My application captures location data in background and saves in sqlite database. It works well when Device is not locked, but when device is locked I am not able to access sqlite database. It always gives me error code as SQLITE_AUTH(error code:23).
I have tried below options:
Disable the Data Protection from Capabilities.(Does not work)
As per Failed to create SQLite3 database with file protection in iOS, I tried the below code :
sqlite3_open_v2([dbPath UTF8String], &myDatabase, SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE|SQLITE_OPEN_FILEPROTECTION_COMPLETE, NULL)
But still its not working.
Could you please help me, How to access the sqlite database in background.
You need to enable Data Protection from your app from iTunesconnect.
1. Enable data protection for your app. For example,
2. Add below file protection key and value into your plist or entitlement file,
<key>com.apple.developer.default-data-protection</key>
<string> NSFileProtectionCompleteUntilFirstUserAuthentication</string>
The type must match to your capability set from itunes server.
3. Rebuild and test if the issue is resolved
File Data Protection
In addition to the hardware encryption features built into iOS devices, Apple
uses a technology called Data Protection to further protect data stored in flash
memory on the device. Data Protection allows the device to respond to common
events such as incoming phone calls, but also enables a high level of encryption
for user data. Key system apps, such as Messages, Mail, Calendar, Contacts,
Photos, and Health data values use Data Protection by default, and third-party
apps installed on iOS 7 or later receive this protection automatically.
Data Protection is implemented by constructing and managing a hierarchy
of keys, and builds on the hardware encryption technologies built into each
iOS device. Data Protection is controlled on a per-file basis by assigning each
file to a class; accessibility is determined by whether the class keys have been
unlocked. With the advent of the Apple File System (APFS), the file system is
now able to further sub-divide the keys into a per-extent basis (portions of a
file can have different keys). Find detail here in section File Data Protection.
Related
I need to protect a file with user data, however I can't really verify if built-in iOS mechanism works. I implemented data protection in my app by:
Enabling Data Protection in AppId
Updating provisioning profiles
Adding Data Protection to entitlements.plist (entry: com.apple.developer.default-data-protection = NSFileProtectionComplete)
Setting attribute FileProtectionComplete on my file
Turning on passcode on iPhone
I was able to confirm, that this attribute is set properly. However, I tried to lock device, wait about 1 minute and access file through iExplorer or by downloading app container from Xcode->Devices and every time I'm able to get non-encrypted content.
I wonder if it's a matter of debug build or not. Is there any way to download encrypted file to confirm that data protection really works (without jailbreaking)?
I've been researching literacy about the secure aspect of the NSUserDefaults leveraged by the ManagedAppConfig capability of iOS.
We are leveraging this "new" iOS capability to configure our enterprise application via various MDM systems used in our customers landscape.
A debate is now raging on how secure it is.
From our side, the only way that we have found to get this information is to actually JailBrake the device. Which of course would be detected by the MDM system.
Any other security vulnerability that we may have missed there ? Anybody looked into the security aspect of this feature ?
Thanks!
Ingrid.
Everything you store un NSUserDefault is easily accessible (with an app like iExplorer for mac, for example). No need to jailbreak. It is all stored in a .plist file in the Library/Preferences folder of your app.
I had to hide some information before, the way I did it was by using Data Encryption. For more information, read the section called Enabling Data Protection
All you would need to do after enabling correct data protection, is to create a file and store your configuration there. By putting the Data Encryption to NSFileProtectionComplete, your file will be visible, put not readable when the device is locked. For this to work, the user must have set a password on his device
I have read that
In iOS 4 and later, apps can use the data protection feature to add a
level of security to their on-disk data. Data protection uses the
built-in encryption hardware present on specific devices (such as the
iPhone 3GS and iPhone 4) to store files in an encrypted format on
disk. While the user’s device is locked, protected files are
inaccessible even to the app that created them. The user must
explicitly unlock the device (by entering the appropriate passcode) at
least once before your app can access one of its protected files.
My question is that can I use it for app level protection? That is even if user didn't set a passcode for his device, all data related to my application must be encrypted using above method while application enters in background. Is it possible? Let us put it i this way "When ever my app goes in background all the secrete data in my app must be hardware encrypted and when the app resumes back, it must prompt me to enter my password"
I have been searching for a solution for more than two days....Any help is greatly appreciated...
No you cannot. The convenient automatic file encryption mechanism only works with the passcode.
From the iOS App Programming Guide:
Data protection is available on most iOS devices and is subject to the
following requirements: [...] The user must have an active passcode
lock set for the device.
To implement an automatic encryption mechanism independent of the passcode, you need to build it on your own, e.g. using the general purpose encryption APIs.
I have a quick question:
I downloaded an iOS application that uses the NSFileProtectionComplete class to protect a sqlite file that contains sensitive information.
According to the iOS security documentation (http://images.apple.com/ipad/business/docs/iOS_Security_May12.pdf), when a device (iPhone/iPad) is paired with the laptop, the laptop obtains the escrow keybag from the mobile device . The keybag contains all the class keys necessary to decrypt information on the device.
However, I noticed that when I pair the device with the laptop and use iExplorer to browse the file system, the sqlite file is only available when the device is unlocked. When the phone is locked (still paired) the file is not readable. Files which are not using NSFileProtectionComplete can be viewed while the device is locked.
If the escrow keybag contains all the class keys to decrypt information, why do I have to unlock the device to access it through iExplorer?
I'm using iOS 6.0 on an iPad3 and used the ios-dataprotection tool (https://github.com/ciso/ios-dataprotection) to determine the data protection class used by the files.
iOS Application: AccountVault
File: PointMinder.sqlite
Any help will be appreciated.
Thanks.
From documentation file you've linked:
Complete Protection (NSFileProtectionComplete): The class key is
protected with a key derived from the user passcode and the device
UID. Shortly after the user locks a device (10 seconds, if the Require
Password setting is Immediately), the decrypted class key is
discarded, rendering all data in this class inaccessible until the
user enters the passcode again.
So device should be unlocked if you want to access that files. That is how Apple made it.
Edit: Found in "Hacking and Securing iOS Applications":
Protection class keys are master encryption keys used to unlock files based on their access policy.
Protection classes are the encryption mechanism used to enforce the access policies of files.
Some files are so important that the operating system should be able to decrypt them only when the device’s user interface is unlocked. These files’ encryption keys are wrapped with a class key that is available only after the user has entered his passcode. When the device locks again, the key is wiped from memory, making the files unavailable again.
Protection class master keys are stored in an escrow known as a keybag. The keybag contains the encrypted protection class master keys, as well as other keys to system files on the device. The system keybag is encrypted using another encryption key named BAGI, which is also stored in the effaceable storage of the NAND. Whenever the user authenticates to meet a specific security protection policy, the encrypted keys in the keybag can be decrypted.
So keys for that files are transferred, but are encrypted. When you enter your passcode, OS decrypt that key and it can then be used to decrypt files protected with it.
This works for me for SQLite databases in my app only, not for my other resources as I was hoping. BUT, I was having the same issues still being able to access the databases after locking the device and waiting several minutes with iExplore still open and device still connected. If I disconnect the iPad and connect right back in, iExplore forced to refresh I guess and I then could NOT access the databases. So not sure if it just has the old 'unencrypted' database info in memory or what.
I have encrypted files downloaded and available for offline view in a folder, I would like to know:
how to open them in the appropriate reader as these are ms office docs and prezi format
I suppose they will have to be unencrypted so that reader can read them but in this case how to ensure security?
which folder to use to avoid iCloud sync, I already read this Disable iCloud sync
Does iOS protects documents of the application by encryption based on app key as I read it or am I wrong?
Speaking extemporaneously, as thoughts occur, Sven is right about UIDocumentInteractionController and that objects are identified by URL.
However, it's possible you don't need to unencrypt your files on disk for this to work. You can probably write your own little URL protocol (subclass NSURLProtocol and implement methods appropriately; you should end up checking that URLs are within the invented scheme you've created — e.g. myApplicationEncrypted:// — then posting data packets to a NSURLProtocolClient) and register it with the device via NSURLProtocol +registerClass.
You'll obviously need to decrypt between disk and protocol client. So you'll be passing unencrypted data on — you'll need to make a trust judgment on UIDocumentInteractionController.
The document interaction controller is documented to work within your app, so there shouldn't be sandbox concerns.
You can send your documents to other apps using an UIDocumentInteractionController object. You initialize it with a file URL pointing to your document and then use one of it’s methods to present it.
This takes care of displaying a preview (if possible) and letting the user select the application the document should be opened in.
The document has to be decrypted for this to work. You then cannot make any guarantees about the security of your file - once it is handed over to another application it is out of your control.
If your app doesn’t explicitly opt-in to use iCloud sync your data will not be synced with iCloud. What will be sent to iCloud are backups of the whole device though (if enabled). There are ways to disable this for single files as you already read in the question you linked.
The iOS file protection is based on a device key, not on a per app key. This also is not necessary because apps are protected from each other by the sandbox, unless your phone is jailbroken. On a jailbroken phone there are no security guarantees.