DVIA-v2 App Pen-testing Report
Vulnerability 1:
Title:
Saving sensitive user data in userInfo plist:
Description:
Storing sensitive data, such as passwords or API keys, in plaintext within property list les
(plist) in an iOS app poses a signi cant security risk. Plist les are easily accessible and
readable, making it trivial for attackers to extract and misuse sensitive information.
Impact:
The impact of storing sensitive data in plaintext within plist les is severe. If an attacker
gains access to the device or the app's les, they can easily extract credentials or
con dential information. This can lead to unauthorised access, account compromise, and
potential misuse of user data, posing a threat to both user privacy and the app's integrity.
Technical details of the vulnerability:
In code “PListViewController” le data is being saved directly without using any encryption API’s
into plist le.
To mitigate the vulnerability following measures can be taken:
Use keyChain Services to store sensitive data, such as passwords and API keys, in the iOS
Keychain. The Keychain provides a secure and encrypted storage mechanism, making it
more dif cult for unauthorised access.
If storing sensitive data locally is necessary, ensure that the data is encrypted
before being written to storage. Use robust encryption algorithms and practices to
protect the con dentiality of the stored information
Whenever possible, refrain from storing sensitive data locally on the device. Fetch
data securely from the server when needed and rely on secure communication
protocols.
Vulnerability 2:
Title:
Caching Web Responses with Sensitive User Information:
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
Description:
Caching web responses in an iOS app without proper consideration for sensitive user
information poses a security vulnerability. If responses containing sensitive data, such as
user credentials or personal details, are cached insecurely, unauthorised access to the
cache could lead to data exposure and potential misuse.
Impact:
The impact of caching sensitive web responses insecurely is signi cant. If an attacker
gains access to the cached data, they can retrieve sensitive user information, leading to
privacy breaches, unauthorised account access, and potential exploitation of personal
data. This vulnerability jeopardises the con dentiality of user information and can harm the
app's reputation.
To mitigate the vulnerability following measures can be taken:
Identify and exclude sensitive information from being cached locally. Only cache
data that is non-sensitive and doesn't pose a security risk if accessed by
unauthorised parties.
Employ secure caching mechanisms provided by iOS, such as NSURLCache with
appropriate con gurations. Ensure that sensitive data is not stored in plaintext and
that cached information is protected against unauthorised access.
If caching sensitive data is unavoidable, encrypt the cached data using strong
encryption algorithms. This adds an additional layer of protection, making it harder
for unauthorised parties to extract meaningful information.
Vulnerability 3:
Title:
Client-Side Injection
Description:
Client-side injection refers to the inclusion of untrusted data from the client side (user input
or other untrusted sources) into client-side code, leading to potential security
vulnerabilities. In an iOS app, this could manifest as injecting malicious scripts or code into
client-side components, such as JavaScript or UIWebView, compromising the app's
integrity and exposing users to various attacks.
Impact:
The impact of client-side injection in an iOS app can be severe. It may lead to a range of
security issues, including Cross-Site Scripting (XSS) attacks, unauthorised access to user
fi
fi
fi
data, session hijacking, and the potential for malicious code execution. Successful
exploitation can compromise user privacy, undermine the app's functionality, and damage
the overall trustworthiness of the application
Technical details of the vulnerability:
In code “ClientSideInjectionDetailViewController” in textField delegate method, input from user
is not being validated and has been passed as it is to web view, which results in injection.
To mitigate the vulnerability following measures can be taken:
Implement robust input validation and sanitisation practices to ensure that user
inputs are validated and sanitised before being processed or rendered on the client
side.
If using WebViews or rendering user-generated content, avoid using UIWebView
(deprecated) and opt for WKWebView, which provides better security features.
Conduct regular code reviews and use static analysis tools to identify and
remediate potential client-side injection vulnerabilities in the codebase.
Vulnerability 4:
Title:
Sensitive Information in Memory
Description:
The presence of sensitive information, such as passwords or cryptographic keys, in the
device's memory during runtime poses a security vulnerability. If proper precautions are
not taken, this data can be exposed to unauthorised access through memory inspection or
tampering.
Impact:
The impact of having sensitive information in memory is critical. An attacker with access to
the device or a compromised app may exploit this vulnerability to extract sensitive data,
leading to unauthorised access, identity theft, or compromise of encrypted
communications. The exposure of sensitive information in memory jeopardises user
privacy and the overall security of the iOS application.
Technical details of the vulnerability:
In code “SensitiveInformationInMemoryDetailsViewController” password is being stored in
variable named “passwd”, which can be accessed easily through memory inspection.
To mitigate the vulnerability following measures can be taken:
Avoid storing sensitive information in memory for extended periods. Instead, use
secure storage mechanisms such as the Keychain for sensitive data like passwords
and cryptographic keys.
Implement secure memory management practices to minimise the time sensitive
information resides in the device's memory. Immediately clear or overwrite sensitive
data once it is no longer needed.
If sensitive information must be held temporarily in memory, ensure it is encrypted.
Implement strong encryption algorithms to protect the con dentiality of the data
while it is in memory.
Vulnerability 5:
Title:
Network Layer Security
Description:
Network layer insecurity in an iOS app refers to vulnerabilities in the communication
channel between the app and backend servers. If the network communication is not
properly secured, it can expose sensitive data to tampering, or man-in-the-middle attacks.
Impact:
The impact of network layer insecurity is signi cant. Without proper security measures,
attackers can intercept and manipulate data exchanged between the app and servers.
This can lead to unauthorised access, data breaches, session hijacking, and the
compromise of sensitive user information. The overall integrity and con dentiality of the
app's communication are at risk.
Technical details of the vulnerability:
In code “TransportLayerProtectionViewController” when sending data using method
“sendOverHTTPTapped” if this request intercepted attacker can see all the data attached in this
request,
To mitigate the vulnerability following measures can be taken:
Always use the HTTPS protocol for secure communication between the app and
backend servers. HTTPS encrypts data in transit, preventing eavesdropping and
tampering.
fi
fi
fi
Implement certi cate pinning to enhance security by associating the server's SSL
certi cate with a speci c known certi cate. This prevents man-in-the-middle attacks
involving rogue certi cates.
Encrypt sensitive data before transmitting it over the network. This provides an
additional layer of protection even if the communication channel is compromised.
Vulnerability 6:
Title:
Side Channel Data Leakage (e.g., Device Logs)
Description:
Side channel data leakage in an iOS app refers to unintentional exposure of sensitive
information through auxiliary channels, such as device logs. If an application inadvertently
logs sensitive data, it can pose a security risk, as these logs might be accessible to
unauthorised users or inadvertently shared, leading to potential data exposure.
Impact:
The impact of side channel data leakage, particularly through device logs, can be
signi cant. Exposure of sensitive information in logs, even temporarily, can lead to
unauthorised access, privacy breaches, and compromise user con dentiality. Additionally,
leaked information may be exploited by attackers or inadvertently exposed during
debugging, posing risks to the overall security of the application.
Technical details of the vulnerability:
In code “DeviceLogsViewController” when user click signup in the method “signupTapped” all
the user information is being printed in logs containing sensitive data like password and phone
number.
To mitigate the vulnerability following measures can be taken:
Refrain from logging sensitive information such as passwords, API keys, or
personal data. Logs are typically accessible to developers and may be inadvertently
shared or exposed, making them a potential target for attackers.
Implement logging levels and ensure that sensitive information is logged only at
appropriate levels during development and debugging. Avoid logging sensitive data
at levels intended for production use.
If logging involves identi ers, such as user IDs, consider tokenisation to avoid
exposing actual user information. Replace sensitive data with tokens in logs to
maintain privacy.
fi
fi
fi
fi
fi
fi
fi
fi