Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Port MASTG-TEST-0055 (by @guardsquare) #3054

Open
wants to merge 9 commits into
base: master
Choose a base branch
from
Open

Port MASTG-TEST-0055 (by @guardsquare) #3054

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
3f28605
Port static test
serek8 Nov 7, 2024
5fb933c
Port dynamic test
serek8 Nov 7, 2024
0608317
Add deprecation note
serek8 Nov 7, 2024
f8ce601
Mention secure inputs and provide a list of UI elements
serek8 Nov 7, 2024
f3aecbb
Fix passive voice
serek8 Nov 7, 2024
ae540ce
Fix spelling error
serek8 Nov 7, 2024
0f80b27
Update tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0x55-2.md
serek8 Nov 7, 2024
2e123d3
minor improvements
cpholguera Nov 7, 2024
b3ba416
Clarify the requirements for caching prevention
serek8 Nov 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0x55-1.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
---
platform: ios
title: Sensitive Data Not Excluded From Keyboard Caching
id: MASTG-TEST-0x55-1
type: [static]
weakness: MASWE-0053
---

## Overview

This test checks whether the target app prevents the caching of sensitive information entered into text fields. The keyboard may suggest previously entered text when typing in any app on the device.

Any of the following attributes, if present, will prevent the caching mechanism for text inputs:

- [`UITextAutocorrectionTypeNo`](https://developer.apple.com/documentation/uikit/uitextautocorrectiontype/uitextautocorrectiontypeno)
- [`secureTextEntry`](https://developer.apple.com/documentation/uikit/uitextinputtraits/1624427-securetextentry)

If the app uses Storyboards or XIB files, check whether the UI elements such as `UITextFields`, `UITextViews`, and `UISearchBars` use the `UITextAutocorrectionTypeNo` attribute.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can this really be tested by just having the IPA?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is no easy way to get it from a built IPA file. I am afraid we can only review the source code, or use dynamic analysis to hook an init function of TextField? Do you want me to create a dynamic test for it?


## Steps

1. Run a static analysis tool such as @MASTG-TOOL-0073 on the app binary to verify if your app uses the above attributes.

## Observation

The output should indicate whether the app uses no-caching attributes.

## Evaluation

The test case fails if any of the text fields in your app accepts sensitive data but do not use no-caching attributes.
25 changes: 25 additions & 0 deletions tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0x55-2.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
---
platform: ios
title: Sensitive Data Present In Keyboard Cache
id: MASTG-TEST-0x55-2
type: [dynamic]
weakness: MASWE-0053
---

## Overview

This test checks whether the keyboard cache contains sensitive data from the target app.

## Steps
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this test really useful/meaningful/valuable?

cc @TheDauntless

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After thinking it over again, I am not sure about value of these tests:

  • Inspecting /private/var/mobile/Library/Keyboard/en-dynamic.lm isn't consistent. Typing a password with autocorrection doesn't consistently put it to the database. Therefore, it's even difficult to get a True Positive.
  • Static search for UITextAutocorrectionTypeNo and secureTextEntry is also difficult if an app uses Storyboard. It'd be easier in SwiftUI but this is not a big percentage of apps yet. Even if it was possible for all apps, I am not sure if testing of usage of these APIs would be practical and sufficient.

In general, it's difficult to test for this weakness statically because we don't know what data is sensitive and where it's typed. Therefore, I suggest we:

  1. Remove the test for testing /private/var/mobile/Library/Keyboard
  2. Remove the static search for UITextAutocorrectionTypeNo and secureTextEntry
  3. Create a dynamic test with Frida that intercepts text from all inputs that don't have UITextAutocorrectionTypeNo or secureTextEntry, and let the user review this list afterwards.


1. Reset your iOS device keyboard cache by navigating to `Settings > General > Reset > Reset Keyboard Dictionary`.
2. Exercise the application and identify the functionalities that allow users to enter sensitive data.
3. Use @MASTG-TECH-0052 to retrieve the keyboard cache file with the extension `.dat` at `/private/var/mobile/Library/Keyboard/` and its subdirectories.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

was this working? which iOS version was it?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it worked on iOS 15.4.1 iPhone XS. The file is /private/var/mobile/Library/Keyboard/en-dynamic.lm.
It's not very consistent though. I can't find there all suggestions that my keyboard cached(yes I restarted my device).


## Observation

The output should contain all cached strings.

## Evaluation

The test case fails if you can find any sensitive cached strings in the output, such as username, passwords, email addresses, and credit card numbers.
2 changes: 2 additions & 0 deletions tests/ios/MASVS-STORAGE/MASTG-TEST-0055.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ title: Finding Sensitive Data in the Keyboard Cache
masvs_v1_levels:
- L1
- L2
status: deprecated
covered_by: [MASTG-TEST-0x55-1, MASTG-TEST-0x55-2]
---

## Overview
Expand Down