CODEWITHSUNDEEP
iosapplication-securityios-app-signingmobile-security
Ashking
Ashking

Reputation: 19

What would happen if my iOS distribution certificate is compromised?

I am an iOS newbie and would really like to focus on the security of my iOS app signing certificates.

In my understanding, for a malicious actor to be able to misuse my leaked distribute certificate would need to crack through following 3 layers to distribute malicious version of my app to the innocent customers:

Step 1: My iOS project source code. Let us assume this was leaked too via some weakly configured VCS such as Git

Step 2: Required to install the distribution provisioning profile on the attacker's device. For a moment, let us assume this was performed too.

Step 3: App Store/Test Flight privileges to upload and release the application to the App Store.

Since app signed by distribution certificates can't be installed on individual devices unless attached to a certain provisioning profile such as Ad Hoc or In House, there is nothing much an attacker would be able to achieve.

Is this correct understanding? Can someone please help me in understanding the threat model better?

Upvotes: 1

Views: 549

Answers (0)

Related Questions