fridump | A universal memory dumper using Frida | Reverse Engineering library

Recently the security team has informed me that there’s sensitive data/ password stored in memory.

For the password input, I’m using TextInput onChangeText to do a setstate for the password string before passing it to the API service payload (object with password string) to authenticate the user. Together with redux and redux thunk.

The security team recommends to change the string to char array. I’m not sure how to go about it, since in the end I still need to pass the password string to the API payload and hence the sensitive password string will still be stored in the memory. Another recommendation is to encrypt the string, is it even possible to do this in memory? I’ve encrypt the API call before sending it out, but I’m not sure how to encrypt it in memory.

To detect the string in memory, I’m using a jail broken iPhone with fridump to dump out the memory and use it with -s flag to extract the strings to a text file.