Ivan's Blog

tl;dr I built an agentic mobile security research system that runs the whole mobile bug bounty pipeline, from scoping a program to writing the report.

tl;dr: I had not looked at my blog in months and found a malicious script injected into every post through the Ghost Admin API.

This is a somewhat complicated topic to cover, but I'll try to go into detail on why, generally, this is not a good idea and you should avoid embedding secrets…

Disclaimer: First of all, I'm not writing on behalf of any entities involved in the development of the COVID Alert application.

It's always a good idea to properly configure your computer and smartphone, know how to securely communicate with others and how to read, write and share…

On Tuesday March 24th 2020, the president of Guatemala Alejandro Giammattei announced [https://twitter.com/DrGiammattei/status/1242828589524848643] that his…

After publishing a blog post on spouseware [https://ivrodriguez.com/analyzing-ios-stalkerware-apps/], I started receiving many interesting messages about…

tl;dr It's like security.txt [https://securitytxt.org/] but for iOS applications [https://securityplist.ivrodriguez.com/].

On Friday, September 27th 2019 many of us on the mobile security community were surprised with the news of a SecureROM…

As some of you may know, with the release of iOS 12.4 Apple accidentally reintroduced a vulnerability…

Stalkerware (a.k.a.

For some reason Apple allows "subscription scam" apps on the App Store.

A few days ago Filippo Valsorda [https://twitter.com/FiloSottile] twitted about a simple, secure and modern encryption tool that will hopefully substitute gpg…

One of the reasons why I write blog posts about mobile app sec is for future me.

I have the absolute pleasure and honour of being one of the beta testers of the GuardianApp [https://guardianapp.com/].

Big news!

Last night I saw this tweet from Will Strafach [https://twitter.com/chronic]: After reading that article I just needed to reverse this iOS app and see how it…

My good friend Pete Yaworski [https://twitter.com/yaworsk] encouraged me to join the bug bounty scene for a long time before I decided to jump in and start…

If you landed on this blog post, it probably means you already know what SSL Kill Switch2 is.

My blog is intended to be a hub of knowledge around Technology, Mobile & Web Application Security, Cryptography, Coding and Hacking.

Yesterday, Sep 12th, Apple announced [https://www.youtube.com/watch?

This is the second part of the "Reverse Engineering iOS Apps - iOS 11 Edition" series.

A simple code snippet to format 10 digit phone numbers in Swift 4.0, instead of including a big library, just implement a delegate function and a formatting…

Github provides 2 main options for connecting (cloning, fetching, pulling, pushing) to repositories.

Even though there are already many, many [https://www.google.com/search?

A big part of understanding how mobile apps work is to identify the endpoints they hit on the server side and the data they send and receive.

One of the best trends these days is the shift to encrypted Internet traffic, aka Transport Layer Security or TLS, and mobile apps are not the exception, often…

If you upgraded to macOS Hight Sierra 10.13.x changes are Cydia Impactor [http://www.cydiaimpactor.com/] is giving you this error when trying to install an…

In December last year, @thimstar [https://twitter.com/tihmstar] and @S1guza [https://twitter.com/s1guza] released H3lix [https://h3lix.tihmstar.net/] a…

This past week (Nov 3rd) I attended the Hackfest CTF in Quebec city, QC.

The context I’m a software engineer and really enjoy using technology, but I love using technology to solve problems and make people’s lives better.