---
title: "Swaroop Yermalkar -- iGoat and iOS Mobile Pen Testing"
url: https://appsecpodcast.com/swaroop-yermalkar-igoat-and-ios-mobile-pen-testing/
date: 2018-11-13
duration_seconds: 1688
guests: ["Swaroop Yermalkar"]
topics: ["OWASP Projects", "Security Testing", "Cloud and Infrastructure"]
audio: https://www.buzzsprout.com/1730684/episodes/8122664-swaroop-yermalkar-igoat-and-ios-mobile-pen-testing.mp3
transcript: true
---

# Swaroop Yermalkar -- iGoat and iOS Mobile Pen Testing

*November 13, 2018 · 28 min*

with [Swaroop Yermalkar](https://appsecpodcast.com/guests/swaroop-yermalkar/)

on [OWASP Projects](https://appsecpodcast.com/topics/owasp-projects/), [Security Testing](https://appsecpodcast.com/topics/security-testing/), [Cloud and Infrastructure](https://appsecpodcast.com/topics/cloud-and-infrastructure/)

[Audio](https://www.buzzsprout.com/1730684/episodes/8122664-swaroop-yermalkar-igoat-and-ios-mobile-pen-testing.mp3)

## Show notes

Mobile apps can hide credentials, expose powerful backend access, and repeat familiar web security mistakes. OWASP iGoat project leader Swaroop Yermalkar joins Chris to explain how he approaches testing iOS and Swift applications, starting with understanding the business and following the data. They discuss hardcoded cloud keys, inspecting application classes, proxying traffic, and weaknesses in mobile service endpoints. Swaroop then introduces iGoat as a practical learning environment where people can exploit a flaw, understand the remediation, and rebuild the application with a fix. A cloud-storage exercise illustrates how client-side clues lead to a wider exposure. The episode closes with iGoat’s relationship to OWASP’s mobile guidance and why these skills matter across Apple’s expanding device ecosystem.

The Application Security Podcast is brought to you by [Security Journey](https://www.securityjourney.com/).

About Security Journey  
Security Journey provides application security education for developers and everyone in the software development lifecycle.  
→ [Learn more about Security Journey](https://www.securityjourney.com/)

Connect with Swaroop Yermalkar:  
→ [Swaroop Yermalkar on LinkedIn](https://www.linkedin.com/in/swaroop-yermalkar/)  
→ [OWASP iGoat](https://github.com/OWASP/igoat)

Mentioned in this episode:  
→ [iGoat Swift](https://github.com/OWASP/iGoat-Swift)  
→ [OWASP Mobile Application Security Testing Guide](https://mas.owasp.org/MASTG/)  
→ [Burp Suite](https://portswigger.net/burp)  
→ [OWASP WebGoat](https://owasp.org/www-project-webgoat/)

Chapters:  
00:00 iOS security and iGoat with Swaroop Yermalkar  
01:11 From Wi-Fi curiosity to application security  
02:42 Mobile applications in bug bounty programs  
03:44 Testing Swift applications  
05:01 Hardcoded keys and excessive permissions  
07:45 Understanding the business before testing  
10:51 Inspecting and decrypting an iOS application  
12:24 Static analysis and proxying mobile traffic  
13:58 Why mobile backends deserve attention  
15:53 What the iGoat learning environment contains  
17:57 Fixing the vulnerability after exploiting it  
19:13 A cloud-storage misconfiguration exercise  
23:18 Future directions and new challenges  
24:49 Connecting iGoat with OWASP mobile standards  
26:24 Applying the skills across devices

## Transcript

*4,852 words · assemblyai*

**0:00 Chris Romeo:** Hey folks, season 4, episode 16 of the AppSec Podcast. On this episode, we talk about iGoat and pen testing iOS mobile applications. This is the first interview from AppSec USA, and we hope you enjoy. The Application Security Podcast. Here we go. Hey folks, welcome to this episode of the AppSec Podcast coming to you live from AppSec USA. And, uh, I'm joined here by Swaroop, who is doing a talk here at AppSec USA, but he's also had a lot of experience and has ownership of the OWASP iGOAT project. And so he's going to explore what that means for us. But first, Swaroop, if you would tell us your security origin story. So how did you get into security? How did you get started?

**1:11 Swaroop Yermalkar:** Yeah. Thanks, Chris, for inviting me. So I've done my engineering from India and I was fascinated by the security. I started with Wi-Fi signals. So how they works. And mostly I was very, very much attracted towards like how to hack into the Wi-Fi. Like it was, it was a fun thing during college. But after that, I, as soon as I've done my engineering, I got job in security. Like it was a security as consulting.

**1:40** Okay.

**1:41 Swaroop Yermalkar:** And in the same time, I also started into bug bounties. And in over the time, I become the one of the top bug bounty researchers worldwide. working with Synack and then Cobalt. And yeah, so, and after that, I authored a book on iOS security that is Learning iOS Penetration Testing, and it's one of the most popular books on iOS security available in the market. And I was— as my specialization is more towards iOS, okay, I'd taken up that OWASP iGoat project and And we are now keeping that project very much active. And it's like a leading project to learn for the iOS security and also the pentesting for both developers and pentesters.

**2:32 Chris Romeo:** Yeah.

**2:33 Swaroop Yermalkar:** So it's kind of brief about me.

**2:35 Chris Romeo:** So now you didn't, you didn't hack the Wi-Fi here at the conference, did you?

**2:38 Swaroop Yermalkar:** No, I stopped that. It was fun during engineering.

**2:42 Chris Romeo:** So do you still do bug bounties and that type of stuff now?

**2:45 Swaroop Yermalkar:** Yeah, I do a lot. And that's, I'm going to present in the talk tomorrow, like some critical findings where I'm not going to disclose everything, but like how I was able to take AWS just by using mobile application.

**3:01** Okay.

**3:02 Swaroop Yermalkar:** Because if you see, then most of the companies pay attention to the web APIs or the backend, but the mobile part is somehow neglected.

**3:11 Chris Romeo:** And you're doing bug bounties? I didn't even realize people did bug bounties. They give you the app and let you actually test the app in their bug bounty environment?

**3:20 Swaroop Yermalkar:** Yeah, they give you the like App Store URL or Play Store, whichever app is there.

**3:24 Chris Romeo:** Okay.

**3:25 Swaroop Yermalkar:** And they say whatever you can do, find issues for us.

**3:28 Chris Romeo:** Okay, so it goes to the production, it's their production application. It's not like a test environment or anything.

**3:33 Swaroop Yermalkar:** So depends on clients. If you prefer the production or if you prefer the— they send you some Crashlytics invite or the testing environment.

**3:42 Chris Romeo:** Okay.

**3:43 Swaroop Yermalkar:** Yeah.

**3:43** Okay, cool.

**3:44 Chris Romeo:** And so what is your talk here at AppSec USA? It's called Pen Testing Swift Applications for Fun and Profit. Kind of has a familiar name to a popular article written about what seems like 100 years ago by Aleph One, right? About buffer over or something for smashing the stack for fun and profit or something. Yeah, maybe a little run on that, but with OWASP iGoat. So tell me, tell me about this talk and Give me just kind of a high-level summary of what you talk about in this talk.

**4:13 Swaroop Yermalkar:** Sure. So recently we released the OWASP SpyGo in Swift. So previously it was completely in Objective-C.

**4:20 Chris Romeo:** Okay, so is that the old— what's the difference between Swift and Objective-C for those that don't know?

**4:26 Swaroop Yermalkar:** So Swift is a new language, right? It's a new language by Apple. So previously, like, most of the companies' entire development was in Objective-C. And now if you see, the companies are moving from Objective-C to Swift, and it's important to learn that Swift vulnerabilities as well. So that's the reason we recently released a Swift version of OWASP PyGuard project. And so that is one part of my talk. And as I said, I do bug bounties. I had like critical findings from them in the iOS applications, which I'm going to explain in the talk.

**5:01 Chris Romeo:** So I guess, so in your talk, you're gonna reference some of the really critical issues and things. Since we're recording this now, and this isn't going to get posted until after your talk, you can give us kind of the inside scoop. So what are some of those critical issues that folks should be thinking about with their mobile apps?

**5:19 Swaroop Yermalkar:** Yeah. So if you see when I talk with the managers or security folks, they have the automated tools scanners for the web APIs, but they don't have tools or the people who can check for the mobile applications. So that's the reason, like I was checking one of the production application that was for pentesting. And what I found that one of the developers, like, so it was basically iOS application, and it's a general practice that once you get the application, you do reverse engineering, then disassemble the code. And, uh, while doing the disassembling, I found that the AWS keys were hardcoded in the code itself.

**5:58 Chris Romeo:** That doesn't sound good.

**5:59 Swaroop Yermalkar:** Yeah, so I use that keys, uh, and I tried the permission, and I was So the keys I got had a lot more permission. I was able to launch EC2 instances and I was able to do a lot more things. Like I was able to list all the IAM users of that particular enterprise. And so if getting those keys into wrong hand, a wrong hand could do anything. Like someone could just launch thousands of EC2 instances and that could cost—

**6:30 Chris Romeo:** Not only did they have the keys hardcoded into the app, they didn't limit the permissions of the key.

**6:36** Exactly.

**6:36 Chris Romeo:** The key had full access to EC2 and all the other AWS resources.

**6:39 Swaroop Yermalkar:** Yeah, so there are 2 issues. Like, one is getting the keys. So that is the— that was the issue in the code level, like the developer has a mistaken. And the other was AWS, the keys, they should have the very limited permission, right? But it has a lot more permissions, so I could do whatever I want. So, but as a POC, I just launched one free tier EC2 instance.

**7:00 Chris Romeo:** Just to prove it.

**7:01 Swaroop Yermalkar:** Yeah, I just submitted.

**7:03 Chris Romeo:** Now, how prevalent is that issue? Does that happen a lot in mobile apps as you're testing? Does default credentials and keys included inside the app?

**7:11 Swaroop Yermalkar:** Yeah, so if you see, not like AWS, but like different, like in one of the applications I found the QA accounts were hardcoded. Like, so as soon as you load the application, it was creating one database and it had one QA credentials with the endpoint. So you can actually access the upcoming features. Like, so application has quarter 1, 2, 3 releases.

**7:34 Chris Romeo:** Okay.

**7:35 Swaroop Yermalkar:** So using that, I was able to log in as a backdoor entry and I was able to access their all upcoming features. Yeah.

**7:43 Chris Romeo:** So, yeah.

**7:44** Wow. Yeah.

**7:45 Chris Romeo:** So that's one kind of big class of mobile problems would be default credentials, which that's a pretty standard problem that exists in product security. It exists in web applications even, not as much anymore as it used to, but it's still there. What's another challenge or what's another big type of issue that you see?

**8:04 Swaroop Yermalkar:** So I see the biggest challenge is if you see, we have lots of tools in CI/CD or DevSecOps where we are already looking at the backend, right? Whenever the code goes into production, it goes through all the tools. So we already get the idea of security posture, But when you're talking about the app on the device, there are people don't have much skills or they are not able to do that. And that's the reason we found so many loopholes in the code, which is like app on the device.

**8:36** Okay.

**8:37 Chris Romeo:** Because you have access to the app itself.

**8:40 Swaroop Yermalkar:** Yeah.

**8:41 Chris Romeo:** Like if you think about it in a common, like in a web app perspective, I never give— it's hard. You can't get a copy of my binary.

**8:48 Swaroop Yermalkar:** Exactly.

**8:48 Chris Romeo:** Like, let's say I'm running a Java application and I'm releasing it in a WAR file.

**8:53 Swaroop Yermalkar:** Yes.

**8:53 Chris Romeo:** You don't have the ability to download that WAR file like you can with an app.

**8:57** Exactly.

**8:57 Chris Romeo:** So with the app, you got access to everything, so you can tear it apart. So walk us through a little bit about what you do once you get your hands on that app and tell us a little bit more about, you mentioned reverse engineering, tell us a little bit more about how that works.

**9:11 Swaroop Yermalkar:** So when we get the application, first we understand their business, like what exactly that, what is their IP or what, what is their business.

**9:20 Chris Romeo:** And when you say business, what do you mean? Like who it belongs to, or what they're selling, or what they do, or what is important for them?

**9:27 Swaroop Yermalkar:** Is it like the data? So data is definitely important, but like which functionality is more sensitive for them, or which is the critical part of the application?

**9:35 Chris Romeo:** And you can tell that— so you can tell that just by using the application?

**9:38 Swaroop Yermalkar:** So yeah, we navigate to our application, we check out all the options of functionalities, and then we We figure it out like what is the most important.

**9:47 Chris Romeo:** So the user, you're at the user level at that point. Exactly.

**9:49 Swaroop Yermalkar:** Okay. So we do it like black box. We don't know what is like server side. It's like a complete black box testing.

**9:56 Chris Romeo:** Which means you have no knowledge, no internal knowledge of the code that's running, no internal knowledge of the systems. They hand you the app and they say, see what you can do.

**10:04 Swaroop Yermalkar:** Yeah. So all we have is the URL, App Store URL, and with that, whatever we can do.

**10:09 Chris Romeo:** Okay.

**10:09 Swaroop Yermalkar:** After that, we do the static analysis. We check like what is application storing locally on the device. So there is again misconception that developers say that they don't consider issues which are on the rooted device. Like they say that if let's say they are storing the credentials in the kitchen and they say that it will be accessible only if the device is rooted, so they don't care.

**10:33** Okay.

**10:34 Swaroop Yermalkar:** But if you see the rooting is, it's just like it's very easy nowadays. Jailbreaking device is not a tough job. If you see like jailbreaks are available till almost iOS 11, and recently there was Pangu, uh, Pangu team demonstrated jailbreak for the iOS 12.

**10:51 Chris Romeo:** Oh yeah, that's brand new.

**10:54 Swaroop Yermalkar:** Yeah, so, so developers should keep in mind that the app is going to be accessed on the rooted device or the compromised device where, where, where the user will have access to everything, like whatever they are storing in the keychain or whatever is in the local storage, or, or they could reverse engineer the application like, uh, So in iOS, it's pretty standard format. Like, you can easily reverse engineer any application. Like, you can first decrypt the application using the tools like Clutch, and then you can dump all the classes.

**11:24 Chris Romeo:** Is that because you have the keys? Like, your phone, your personal phone has to be able to decrypt the app to run it, right?

**11:30 Swaroop Yermalkar:** So once you unlock the phone, you can use utilities like Clutch, and then you're gonna actually decrypt the application.

**11:38 Chris Romeo:** Using your credentials on the phone?

**11:41 Swaroop Yermalkar:** You don't need credentials. So when— so basically Clutch, how it works is like when you load the application into your memory, it's basically decrypted. Okay, so Clutch uses that thing and it basically helps you to decrypt the application. Okay, and after that you use the class dumpz and you can actually dump the classes. You can— so you can also use the disassemblers and And you can understand pretty much everything in the application. What are the workflows? What are the hardcoded values and other stuff? So methodology is like static analysis, then reverse engineering, then we keep the proxy in between, and again, we check the dynamic scanning of the application.

**12:24 Chris Romeo:** So when you say static analysis, are there tools that you're using that's actually performing the static analysis?

**12:32 Swaroop Yermalkar:** So there is no like one tool which will do everything. Like we have like different open source tools. Mostly the tools are like free and open source.

**12:39 Chris Romeo:** Okay.

**12:40 Swaroop Yermalkar:** We use for the static analysis, and that comes for like storage analysis or the keychain data and other things.

**12:50 Chris Romeo:** Yeah. Okay. And so from— okay, so, so that's the static analysis side. You're dumping the classes in the disassembler. To look for hardcoded values. So when you proxy, you're just running normal DAST tools, dynamic application security testing tools against the app, or is it special tools for apps?

**13:08 Swaroop Yermalkar:** It's a normal, like we keep the Burp Suite proxy or different scanners and we check the traffic going from app to backend.

**13:16 Chris Romeo:** Oh, okay. So you're not really scanning the app for vulnerabilities per se in the web, like a web service that might be running on the app because everything's running on the server side.

**13:26 Swaroop Yermalkar:** Yeah, mostly. You're just watching the traffic. Nowadays are hybrid application where your server, it's communicating into the servers in the backend.

**13:32 Chris Romeo:** So, okay.

**13:34 Swaroop Yermalkar:** And what I see is like even the endpoints used by the mobile application are weak because, because they don't— the many companies don't pay much attention towards that. Like they have the different endpoints for your web application and different endpoints for your mobile application.

**13:51 Chris Romeo:** Okay.

**13:52 Swaroop Yermalkar:** And I found many of the issues in the endpoints used by the mobile applications.

**13:58 Chris Romeo:** So they're not as vigilant in the security for the mobile endpoints?

**14:01 Swaroop Yermalkar:** Yeah, like server-side validation and like those issues are more towards the mobile endpoints.

**14:07** Hmm.

**14:10 Chris Romeo:** I guess it makes sense because they're probably not seeing as much attack traffic to the mobile side because people just aren't poking at it as much, but that will change, right?

**14:22 Swaroop Yermalkar:** But nowadays time has changed. If you see the traffic for all the big companies, it's more from the, more than 50% is from the mobile. mobile comparing to your web application.

**14:31 Chris Romeo:** After the break, Swaroop answers the question, how does iGoat fit into the pen testing process for iOS and Swift-based applications? The Application Security Podcast operates with support from Security Journey. A Security Belt program provides the 3 pillars of successful AppSec training: learning, application, and experience. Visit us on the web at www.securityjourney.com to learn how you can teach and empower your developers using a new kind of security training. What is the correlation between iGoat and WebGoat?

**15:10 Swaroop Yermalkar:** Almost everyone have heard of WebGoat. So WebGoat is everyone, they start learning for the web vulnerabilities. So same is iGoat, to learn vulnerabilities in the iGoat. So as I said, I do lots of bug bounties, I do lots of security assessment, and I get case— so I take the case studies from there and I add it in the iGoat so everyone in the security community, they can explore, they can learn the vulnerabilities which, which are often found in the iOS applications. And it not only helps to find, but it also helps to secure. Like, we, we provide the solution in the code itself.

**15:47 Chris Romeo:** Yeah.

**15:48 Swaroop Yermalkar:** So all you have to do is rebuild the project and that particular vulnerability will be fixed.

**15:53 Chris Romeo:** So when I get an iGoat, is an iGoat an app and a web service? Or what is iGoat?

**16:00 Swaroop Yermalkar:** Yeah. So it's a mobile application.

**16:02** Okay.

**16:02 Swaroop Yermalkar:** And we have the server in the AWS, also in the Docker. So you need to start the server either as a Docker or it's already there in the AWS. So it basically communicates with the server and you can use it on pretty any iDevice like iPhone, iPad, iPod, or your MacBook simulator.

**16:22 Chris Romeo:** Okay.

**16:22 Swaroop Yermalkar:** So we have made it compatible and you can just start exploring the vulnerabilities there. So they have the— we have the challenges. It's not like just vulnerable application, but it's kind of CTF where you find the values, you enter that, and the application will tell that you are correct or not.

**16:40 Chris Romeo:** So gimme an example then of a challenge that exists in iGOAT, because I mean, I've used WebGoat, I've used Juice Shop, You know, the idea of SQL injection and cross-site scripting in those vulnerable applications is crystal clear to me. Give me an example of one of the challenges that exists in iGoat on the mobile side.

**16:59 Swaroop Yermalkar:** Yeah, so I will take the simplest challenge. Perfect.

**17:02 Chris Romeo:** I like simple.

**17:02 Swaroop Yermalkar:** Yeah, so the one challenge is like many developers make mistake to store data, like sensitive data, in the normal plist file. So plist file is supposed to store the configuration and stuff like that, but not the sensitive information.

**17:16 Chris Romeo:** Okay.

**17:16 Swaroop Yermalkar:** So in iCode, there is a challenge, um, like, uh, it will ask you to find the data in the plist which is already stored and you need to enter in the application. So what the user or the student will have to do is they will have to identify the plist, they will have to identify the data from that, and they will have to enter in the application, and the application will tell that it's, uh, right data or not. Once they find that, there is a method in the code to store the data in the kitchen. So again, they need to uncomment that code and basically rebuild the project. So next time the data will be stored in the kitchen instead of the plist.

**17:57 Chris Romeo:** Oh, so they fix it?

**17:58 Swaroop Yermalkar:** Yeah.

**17:59 Chris Romeo:** So part of iGoat is not— it's not just breaking and finding the broken pieces, it's actually fixing.

**18:04 Swaroop Yermalkar:** Exactly.

**18:05 Chris Romeo:** Okay, that's, that's, that's different than Any of the other, when I think of WebGoat and Juice Shop and even DevSlop, that's different. That's a different approach. And I think that's actually pretty cool to go further than just break it, let's break it and then let's fix it.

**18:22 Swaroop Yermalkar:** So we have built for both pentesters and developers.

**18:26 Chris Romeo:** Got it.

**18:26 Swaroop Yermalkar:** Because I do lots of training and over the time what I understood is developers are very interested to learn security. but they don't have the right platform because they— when they start looking for security solutions, they end up with lots of Stack Overflow, then the different blogs.

**18:43 Chris Romeo:** Yeah.

**18:43 Swaroop Yermalkar:** And they don't know what exactly to fix that problem. And over the time they will leave because they have already— they are under pressure to implement some functionality or feature. So OWASP Cygode is one platform where they can just use the one single point where they can learn how to attack, and also they will learn how to secure that particular vulnerability.

**19:02 Chris Romeo:** Okay, so now give me like a more difficult challenge. Give me an example of something that's— you said that was an easy one. Give me an example of one that's maybe medium or hard.

**19:13 Swaroop Yermalkar:** So we have the, let's say, cloud misconfiguration attack. It's basically, we— so we see that nowadays everyone using the S3 buckets for their data, like file storage. And many of the times they are like misconfigured. So this is, I took from one of the case study like in the bug bounty. Like, uh, so one of the application was, uh, having like storing all the user profile images in the S3 bucket.

**19:42 Chris Romeo:** Okay.

**19:43 Swaroop Yermalkar:** And that bucket was publicly, that had public access. So in the iGOT, we have developed one challenge, uh, where you, you, you will ask to enter the credit card data. And there's a hint, is like cat image. So if you intercept the traffic, you will see that the data is coming from the S3 bucket. And if you explore that more, like, you will see that you can list all the files from the S3 bucket, and you will have the one file which has the credit card information that you need to enter in the application.

**20:13 Chris Romeo:** Is it in your AWS? It's actually in your S3 bucket on AWS? Yes, the file is. Okay, so it's not even in my Docker or anything. It's actually on AWS.

**20:21 Swaroop Yermalkar:** It's actually on AWS.

**20:23** Okay.

**20:23 Chris Romeo:** And so how— so then how do I— walk me through at a high level without giving people all the answer. Walk me through at a high level, how do you get to that? What are the steps you go through in profiling the app to be able to find this problem?

**20:38 Swaroop Yermalkar:** Do you mean like what should be the solution or—

**20:44 Chris Romeo:** Well, without giving us the exact solution, like what are— like are you finding this in the app by decompiling or disassembling the app and then you're finding a reference to the AWS, and then you're going to the AWS and looking in the bucket and finding the permissions are bad. Is that basically what's happening, or is there more to it?

**21:00 Swaroop Yermalkar:** Yeah, so there are multiple approaches. The one is, as you said, like, we can disassemble that, um, we can just dump all the strings, and there you will find the references to the AWS and also your S3 bucket. And then you can link and find the permission set. That is the one approach. Or if it's like, uh, you can also intercept the traffic using Burp Suite And if it's from S3 bucket, you can observe that the data is coming from S3 bucket. And then also you can use the same thing like to identify if— what are the permission levels and stuff like that.

**21:30** Okay.

**21:30 Swaroop Yermalkar:** And we also have a very interesting challenge of like encryption key management because— so we say developers that don't store sensitive information locally, right? Because it can be accessible.

**21:41 Chris Romeo:** Yep.

**21:42 Swaroop Yermalkar:** But again, developers ask then what to do. So we suggest them encrypt the data. But again, developer asks where to store the encryption key, right? Because that is also a problem, because if you are storing the key on the device itself, then it's accessible.

**21:54 Chris Romeo:** Yeah.

**21:54 Swaroop Yermalkar:** So in iGOT, we have developed several challenges. Uh, we say that there is no one solution, there could be different scenarios. Like, the one solution, uh, one of the solutions is random key generation.

**22:07 Chris Romeo:** Okay.

**22:08 Swaroop Yermalkar:** So every time you are storing the data, let's say you need to store something, data, uh, some sensitive data locally. That is the one requirement. You can store it, uh, the— but encryption key will be generated at the runtime. So let's say you're using the iPhone and you have the unique hardware ID, so that will be unique for your own device. So like that, I will take one parameter, other I will take as a timestamp, like, uh, some timestamp, and using that I will create the encryption key. So the thing is, encryption key will be different for each of the devices, each of the users. So I cannot use the same key for decrypting everyone's data. So we are not saying that use the one solution, but in iBot we have developed the different scenarios. So whichever, like the one is like storing the encryption key at the server side. So every time you want to encrypt the data, the key will be fetched from the server and that will be used for the encryption. So it totally depends on like, we cannot say stick with one solution.

**23:09 Chris Romeo:** Okay.

**23:09 Swaroop Yermalkar:** We have the different scenarios, different requirements. So as per your convenience, you can try out that solution and you can apply to your application.

**23:16** Okay.

**23:18 Chris Romeo:** Interesting. So where do you see iGoat, or what are you going to do with iGoat in the future?

**23:22 Swaroop Yermalkar:** So the next goal is like, definitely iGoat is at a definitely good stage. We are also working, planning to automate most of the tasks in iOS security. If you see, there are definitely some challenges with iOS because it keeps changing, unlike Android. Like if you see, there is so much file structure change from iOS 10 to 11. So that is a challenge, but we are planning to automate like many of the tasks which are for the iOS pentesting. Like, so if we can automate most of the things, then that will help the developers or the pentesters to find the issues at the early stages.

**23:58 Chris Romeo:** Okay.

**23:59** Yeah.

**23:59 Chris Romeo:** Yeah. So, and how often are you adding new challenges?

**24:04 Swaroop Yermalkar:** So it's pretty fast. If you say every month we release the new version with at least some bugs fixed or the new challenges. And its team is pretty small and all are the working people, but we try our best to spend time for that project.

**24:20 Chris Romeo:** Yep.

**24:20 Swaroop Yermalkar:** And we have done like, we recently launched a new website, we have launched the documentation, and we have the supporters or developers from all around the world. So Junard is from Singapore, Anthony is from India, like who are like consistent help me in developing this project. And there are other people like Arun from India who is helping on the documentation and stuff. So, it's a community-based project.

**24:49 Chris Romeo:** Yeah, this sounds pretty cool and it sounds like it's a nice fit within the existing vulnerable web applications that we have at OWASP. How does iGOAT stack up against Mobile Application Security Verification Standard and Mobile Security Testing Guide? Are they— do they work together?

**25:09 Swaroop Yermalkar:** Yeah. So if you see Mobile Security Standards or OWASP top 10 list, it almost covers all the attacks which are listed. And it's pretty much, we are covering almost all the top 10 list and all the major attack scenarios.

**25:28 Chris Romeo:** Okay. So you're staying in sync with all the mobile projects are staying in sync to some degree amongst each other. Okay. Yeah, and it seems like mobile is going to only become more and more prevalent into the future. It seems like, like you said in the beginning, more people, more applications and things are going from server-side with web browser clients on laptops to mobile platforms. Mobile side, yes. So, when you think about like Apple's different devices, like Apple's— they have an Apple Home thing now, don't they? Like a HomePod or something like that? Does that— are those apps in the same setup? Are they the same apps that are like what we're running on our phones?

**26:14 Swaroop Yermalkar:** So yeah, if you see, they have the Apple Watch, Apple Home. So it's pretty much same applications which runs on all these devices.

**26:24 Chris Romeo:** Okay. So all of the things you're doing from a pen testing perspective apply to all the different devices that are non-laptop or non, you know, host operating system based?

**26:36 Swaroop Yermalkar:** So frankly, I have mostly worked with the iPhone, iOS applications, and couple of Apple Watch, but not the other devices.

**26:45 Chris Romeo:** Okay. I just, I'm thinking, as I think about those, they're probably, they gotta be on the same problems.

**26:50 Swaroop Yermalkar:** Same, because they run on the same iOS operating system. And it's pretty much that when we are talking about iOS, the structure will remain same. They will have the local data storage and they will have the keychain and same.

**27:01 Chris Romeo:** So tvOS and watchOS, and I don't even, I don't know what runs on the home devices, but they're all gonna have the same or similar style of problems to what you've already laid out here for the phones.

**27:13 Swaroop Yermalkar:** Definitely. If you do security review, we are going to get these fancy bugs.

**27:17 Chris Romeo:** Yeah, so maybe we should not have all these devices.

**27:21** Yeah.

**27:22 Chris Romeo:** We know that's never gonna happen, so we have to make them secure, and it sounds like you're on your way down that road of helping to make that happen in the industry. So thank you for your contributions on iGoat, and thanks for taking the time to bring us up to speed on.

**27:35 Swaroop Yermalkar:** Yeah, thanks, Chris, for inviting me.

**27:37** Thanks for listening to the Application Security Podcast. If you enjoy the podcast, please do us a favor and visit the iTunes Store and give us a 5-star rating. Our intro music is 8-Bit Kung Fu by Born and TJ, and the outro is Southern Delight by Stefan Cartenberg. You can find us on Twitter @appsecpodcast or on the web at www.appsecpodcast.org.

---

Source: https://appsecpodcast.com/swaroop-yermalkar-igoat-and-ios-mobile-pen-testing/