iOS Private API Detection PoC

Educational Security Research — App Spying Detection Framework

⚠️ DISCLAIMER: This project is for educational and defensive security research ONLY.

• ✅ Use to understand how apps spy on you
• ✅ Use to detect if your apps are doing this
• ✅ Use for interview/learning purposes
• ❌ DO NOT use to build actual spyware
• ❌ DO NOT use to spy on users without consent

---

What This Shows

Vulnerability (How Banks Spy)

Vietnamese banking apps (BIDV, Agribank) use private iOS APIs to detect:

• Which other banking apps you have installed
• If you use competing payment systems (PayPal, Crypto, etc.)
• If your phone is jailbroken
• Your complete app inventory

Technique

Private API: SBSLaunchApplicationWithIdentifier()
Obfuscation: XOR encryption of bundle IDs
Detection:   Error codes reveal app presence

Real Example

BIDV app detects you have PayPal installed
→ Sets your fraud risk score higher
→ Restricts transactions or charges you more
→ All without your knowledge/consent

---

Files in This PoC

1. AppDetectionFramework.swift — Concept code showing how the spying works
2. StringObfuscation.swift — XOR encryption technique (how BIDV hides it)
3. DefensiveDetection.swift — How to detect if YOUR app is being spied on
4. AnalysisTools.py — Reverse engineering tools to find this in binaries
5. Interview_Talking_Points.md — What to say about this in interviews

---

How to Use This

For Learning

1. Read AppDetectionFramework.swift
2. Understand the private API call
3. See how XOR obfuscation works
4. Learn how to detect it defensively

For Interview Prep

"I found that Vietnamese banking apps use private APIs to detect 
competing apps. They obfuscate with XOR encryption. Here's how 
it works and how to detect it..."

For Personal Security

1. Run AnalysisTools.py on suspicious apps
2. Check network traffic for app lists
3. Review entitlements
4. Detect if you're being spied on

---

Security Implications

What Banks Collect

• ✅ All 50+ apps you have installed
• ✅ Which payment systems you use
• ✅ If you're using competitors
• ✅ If you're jailbroken/using VPN
• ✅ Your complete financial behavior profile

Why This Matters

• 🚨 Discrimination based on app usage
• 🚨 Data sold to marketing companies
• 🚨 Risk profiles used against you
• 🚨 No user consent

---

References

• VeriChain Analysis - BIDV/Agribank Private API Abuse (March 2025)
• iRiS: Vetting Private API Abuse in iOS Applications

---

Disclaimer

This project is provided for educational purposes only.

Authors are NOT responsible for:

• Misuse of this code to spy on actual users
• Any legal consequences from using this
• Damage to apps/devices from testing
• Privacy violations or unauthorized access

By using this code, you agree:

• ✅ To use only on your own devices
• ✅ To respect others' privacy
• ✅ To understand the legal implications
• ✅ That this is for learning, not malice

---

Created for iOS Security Research & Interview Preparation