Mobile Application Shielding for iOS Version 7.0.6 (March 2025)

In the OneSpan Mobile Portal, the following configuration options have been renamed and their descriptions updated accordingly:

Exit On Screenshot has been renamed to Exit On Screenshot or Screen Recording. When enabled, the application is exited when a screenshot is taken or when a screen recording is detected. For more information, see Configuration of App Shielding for iOS apps.

Exit on Screenshot URL has been renamed to Exit On Screenshot or Screen Recording URL. If a URL is specified, a web page is launched with an explanation when the application is shut down because the user takes a screenshot or the screen is being recorded. For more information, see Exit URL Launching.

Dopamine jailbreak detection has been improved, and Dopamine detection has been added when RootHide is active.

App Shielding detects the following RootHide versions:

• Dopamine-roothide v1.1.1

• Dopamine-roothide v2, versions v13 and v15

App Shielding currently does NOT detect the following versions:

• Dopamine-roothide v1.1.2

• Dopamine-roothide v2, versions v14 and v16

Xcode 16 introduced a new warning when it discovers a missing dSYM file. For example:

 ```
  Upload Symbols Failed
  The archive did not include a dSYM for the MyAppx.framework with the UUIDs
  [XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX]. Ensure that the archive's dSYM folder
  includes a DWARF file for MyAppx.framework with the expected UUIDs.
  ```

The warning can safely be ignored, as it relates to missing symbols for the App Shielding dynamic library. App Shielding is a proprietary SDK, and OneSpan has never shared debug symbols for the library, which is the same for most proprietary/closed source libraries.

Description: Because of the nature of pure Javascript frameworks such as Cordova, the effectiveness of the push and pull bindings of App Shielding is affected. As a result, it might be possible to extract all Javascript files from a shielded application and build a new Cordova-based application with the extracted Javascript files. That new application will behave identical to the original one but has two major differences:

1. It is not longer protected with App Shielding.

2. It is signed with a different developer certificate.

Because this new application is signed with a different developer certificate, it is recognized by the stores or every device as a completely different and new application in comparison to the original shielded application. It cannot be avoided that a new application like this is built that looks and behaves similar to the original application.

OneSpan risk assessment: Threat actors will need to make heavy use of targeted phishing attacks to convince users of the original application to install the rogue version. For attackers, however, it is much easier to use existing malware frameworks that mimic hundreds of login screens in one single piece of malware. In addition, the existence of any rogue versions of the application does not affect the security features of the original shielded application. Everyone who is using the genuine, shielded application is protected with all the features of App Shielding, including all security measures of the original application. Therefore, we consider this issue to be of low risk.

Xcode marks the ShieldSDK.xcframework package as not signed or verified and might move it to quarantine mode. If Xcode displays a message like ShieldSDK.xcframework cannot be opened..., follow these steps to resolve it:

1. Select Cancel.

2. Open the macOS System Settings.

3. Navigate to Privacy & Security.

4. Scroll down to the security warning and select Allow Anyway.

This will be fixed as soon as possible.

Blocking external screens (e.g. AirPlay) is currently not working for apps that use UISceneDelegate in iOS 13 and later.

If you are using Jigsaw, the following apps might encounter unexpected termiantions or other issues:

• Apps that utilize heavy bridging between Swift and Objective-C.

• Apps which programmatically read information at the beginning of virtual space, such as the Mach-O header.