URLSession delegate handlers that respond to TLS challenges by calling the completion handler with a “use this credential” disposition without actually verifying the certificate are a subtle but co...
iOS - Unencrypted CoreData and Realm
CoreData (Apple’s persistence framework) and Realm (a popular third-party DB) both store data on disk in the app’s container. By default, neither is encrypted. iOS Data Protection covers the files ...
iOS - LAContext Biometric Bypass
Apple’s LocalAuthentication framework lets apps trigger Face ID / Touch ID prompts. The right way to use it for security is to bind a Keychain item to biometric authentication using kSecAccessContr...
iOS - ATS NSAllowsArbitraryLoads in Production
App Transport Security (ATS) is iOS’s “all network traffic must be HTTPS with valid certs” policy. Introduced in iOS 9, it forced developers to migrate to HTTPS. The escape hatch is the NSAppTransp...
iOS - Background Snapshot Leak
When an iOS app backgrounds, the system takes a snapshot of its current screen and uses it for the app switcher’s thumbnails. The snapshot is stored as a PNG in the app’s container under Library/Ca...
iOS - UIPasteboard Clipboard Leak
UIPasteboard’s general pasteboard is shared across every app on the device. When the user copies an OTP from their banking app, it sits in UIPasteboard.general.string until something else replaces ...
iOS - Universal Link Misconfiguration
Universal Links are iOS’s robust deep-link mechanism, they prove domain ownership via a JSON file (apple-app-site-association, AASA) served from the domain’s .well-known/ path. Apple’s framework ve...
iOS - Custom URL Scheme Hijacking
iOS lets apps declare custom URL schemes in their Info.plist. Tap bankapp://, the system opens the registered app. The system does not deduplicate, multiple apps can claim the same scheme. The orde...
iOS - WKWebView JS Bridge
Apps embed WKWebView to render HTML - documentation, dashboards, in-app browsers. To let that HTML do something native (open a file, get a token, run a command), the app registers a JavaScript brid...
iOS - WKWebView allowingReadAccessTo File Read
WKWebView.loadFileURL(_:allowingReadAccessTo:) lets a developer load a local HTML file into a web view and specify the read-access boundary. The allowingReadAccessTo parameter is supposed to be a d...