Class: AiRootShield::Platform::IosSecurityModule

Inherits:
Object
  • Object
show all
Defined in:
lib/ai_root_shield/platform/ios_security_module.rb

Overview

iOS-specific security module with advanced jailbreak detection

Constant Summary collapse

JAILBREAK_INDICATORS =

iOS jailbreak detection categories

{
  file_system: %w[
    /Applications/Cydia.app
    /Applications/blackra1n.app
    /Applications/FakeCarrier.app
    /Applications/Icy.app
    /Applications/IntelliScreen.app
    /Applications/MxTube.app
    /Applications/RockApp.app
    /Applications/SBSettings.app
    /Applications/WinterBoard.app
    /Library/MobileSubstrate/MobileSubstrate.dylib
    /Library/MobileSubstrate/DynamicLibraries/LiveClock.plist
    /Library/MobileSubstrate/DynamicLibraries/Veency.plist
    /private/var/lib/apt
    /private/var/lib/cydia
    /private/var/mobile/Library/SBSettings/Themes
    /private/var/stash
    /private/var/tmp/cydia.log
    /System/Library/LaunchDaemons/com.ikey.bbot.plist
    /System/Library/LaunchDaemons/com.saurik.Cydia.Startup.plist
    /usr/bin/sshd
    /usr/libexec/sftp-server
    /usr/sbin/sshd
    /etc/apt
    /bin/bash
    /bin/sh
    /usr/bin/ssh
  ],
  url_schemes: %w[
    cydia://
    undecimus://
    sileo://
    zbra://
    filza://
    activator://
  ],
  dyld_libraries: %w[
    MobileSubstrate
    SubstrateLoader
    SSLKillSwitch
    SSLKillSwitch2
    LibertaLite
    Shadow
    FlyJB
    Substitute
  ]
}.freeze

Instance Method Summary collapse

Constructor Details

#initialize ⇒ IosSecurityModule

Returns a new instance of IosSecurityModule.



60
61
62
 
# File 'lib/ai_root_shield/platform/ios_security_module.rb', line 60

def initialize
  @detection_cache = {}
end

Instance Method Details

#analyze_device_security(device_logs) ⇒ Object

Comprehensive iOS security analysis



65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
 
# File 'lib/ai_root_shield/platform/ios_security_module.rb', line 65

def analyze_device_security(device_logs)
  results = {
    jailbreak_detection: detect_jailbreak(device_logs),
    code_signing: analyze_code_signing(device_logs),
    sandbox_integrity: analyze_sandbox_integrity(device_logs),
    dyld_injection: detect_dyld_injection(device_logs),
    hardware_security: analyze_hardware_security(device_logs),
    system_integrity: analyze_system_integrity(device_logs),
    risk_factors: [],
    risk_score: 0
  }
  
  calculate_ios_risk_score(results)
  results
end