Skip to content

Conversation

serek8
Copy link
Collaborator

@serek8 serek8 commented Nov 6, 2024

This PR closes #2929.

I split this test into 3:

  • Filesystem Content comparison => MASWE-0006
  • Static search for APIs => MASWE-0006
  • Keychain Security Policies => MASWE-0008

@serek8 serek8 marked this pull request as ready for review November 6, 2024 12:22
@serek8 serek8 requested a review from cpholguera January 13, 2025 13:43
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This test still has something fundamental that we need to capture in a new test (or two): the app uses the Keychain API in 2 ways

  • to store data in the Keychain itself (the keychain wasn't designed for this but developers do it)
  • to encrypt data using keys from the Keychain and store it in private storage (envelope encryption)


1. Run a static analysis tool such as @MASTG-TOOL-0073 on the app binary.

2. Search for APIs that indicates a use of Private Storage. This API includes:
Copy link
Collaborator

@cpholguera cpholguera Jan 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should add the use of encryption APIs for envelope encryption or the explicit use of insecure data protection classes (?)

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure I understand

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to add here any references to encryption APIs so that the tester has everything they need.

See below in "Evaluation": we address now the "writing files" part but not the "unencrypted" part.

If we have both, then the rev. engineer can go and reverse the files and validate.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This would be L1: https://developer.apple.com/documentation/uikit/encrypting-your-app-s-files

And for L2 we'd actually encrypt the files with a key from the Keychain

@cpholguera cpholguera changed the title Port MASTG-TEST-0052 (by @guardsquare) Port MASTG-TEST-0052: Testing Local Data Storage (ios) (by @guardsquare) Feb 24, 2025
@serek8 serek8 requested a review from cpholguera July 18, 2025 13:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

MASTG v1->v2 MASTG-TEST-0052: Testing Local Data Storage (ios)
2 participants