Lisbon 2013 FIRST TC

Static and Dynamic Analysis of iOS Apps for Vulnerabilities

FIRST/TF-CSIRT Seminar

Tuesday — January 29th, 2013 15:00

IT Security staff are increasingly being tasked to manage or oversee "BYOD" mobile fleets. While this may seem an impossible task, there are things we can do to make the job a bit easier, starting with reviewing apps that are permitted on employee devises (under centralized management), including BYODs. This talk describes how IT Security staff can analyze iOS apps for security weaknesses, both statically as well as dynamically. It covers several fundamental analysis techniques and tools available to help in the process.

Presenters

  • Ken Van Wyk (KRvW Associates, LLC)

    Ken is a CERT® Certified Computer Security Incident Handler, as well as an internationally recognized information security expert and author of the popular O'Reilly and Associates books, Incident Response and Secure Coding: Principles and Practices, as well as a monthly columnist for Computerworld. Among his numerous professional roles, Ken is a Visiting Scientist at the Software Engineering Institute at Carnegie Mellon University, where he is a course instructor and consultant to the CERT® Coordination Center.

    Ken has previously held senior information security technologist roles at Tekmark's Technology Risk Management practice, Para-Protect Services, Inc., and Science Applications International Corporation (SAIC). Ken was also the Operations Chief for the U.S. Defense Information Systems Agency's DoD-CERT incident response team, as well as a founding employee of the CERT® Coordination Center at Carnegie Mellon University's Software Engineering Institute.

    Ken has previously served as the Chairman and as a member of the Steering Committee for the Forum of Incident Response and Security Teams (FIRST), a non-profit professional organization supporting the incident response community. He currently sits on their Steering Committee and Board of Directors. He holds a mechanical engineering degree from Lehigh University and is a frequent speaker at technical conferences, including S3, CSI, ISF, and others FIRST.