Quick QA notes about asvs

[vanderaj]

Thanks for these. I'll incorporate all of these and publish a new version.

[vanderaj]

PIE is not necessarily a security control. Exploits need to be PIE to run, but that doesn't mean that PIE code will not be linked and loaded at the same specific address each time. Can you nominate a use case for PIE that enables more security?

[ethicalhack3r]

I'm parroting what I have read, my knowledge of binary app security is limited. According to The Mobile Application Hacker's Handbook, page 56:

PIE allows an (iOS) application to take full advantage of ASLR.

An application compiled without PIE loads the executable at a fixed address.

Some other iOS app security measures recommended by the book:

Stack-Smashing Protection
Automatic Reference Counting (ARC)

^ Not sure if these are also worth considering

[vanderaj]

In other news, all but two of your QA notes were acted upon and are now in the repo. Check out the new version.

[danielcuthbert]

I'm going to assume all is good with this now. Pushing on to clear this queue and get 3.0 ready for release shortly. If there's anything glaringly still open, please log a new ticket and ill sort.

[ethicalhack3r]

Just checked, all good! Thanks!