• Bluetooth peripherals
• Calendar data
• Camera
• Contacts
• Health sharing
• Health updating
• HomeKit
• Location
• Microphone
• Motion
• Music and the media library
• Photos
• Reminders
• Siri
• Speech recognition
• the TV provider

• The typical QR Code scanning app obviously requires the camera to function but might be requesting the photos permission as well. If storage is explicitly required, and depending on the sensitivity of the pictures being taken, these apps might better opt to use the app sandbox storage to avoid other apps (having the photos permission) to access them. See the chapter "Data Storage on iOS" for more information reagarding storage of sensitive data.
• Some apps require photo uploads (e.g. for profile pictures). Recent versions of iOS introduce new APIs such as UIImagePickerController (iOS 11+) and its modern replacement PHPickerViewController (iOS 14+). These APIs run on a separate process from your app and by using them, the app gets read-only access exclusively to the images selected by the user instead of to the whole "Camera Roll". This is considered a best practice to avoid requesting unnecessary permissions.

Typically you'll find the armv7 capability, meaning that the app is compiled only for the armv7 instruction set, or if it’s a 32/64-bit universal app.

• The bluetooth-le device capability can be set in order to restrict non-BLE capable devices from downloading their app.
• App capabilities like bluetooth-peripheral or bluetooth-central (both UIBackgroundModes) should be added if BLE background processing is required.

Entitlements are key value pairs that are signed in to an app and allow authentication beyond runtime factors, like UNIX user ID. Since entitlements are digitally signed, they can’t be changed. Entitlements are used extensively by system apps and daemons to perform specific privileged operations that would otherwise require the process to run as root. This greatly reduces the potential for privilege escalation by a compromised system app or daemon.

1. 1.

   Entitlements embedded in a provisioning profile that is used to code sign the app, which are composed of:

   • Capabilities defined on the Xcode project's target Capabilities tab, and/or:
   • Enabled Services on the app's App ID which are configured on the Identifiers section of the Certificates, ID's and Profiles website.
   • Other entitlements that are injected by the profile generation service.
2. 2.

   Entitlements from a code signing entitlements file.

1. 1.

   The app's signature.
2. 2.

   The app's embedded provisioning profile.

• During code signing, the entitlements corresponding to the app’s enabled Capabilities/Services are transferred to the app's signature from the provisioning profile Xcode chose to sign the app.
• The provisioning profile is embedded into the app bundle during the build (embedded.mobileprovision).
• Entitlements from the "Code Signing Entitlements" section in Xcode's "Build Settings" tab are transferred to the app's signature.

• Purpose Strings in the Info.plist File
• Code Signing Entitlements File
• Embedded Provisioning Profile File
• Entitlements Embedded in the Compiled App Binary
• Source Code Inspection

• Open the project with Xcode.
• Find and open the Info.plist file in the default editor and search for the keys starting with "Privacy -".

• Unzip the IPA.
• The Info.plist is located in Payload/<appname>.app/Info.plist.
• Convert it if needed (e.g. plutil -convert xml1 Info.plist) as explained in the chapter "iOS Basic Security Testing", section "The Info.plist File".
• Inspect all purpose strings Info.plist keys, usually ending with UsageDescription:

  1

  <plist version="1.0">

  2

  <dict>

  3

  <key>NSLocationWhenInUseUsageDescription</key>

  4

  <string>Your location is used to provide turn-by-turn directions to your destination.</string>

  Copied!

Note: the strings command will not help here as it will not be able to find this information. Better use grep with the -a flag directly on the binary or use radare2 (izz)/rabin2 (-zz).

This method should work even if the app binary is still encrypted (it was tested against several App Store apps).

• whether the purpose strings in the Info.plist file match the programmatic implementations.
• whether the registered capabilities are used in such a way that no confidential information is leaking.

• Bluetooth: the state property of the CBCentralManager class is used to check system-authorization status for using Bluetooth peripherals.
• Location: search for methods of CLLocationManager, e.g. locationServicesEnabled.

  1

  func checkForLocationServices() {

  2

  if CLLocationManager.locationServicesEnabled() {

  3

  // Location services are available, so query the user’s location.

  4

  } else {

  5

  // Update your app’s UI to show that the location is unavailable.

  6

  }

  7

  }

  Copied!

  See Table1 in "Determining the Availability of Location Services" (Apple Developer Documentation) for a complete list.

1. 1.

   Consider the list of permissions / capabilities identified in the static analysis (e.g. NSLocationWhenInUseUsageDescription).
2. 2.

   Map them to the dedicated APIs available for the corresponding system frameworks (e.g. Core Location). You may use the Apple Developer Documentation for this.
3. 3.

   Trace classes or specific methods of those APIs (e.g. CLLocationManager), for example, using frida-trace.
4. 4.

   Identify which methods are being really used by the app while accessing the related feature (e.g. "Share your location").
5. 5.

   Get a backtrace for those methods and try to build a call graph.

-U connects to the USB device. -m includes an Objective-C method to the traces. You can use a glob pattern (e.g. with the "*" wildcard, -m "*[* *authorizationStatus*]" means "include any Objective-C method of any class containing 'authorizationStatus'"). Type frida-trace -h for more information.

• Custom URL Schemes
• Universal Links
• UIActivity Sharing
• App Extensions
• UIPasteboard

• tg://resolve?domain=fridadotre is a custom URL scheme and uses the tg:// scheme.
• https://telegram.me/fridadotre is a universal link and uses the https:// scheme.

• Unique: Unlike custom URL schemes, universal links can’t be claimed by other apps, because they use standard HTTP or HTTPS links to the app's website. They were introduced as a way to prevent URL scheme hijacking attacks (an app installed after the original app may declare the same scheme and the system might target all new requests to the last installed app).
• Secure: When users install the app, iOS downloads and checks a file (the Apple App Site Association or AASA) that was uploaded to the web server to make sure that the website allows the app to open URLs on its behalf. Only the legitimate owners of the URL can upload this file, so the association of their website with the app is secure.
• Flexible: Universal links work even when the app is not installed. Tapping a link to the website would open the content in Safari, as users expect.
• Simple: One URL works for both the website and the app.
• Private: Other apps can communicate with the app without needing to know whether it is installed.

• Checking the Associated Domains entitlement
• Retrieving the Apple App Site Association file
• Checking the link receiver method
• Checking the data handler method
• Checking if the app is calling other app's universal links

• The AASA file is not served over HTTPS.
• The AASA is not available.
• The appIDs do not match (this would be the case of a malicious app). iOS would successfully prevent any possible hijacking attacks.

From Apple Docs: When iOS launches your app after a user taps a universal link, you receive an NSUserActivity object with an activityType value of NSUserActivityTypeBrowsingWeb. The activity object’s webpageURL property contains the URL that the user is accessing. The webpage URL property always contains an HTTP or HTTPS URL, and you can use NSURLComponents APIs to manipulate the components of the URL. [...] To protect users’ privacy and security, you should not use HTTP when you need to transport data; instead, use a secure transport protocol such as HTTPS.

• The mentioned NSUserActivity object comes from the continueUserActivity parameter, as seen in the method above.
• The scheme of the webpageURL must be HTTP or HTTPS (any other scheme should throw an exception). The scheme instance property of URLComponents / NSURLComponents can be used to verify this.

Universal links offer a potential attack vector into your app, so make sure to validate all URL parameters and discard any malformed URLs. In addition, limit the available actions to those that do not risk the user’s data. For example, do not allow universal links to directly delete content or access sensitive information about the user. When testing your URL-handling code, make sure your test cases include improperly formatted URLs.

Note that the openURL:options:completionHandler: method is not only used to open universal links but also to call custom URL schemes.

• the associated domains
• the Apple App Site Association file
• the link receiver method
• the data handler method

• Triggering universal links
• Identifying valid universal links
• Tracing the link receiver method
• Checking how the links are opened

• Open the Notes app and create a new note.
• Write the links including the domain.
• Leave the editing mode in the Notes app.
• Long press the links to open them (remember that a standard click triggers the default option).

To do it from Safari you will have to find an existing link on a website that once clicked, it will be recognized as a Universal Link. This can be a bit time consuming.

Note that there is a difference between a click and a long press. Once we long press a link and select an option, e.g. "Open in Safari", this will become the default option for all future clicks until we long press again and select another option.

-i includes any method. You can also use a glob pattern here (e.g. -i "*open*Url*" means "include any function containing 'open', then 'Url' and something else")

xcrun can be used invoke Xcode developer tools from the command-line, without having them in the path. In this case it will locate and run swift-demangle, an Xcode tool that demangles Swift symbols.

• It calls application:continueUserActivity:restorationHandler: from the app delegate as expected.
• application:continueUserActivity:restorationHandler: handles the URL but does not open it, it calls TelegramUI.openExternalUrl for that.
• The URL being opened is https://t.me/addstickers/radare.

• Both rely on the same method when receiving data:

• Like universal links, the Handoff's Activity Continuation must be declared in the com.apple.developer.associated-domains entitlement and in the server's apple-app-site-association file (in both cases via the keyword "activitycontinuation":). See "Retrieving the Apple App Site Association File" above for an example.

If the user is using a web browser on the originating device, and the receiving device is an iOS device with a native app that claims the domain portion of the webpageURL property, then iOS launches the native app and sends it an NSUserActivity object with an activityType value of NSUserActivityTypeBrowsingWeb. The webpageURL property contains the URL the user was visiting, while the userInfo dictionary is empty.

• airDrop
• assignToContact
• copyToPasteboard
• mail
• message
• postToFacebook
• postToTwitter

• the data (items) being shared,
• the custom activities,
• the excluded activity types.

• Inspect the activities passed to the init(activityItems:applicationActivities:) method.
• Check if it defines custom activities (also being passed to the previous method).
• Verify the excludedActivityTypes, if any.

• if the app declares custom document types by looking into Exported/Imported UTIs ("Info" tab of the Xcode project). The list of all system declared UTIs (Uniform Type Identifiers) can be found in the archived Apple Developer Documentation.
• if the app specifies any document types that it can open by looking into Document Types ("Info" tab of the Xcode project). If present, they consist of name and one or more UTIs that represent the data type (e.g. "public.png" for PNG files). iOS uses this to determine if the app is eligible to open a given document (specifying Exported/Imported UTIs is not enough).
• if the app properly verifies the received data by looking into the implementation of application:openURL:options: (or its deprecated version UIApplicationDelegate application:openURL:sourceApplication:annotation:) in the app delegate.

• UTExportedTypeDeclarations/UTImportedTypeDeclarations if the app declares exported/imported custom document types.
• CFBundleDocumentTypes to see if the app specifies any document types that it can open.

Note that this is the same as if we would retrieve the IPA from the phone or accessed via e.g. SSH and navigated to the corresponding folder in the IPA / app sandbox. However, with objection we are just one command away from our goal and this can be still considered static analysis.

• The activityItems: an array of the items being shared. They might be of different types, e.g. one string and one picture to be shared via a messaging app.
• The applicationActivities: an array of UIActivity objects representing the app's custom services.
• The excludedActivityTypes: an array of the Activity Types that are not supported, e.g. postToFacebook.

• Hook the method we have seen in the static analysis (init(activityItems: applicationActivities:)) to get the activityItems and applicationActivities.
• Find out the excluded activities by hooking excludedActivityTypes property.