🍎iOS

Example: https://github.com/talsec/Free-RASP-iOS

📝 Prerequisites

freeRASP requires a minimum iOS 13+.

📦 Add the dependency

1. From GitHub, Copy Talsec folder into your Application folder.

2. Drag & drop the Talsec folder to your .xcworkspace.

3. Add TalsecRuntime framework to Target > Build Phases > Link Binary With Libraries.

4. In the General > Frameworks, Libraries, and Embedded Content choose Embed & Sign.

Note: In case you are using Carthage, the zipped version of the framework is included in the GitHub Releases.

---

⚙️ Setup the Configuration for your App

To ensure freeRASP functions correctly, you need to provide the necessary configuration. All required values must be filled in for the plugin to operate properly. Use the following template to configure the plugin. Detailed descriptions of the configuration options are provided on the API page.

In the AppDelegate import TalsecRuntime and add the following code (e.g., in the didFinishLaunchingWithOptions method.:

AppDelegate.swift

let config = TalsecConfig(
    appBundleIds: ["YOUR_APP_BUNDLE_ID"], 
    appTeamId: "YOUR TEAM ID", 
    watcherMailAddress: "[e-mail]", 
    isProd: true
)

It does not have to be AppDelegate, it can be anywhere. However, the recommended approach is to start the SDK as soon as possible.

Configuration Parameters

• isProd - a boolean flag that determines whether the freeRASP integration is in the Dev or Release version. If you want to learn more about isProd, visit this wiki section.

• watcherMail - By providing your watcherMail, you consent to receive security reports, product updates, and other essential communications from Talsec. Learn more about the role of watcherMail.

---

👷 Handle detected threats

You can handle the detected events using handlers. For example, you can log the event, show a window to the user or kill the application. See the Threat detection to learn more details about the performed checks and their importance for app security.

1. Anywhere in your project (e.g. in AppDelegate), add the following code as an extension:

   AppDelegate.swift

   import TalsecRuntime
   
   extension SecurityThreatCenter: SecurityThreatHandler {
       public func threatDetected(_ securityThreat: TalsecRuntime.SecurityThreat) {
           print("Found incident: \(securityThreat.rawValue)")
       }
   }

2. Use the code above for handling these types of events:

   TalsecRuntime

   public enum SecurityThreat: String, Codable, CaseIterable, Equatable {
       /// app integrity / repackaging / tampering
       case signature = "appIntegrity"
       /// jailbreak
       case jailbreak = "privilegedAccess"
       /// debugger
       case debugger = "debug"
       /// runtime manipulation / hooks
       case runtimeManipulation = "hooks"
       /// disabled passcode
       case passcode
       /// [DEPRECATED] passcode change
       case passcodeChange
       /// simulator
       case simulator
       /// missing Secure Enclave
       case missingSecureEnclave
       /// device binding
       case deviceChange = "device binding"
       /// changed deviceID
       case deviceID
       /// unofficial store or Xcode build
       case unofficialStore
       /// Detected system VPN
       case systemVPN
       /// screenshot
       case screenshot
       /// screen recording and screen mirroring
       case screenRecording
       /// Time spoofing detected
       case timeSpoofing
   }

---

📱(Optionally) Add screenshot and screen capture blocking

To utilize active screen shot and screen capture (e.g. mirroring, screen recording) protection, you can use Talsec.blockScreenCapture(enable: Bool, window: UIWindow) with specific UIWindow on which it should be blocked. To receive whether the screen capture is blocked in the specific UIWindow, you can use the Talsec.isScreenCaptureBlocked(in window: UIWindow). For more details about all these screen capture methods, see Screen Capture.

👷(Optionally) Get information about state of check execution

You can use RaspExecutionState to get callback when are initial checks are finished:

AppDelegate.swift

extension SecurityThreatCenter: RaspExecutionState {
    public func onAllChecksFinished() {
        print("Initial checks done")
    }
}

🛡️ Start freeRASP

Invoke the following method right after setting up the TalsecConfig in previous steps.

AppDelegate.swift

...
let config = TalsecConfig(...)
Talsec.start(config: config)

For the version you’re integrating, you can find the specific dSYMs for debugging in Releases.

---

🖥️ Check Talsec Portal

Check out Data Visualisation Portal and register using your watcherMail to see your data. If you integrated the SDK successfully, the application will be present after a few hours. The visualisations will be active later due to the bucketing mechanism.

You have to use the same email for the Portal as you used for the watcherMail parameter.