wireless and Mobile Networks - Stockholm, Sweden
Duration: 18 Jun 201820 Jun 2018


ConferenceACM Conference on Security and Privacy in Wireless and Mobile Networks
Abbreviated titleWiSec
Internet address


  • iOS
  • Reverse Engineering
  • Program Analysis
  • Cryptographic Misuse


Dive into the research topics of 'Automated Binary Analysis on iOS - A Case Study on Cryptographic Misuse in iOS Applications'. Together they form a unique fingerprint.
  • Best Paper Award

    Feichtner, Johannes (Recipient), 20 Jun 2018

    Prize: Prizes / Medals / Awards

Cite this