Home/ Questions/Q 8487289
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-10T21:11:42+00:00

Is anyone hardening their code in an attempt to detect injections? For example, if

  • 0

Is anyone hardening their code in an attempt to detect injections? For example, if someone is trying to intercept a username/password via NSUrlConnection, they could use LD_PRELOAD/DYLD_LIBRARY_PATH, provide exports for my calls into NSUrlConnection, and then forward the calls to the real NSUrlConnection.

Ali gave excellent information below, but I’m trying to determine what measures should be take for a hostile environment, where a phone might be jail broken. Most applications don’t have to care, but one class of apps do – high integrity software.

If you are hardening, what method(s) are you using? Is there a standard way to detect injections on Macs and iPhones? How are you defeating framework injections?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    For iOS / CocoaTouch, loading dynamic libraries is not allowed* (except for the System frameworks). To build and distribute an Application thru the AppStore, you can only link with static libraries and system frameworks, no dynamic library.

    So on iOS you can’t use that for code injection, neither can you use LD_PRELOAD of course (as you don’t have access to such environment variables on iOS).

    Except for jailbroken iPhones probably, but people jailbreaking their iPhone should take upon themselves that jailbreaking is by definition lifting all securities provided by iOS to avoid things such as injections (so you can’t expect to remove the lock on your door to avoid having to use your key… and still expect that you’re still protected against thieves robbing your house ;-))

    That’s the advantage of the Sandboxing + CodeSigning + No dylib constraints on iOS. No Code injection possible.

    (On OSX it is still possible anyway, inparticular using LD_PRELOAD)

    [EDIT] Since iOS8, iOS also allows dynamic frameworks. But as that’s still sandboxed (you can only load code-signed frameworks that are inside your application bundles, and can’t load frameworks that comes from outside your app bundle) injection is still not possible*

    *except if the user jailbreaks its phone but it means that s/he chose to get rid of all protections and purpose and thus put its phone at risk — we can’t crack our phone security and still expect it to provide all the protections those securities provided

    • 0