Testing third-party iOS apps will help you uncover unknown vulnerabilities in a mobile app.
For example, researching third-party iOS apps, has led to the discovery of numerous fraudulent, fleecing, and malicious applications. Recently, Meta researchers found 400 malicious Android and iOS apps designed to steal logins. Similarly, another group of researchers uncovered suspicious Chat GPT clone apps masquerading on the App Store to capitalize on the chatbot craze.
However, sourcing the right device—OS combination, jailbreaking the device to gain root access, and constantly flashing or updating the device to a desirable state adds more drudgery to an already time-consuming task.
Forward-looking security researchers are now adopting virtual hardware platforms to bypass these physical device limitations and advance mobile app security testing.
Common Scenarios for Third-Party Mobile App Testing & How Virtualization Changes What's Possible
Bug Bounties
Security researchers commonly test third-party iOS apps as part of a bug bounty program.
Companies invite independent security testers to test and report security defects in their iOS mobile apps in exchange for rewards ranging from hundreds to thousands of bounty dollars per vulnerability. Researchers are incentivized to find and report vulnerabilities, which the app developer can then fix to improve the app's security.
Through virtualization, researchers have access to a comprehensive list of device and OS combos available and can seamlessly jailbreak or root any device, removing the need to rely on security vulnerabilities. Access to devices and all iOS versions unlocks the potential to rapidly and seamlessly perform vulnerability and exploit research.
Investigating Popular Third-Party iOS Apps
Independent security researchers are a vital resource for enterprise organizations, helping to discover vulnerabilities before they can be exploited and cause harm to end users.
Independent initiatives, like Google Project Zero, have led to the revelation of security defects, like those uncovered in WhatsApp, that allow hackers and foreign governments to compromise the physical devices of iOS users. To forestall future compromises of this kind, developers and security researchers need to identify vulnerabilities within mobile apps before attackers and malware can exploit them.
Device virtualization allows security researchers to participate more closely in the software development cycle, simplifying critical work while also accelerating secure software development.
Virtualization makes it possible to perform both dynamic and static testing.
Virtualization also enables reverse engineering an app to fully understand its inner workings, detect hard coded values in the code, and gain insights into building exploitation scripts.
Virtualization Streamlines Third-Party iOS App Testing
By developing the world’s most powerful Arm-based virtualization, Corellium is opening up new possibilities to test third-party iOS apps.
Unlike iOS simulators, the Corellium virtual devices run directly on a 64-bit ARM CPU architecture server, just like a physical iOS device does. So, you get native fidelity and real-time performance without any lags. Corellium also allows you to scale up or down the number of processors as needed. So, security researchers no longer need to be constrained by the hardware processor of an Apple device. Instead, they can access near unlimited processing capability while testing third-party iOS apps.
With the Corellium Virtual Hardware Platform, security teams can access endless combinations of iOS device models and operating systems. So, instead of dealing with old iOS phone resellers, security testers can now focus their energy on the actual work of iOS app testing.
Everything your team needs to conduct extensive research and testing is available through Corellium’s simple yet powerful browser interface, built-in security tools, and comprehensive APIs. So, while testing third-party iOS apps, you no longer need to spend extra effort connecting to external traffic monitoring tools of your choice, debugging tools like GDB and IDA, or Frida and Cydia installations.
Because Corellium decouples hardware availability and security testing, you can use the platform to test an app for vulnerabilities even before you release it on the App Store or update the app for the latest iOS version. So, instead of reacting to zero-day vulnerabilities after a new device or iOS version gets released, you can now proactively prepare for it.
For specifics on how you can install iOS apps for security research purposes, our team gives you a rundown here.
Unlock Superior Mobile Security Testing with Corellium
Equip your security teams with unprecedented tools for both manual and automated testing, freeing up valuable engineering time and saving money. Discover the power of Corellium’s high-fidelity virtual devices and spin-up near limitless combinations of device and OS with one-click jailbreak/root access. Book a meeting today to see how we can streamline your processes and reduce costs.
