NowSecure

We deliver mobile app security testing, incident response, and compliance solutions.

Main navigation

iOS

Adventures in Remote Code Execution and Zip File Vulns — from Samsung and Vungle to ZipperDown

As with all things mobile, there are both secure and insecure ways of downloading and using zipped content. Back in 2014, NowSecure identified and properly disclosed zip file download and remote code execution (RCE) vulnerabilities on Android for Samsung and Vungle. Now Pangu has posted about iOS zipfile download issues identified as ZipperDown.

Read Now >

U.S. Soldiers and Athletes using STRAVA social fitness apps: Finding Risky Mobile Apps that Share and Leak Data

A series of mobile apps built by or connecting with STRAVA have been sharing and publishing activity by geolocation – including what should be highly confidential information about U.S. personnel and military staff locations. Get recommendations on how to protect your organization and staff from risks like STRAVA data collection and sharing.

Read Now >

A guide to App Transport Security (ATS) for security analysts, by a security analyst

A security analyst’s guide to NSAppTransportSecurity, NSAllowsArbitraryLoads, and App Transport Security (ATS) exceptions

I’ve recently noticed a spike in questions from our customers — and specifically security analysts — about App Transport Security (ATS), or NSAppTransportSecurity, for iOS apps. ATS is a critical security practice for our customers in financial services and other regulated industries. A lot of ATS documentation already exists, but questions persist. A core part

Read Now >