Mobile Application Shielding for iOS Version 7.3.0 (May 2025)
- 22 May 2025
- 4 Minutes to read
- Print
- DarkLight
- PDF
Mobile Application Shielding for iOS Version 7.3.0 (May 2025)
- Updated on 22 May 2025
- 4 Minutes to read
- Print
- DarkLight
- PDF
Article summary
The Mobile Application Shielding version 7.3.0 for iOS includes various issue fixes and updates. It supports iOS 12.0 to iPadOS 18, with the end of support for iOS 9.0 and 32-bit architectures. The Shielding Tool requires macOS for application signing and is compatible with Xcode 15 and later. Notably, App Shielding no longer supports iOS 11, and the deprecated ShieldCallback API will be replaced in future versions. Key fixes include improved jailbreak detection and resolution of URL substitution issues. However, limitations persist, such as external screen blocking not functioning with UISceneDelegate on iOS 13 and later. Users must re-enable certain settings when changing App Shielding versions. Additionally, there are concerns regarding the potential for bypassing protection in Cordova-based applications, though the risk is considered low. Xcode may flag the ShieldSDK.xcframework as unverified, which can be resolved through system settings.
Did you find this summary helpful?
Thank you for your feedback
Introduction
Welcome to Mobile Application Shielding for iOS 7.3.0!
This is a release of Mobile Application Shielding with issue fixes. For information about configuring and using Mobile Application Shielding, see the Mobile Application Shielding Integration Guide.
Supported platform versions
iOS 12.0 – iOS/iPadOS 18
With the end of support for iOS 9.0, support for 32-bit architectures also ended.
Shielding Tool:
Windows 10: 64-bit Java 17
Mac OSX (10.15+)
The Shielding Tool requires a macOS system to sign applications.
Ubuntu Linux 20.04 LTS or 22.04
Xcode 15 and later. We recommend using the latest stable Xcode version.
iOS platform updates
App Shielding version 7.3.0 is compatible with iOS/iPadOS 18.5 beta 4.
As of March 1, 2025, App Shielding for iOS version 5.0.5.95564 and earlier are no longer supported. For more information, refer to the OneSpan Mobile Portal.
Deprecations
OneSpan Customer Portal decommissioned
As announced over the previous months, with the launch of our new OneSpan Mobile Portal, we have now decommissioned our previous portal, the OneSpan Customer Portal. Our new OneSpan Mobile Portal offers enhanced features, stronger security, and a more intuitive user interface, designed to provide you with a superior experience. For more information about the OneSpan Mobile Portal, see How to use the OneSpan Mobile Portal.
Platform minimum supported version
The minimum supported version is iOS 12. App Shielding no longer supports iOS 11.
Xcode bitcode
As of Xcode 14, Apple has deprecated bitcode.
As of App Shielding version 6.0.0, the Shielding Tool no longer supports bitcode-based code obfuscation!
Deprecated API
As of App Shielding version 6.5.0, the ShieldCallback API has been deprecated and will be removed in a future version. This API has been replaced with the new PRMShieldEventManager and PRMShieldEventDelegate protocols that have been integrated into the ShieldSDK callback APIs.
Fixes and other changes
RASP-4902 (Support cases INC0014777, INC0014831): URL substitution failed for Exit on Screen Recording URL
Description: When the Exit on Screen Recording URL configuration option was enabled, the launched web page did not correspond to the configured URL.
Status: This issue has been fixed.
SHIOS-3294: Improved Dopamine jailbreak detection
Dopamine jailbreak detection has been improved when RootHide is active. App Shielding detects the following RootHide versions:
Dopamine-roothide v2, versions v13 and up to v17
The improved Dopamine jailbreak detection is only active when using the Exit or ExitURL options for jailbreak and hooking detection and does not apply when using callbacks.
Other notices
Xcode warning for missing dSYM file
Xcode 16 introduced a new warning when it discovers a missing dSYM file. For example:
Upload Symbols Failed
The archive did not include a dSYM for the MyAppx.framework with the UUIDs [XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX]. Ensure that the archive's dSYM folder includes a DWARF file for MyAppx.framework with the expected UUIDs.
The warning can safely be ignored, as it relates to missing symbols for the App Shielding dynamic library. App Shielding is a proprietary SDK, and OneSpan has never shared debug symbols for the library, which is the same for most proprietary/closed source libraries.
Known limitations
The limitations described here have not yet been solved for the current Mobile Application Shielding version. Possible workarounds are described where available.
External screen block
Blocking external screens (e.g. AirPlay) is currently not working for apps that use UISceneDelegate on iOS 13 and later. However, the on-screen keyboard is not blocked.
Settings for Exit On Screen Recording and Exit On Screen Recording URL lost when changing App Shielding versions
If you enable the configuration options Exit On Screen Recording and Exit On Screen Recording URL, and change the App Shielding versions from 7.0.6 or 7.0.6-a to 7.2.1 or vice-versa, your settings will be lost. To ensure the app is exited and the specified web page with an explanation is launched, you need to re-enable the options as required after you changed versions.
Bypassing App Shielding protection in Cordova-based applications
Description: Because of the nature of pure Javascript frameworks such as Cordova, the effectiveness of the push and pull bindings of App Shielding is affected. As a result, it might be possible to extract all Javascript files from a shielded application and build a new Cordova-based application with the extracted Javascript files. That new application will behave identical to the original one but has two major differences:
It is not longer protected with App Shielding.
It is signed with a different developer certificate.
Because this new application is signed with a different developer certificate, it is recognized by the stores or every device as a completely different and new application in comparison to the original shielded application. It cannot be avoided that a new application like this is built that looks and behaves similar to the original application.
OneSpan risk assessment: Threat actors will need to make heavy use of targeted phishing attacks to convince users of the original application to install the rogue version. For attackers, however, it is much easier to use existing malware frameworks that mimic hundreds of login screens in one single piece of malware. In addition, the existence of any rogue versions of the application does not affect the security features of the original shielded application. Everyone who is using the genuine, shielded application is protected with all the features of App Shielding, including all security measures of the original application. Therefore, we consider this issue to be of low risk.
Xcode marks ShieldSDK.xcframework package as not signed/verified
Xcode marks the ShieldSDK.xcframework package as not signed or verified and might move it to quarantine mode. If Xcode displays a message like ShieldSDK.xcframework cannot be opened..., follow these steps to resolve it:
Select Cancel.
Open the macOS System Settings.
Navigate to Privacy & Security.
Scroll down to the security warning and select Allow Anyway.
This will be fixed as soon as possible.
Was this article helpful?