App Transport Security Bypass

What might happen

App Transport Security (ATS) enforces best practices in the secure connections between an app and its back end.

Disables ATS altogether

<key>NSAppTransportSecurity</key>
<dict>
<key>NSAllowsArbitraryLoads</key> <true/>
</dict>

Per domain exception

<key>NSAppTransportSecurity</key>
<dict>
  <key>NSExceptionDomains</key>
  <dict>
    <key>example.com</key>
    <dict>

<!--Include to allow subdomains--> <key>NSIncludesSubdomains</key>\
<true/>\
<!--Include to allow HTTP requests--> <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key> <true/>
      <!--Include to specify minimum TLS version-->
      <key>NSTemporaryExceptionMinimumTLSVersion</key>
      <string>TLSv1.2</string>
    </dict>
  </dict>
</dict>

Disables ATS only for example.com

<key>NSAppTransportSecurity</key>
<dict>
  <key>NSExceptionDomains</key>
  <dict>
    <key>example.com</key>
    <dict>
<key>NSIncludesSubdomains</key>\
<true/> <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key> <false/> <key>NSTemporaryExceptionMinimumTLSVersion</key> <string>TLSv1.2</string>
    </dict>
  </dict>
</dict>

Screen Caching

What might happen

An attacker could get access to the application screenshots that were saved by the system. If sensitive data was presented in the screenshot, it could be leaked. Hide a Sensitive UI Element Before the Application is Sent to Background

func viewDidLoad() { NSNotificationCenter.defaultCenter().addObserver(self,

selector: "didEnterBackground:",\
name: UIApplicationDidEnterBackgroundNotification, object: nil)

NSNotificationCenter.defaultCenter().addObserver(self, selector: "didBecomeActive:",\
name: UIApplicationDidBecomeActiveNotification, object: nil)

}

func didEnterBackground(notification: NSNotification) { self.creditCardNumberTextFieldsetHidden = true

}

func didBecomeActive(notification: NSNotification) { self.creditCardNumberTextFieldsetHidden = false

}

Jailbrake File Referenced By Name

What might happen

In a jail-broken device, an attacker could manipulate the contents of a file written by the application. A buffer overflow or other unintended behavior may happen when the modified file is read back by the application. This may allow an attacker to seize control of the system.

Example of insecure way to reference files by name.

let fileName = NSTemporaryDirectory().stringByAppendingString("f1.txt")

let stringToWrite = "Hello world" do {

try stringToWrite.writeToFile(fileName, atomically: true, encoding: NSUTF8StringEncoding) }

catch {print(error)}

Example of secure way to reference files by descriptor.

let fileNameTemplate = NSTemporaryDirectory().stringByAppendingString("myTmpFile-XXXXXX.txt") let bufLength: CFIndex = 2048\
let fileNameBuf = UnsafeMutablePointer<CChar>.alloc(bufLength)\
strncpy(&fileNameBuf.memory, fileNameTemplate.cStringUsingEncoding(NSUTF8StringEncoding)!, bufLength)

let fileDescriptor = mkstemp(fileNameBuf);\
let fileHandle = NSFileHandle(fileDescriptor: fileDescriptor)

let stringToWrite = "Hello world" fileHandle.writeData(stringToWrite.dataUsingEncoding(NSUTF8StringEncoding)!)