The iOS security model: secure boot, code signing, sandbox and data protection
You learn iOS's layered protection through a security person's eyes: the secure boot chain, the Secure Enclave, code signing and entitlements, the sandbox, data protection classes and the Keychain.
Level 201 · 22 lessons · 18 practice labs
Lessons
Hardware and boot
- The secure boot chain: from Boot ROM to kernel
- The Secure Enclave: where keys and biometrics live
- System integrity: the signed system volume and kernel protections
- Update signing and blocking downgrades
- Short task: order the links of the boot chain and what each one verifies
Code signing
- Code signing: only signed code runs
- Certificates and provisioning profiles
- Entitlements: the privileges granted to an app
- Distribution types: development, ad hoc, in-house, store
- The concepts of App Attest and DeviceCheck
- Short task: extract the team ID, device list and expiry from a provisioning profile
Isolation
- Sandbox containers: bundle, data and group containers
- App extensions and app groups
- Inter-app communication on iOS: URL schemes, universal links, pasteboard
- Behind the scenes of privacy permissions
- Short task: map the folders in an app's container export to their purpose
Data protection
- Data protection classes: when a file can be read
- The Keychain: item classes and accessibility values
- Access groups and iCloud Keychain sync
- The passcode and the key hierarchy
- Short task: read the protection classes in a file list and flag the weak one
Capstone
- Capstone: write a note that documents an iPhone's security posture layer by layer
Practice labs
- Order the links of the boot chain: Put the given links in the right order and write what each one verifies.
- Find the boot stages in a system log excerpt: Mark the line for each stage in the prepared excerpt.
- Explain with evidence why a downgrade is blocked: Examine the update signing records and explain in a technical note why an unsigned version cannot install.
- Extract the team ID from a provisioning profile: Decode the embedded profile and find the team ID and expiry.
- Determine a profile's distribution type: Prove from the device list and flags whether it is development, ad hoc, in-house or store.
- Audit the signing state of three IPAs: Find the expired profile, the wrong distribution type and the mismatched bundle ID.
- List an app's entitlements: Extract the entitlement dictionary from the binary and write the keys.
- Compare entitlements with those in the profile: Find the entitlement present in the binary but absent from the profile and explain the consequence.
- Assess the effect of a wide keychain group: Find the access group shared by two apps, document which data both can read and write a risk note.
- Map the folders in a container export to their purpose: Identify the Documents, Library, Caches and tmp folders.
- Tell the bundle, data and group containers apart: Classify three folder trees by type and state which one is backed up.
- Find the data shared with an extension: Extract the files kept in the group container and report that the extension reaches more data than it needs.
- Read the protection classes in a file list: Tabulate each file's class.
- Flag the file left in a weak protection class: Find the sensitive file sitting in a class readable while locked and recommend the right class.
- Balance a background feature against protection class: For an app that syncs while locked, write a reasoned design note on which file belongs in which class.
- Read the accessibility values in a Keychain listing: List each item's accessibility value.
- Separate the items that travel with backups: Separate this-device-only items from the rest and flag the one that should not travel.
- Write a note documenting an iPhone's posture layer by layer: Join boot, signing, sandbox, data protection and Keychain evidence in one note.
About this course
You learn iOS's layered protection through a security person's eyes: the secure boot chain, the Secure Enclave, code signing and entitlements, the sandbox, data protection classes and the Keychain.
What you will learn
- Hardware and boot
- Code signing
- Isolation
- Data protection
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.