Home / Attacks & tests / Application Local Storage Flaws
7 test cases
Application Local Storage Flaws
Local storage testing on iOS examines the application's container and the data protection class applied to what it holds. The platform encrypts storage at rest, but the protection class determines whether that encryption still applies while the device is unlocked or after first unlock — which is most of the time.
What an attacker is trying to achieve
The attacker has the device, or a backup of it. They want the container's contents: cached responses, databases, preferences, snapshots taken when the application was backgrounded, and anything the application wrote with a protection class weak enough to be readable in the state the attacker has.
Test cases
7 test cases in this category. Each states what the test proves, how it is carried out, what has to be in place beforehand, what a positive result looks like, and whether the work is manual, automated or a mixture.
IOS-STOR-01 Hidden Secrets in the Code
Objective — Determine whether keys, credentials or endpoints requiring authentication are embedded in the application binary or bundle.
How it is tested — Extract strings and constant data from the decrypted binary and search the bundle's property lists, configuration files and assets for key material, credentials and tokens. Include values assembled at runtime or obscured by an embedded cipher, recovering them by instrumenting the running application. Establish what each recovered secret authorises and whether it is common to every installation.
Prerequisites — A decrypted binary and the bundle; a device permitting instrumentation for runtime-assembled values.
Indicators — A credential or key recoverable from the binary or bundle; a secret obscured rather than protected; one secret shared across installations; a recovered secret accepted by the server.
Coverage — MASVS-STORAGE-1MASVS-CRYPTO-2CWE-798CWE-321
Depth — Hybrid String extraction automates; runtime-assembled secrets require instrumenting the application.
IOS-STOR-02 Sensitive Data in Shared Storage
Objective — Determine whether the application places data outside its own container — in a shared App Group, a document directory exposed to the user, or a location another application can reach.
How it is tested — Enumerate the App Groups the application declares and inspect their shared containers for what is written there and which other applications participate. Establish whether the application exposes its documents directory to file browsing, and what lands there. Test share and export flows for artefacts written outside the container, and check whether pasteboard and share extensions carry more than intended.
Prerequisites — A device with container access; the entitlements from the bundle; the vendor's other applications where an App Group is shared with them.
Indicators — Session or personal data in a shared App Group container; the documents directory exposed with sensitive content; export artefacts persisting; a group shared with a weaker application.
Coverage — MASVS-STORAGE-1MASVS-PLATFORM-1CWE-922CWE-276
Depth — Manual Requires reading the entitlements and then inspecting the containers they grant.
IOS-STOR-03 Sensitive Data in Application Cache Files
Objective — Determine whether caching performed by the application or by the frameworks it uses retains sensitive material after the workflow that produced it.
How it is tested — Drive authenticated workflows and then inspect the container's cache locations: the URL cache and its database, web view caches, image and media caches, and any framework-managed store. Establish whether authenticated responses are cached at all, whether the cache is cleared on sign-out, and whether backgrounding produces a screen snapshot containing displayed data.
Prerequisites — A device with container access; an account with recognisable data; the ability to background the application and sign out.
Indicators — Authenticated response bodies in the URL cache; a web view cache retaining session content; caches surviving sign-out; a background snapshot showing sensitive data.
Coverage — MASVS-STORAGE-1MASVS-STORAGE-2CWE-524CWE-359
Depth — Manual The snapshot and framework caches are produced by the platform rather than the application, so they are only found by inspecting the container.
IOS-STOR-04 Cryptographic Storage Strength
Objective — Determine whether data the application protects at rest is genuinely protected in the device state an attacker actually has, and whether keys are held where the hardware protects them.
How it is tested — Identify the data protection class applied to each stored file and keychain item, and establish what state the device must be in for each to be readable. Trace how encryption keys are derived and where they are held. Attempt to read protected data from a device that is unlocked and from one that has been unlocked once since boot, which is the realistic attacker position, rather than only from a device that has never been unlocked.
Prerequisites — A device permitting container and keychain inspection in more than one lock state; the decrypted binary; sample data produced by real use.
Indicators — Sensitive data at a protection class readable after first unlock; keys derived from device constants; encryption implemented in the application where the platform's own facility would be stronger.
Coverage — MASVS-CRYPTO-1MASVS-STORAGE-1CWE-311CWE-522
Depth — Manual The protection class only means something relative to device state, which has to be varied deliberately.
IOS-STOR-05 Data Provider Access Permissions
Objective — Determine whether the mechanisms by which the application shares data with other applications and extensions expose more than intended.
How it is tested — Enumerate the application's extensions, document types, shared containers and any custom URL schemes used to hand data across. Establish what each will return and to whom, and whether the caller is identified at all. From a test application, exercise each sharing route and record what can be retrieved. Establish whether extensions inherit access to the container's sensitive contents.
Prerequisites — The bundle's entitlements and extension declarations; a device; a test application able to invoke the sharing routes.
Indicators — Data retrievable by an unidentified caller; an extension with access broader than its function; a document type handler returning container contents; a URL scheme returning data to any caller.
Coverage — MASVS-PLATFORM-1MASVS-STORAGE-1CWE-200CWE-285
Depth — Manual Requires a second application on the device exercising each sharing route.
IOS-STOR-06 Local Database Injection
Objective — Determine whether values reaching the application's on-device database are concatenated into queries, allowing stored or externally supplied content to alter them.
How it is tested — Identify the on-device stores and the code paths that query them. Submit query syntax through values that reach those paths — search terms, identifiers, and content arriving from the server or from another application — and observe whether the result set changes. Concentrate on data arriving from outside the application, since that is the input the attacker controls.
Prerequisites — A decrypted binary to locate the query paths; a device with container access to observe the store; a proxy to inject values through server responses.
Indicators — A result set altered by query syntax; concatenated query construction in the binary; server-supplied content reaching a query unparameterised.
Coverage — MASVS-CODE-4MASVS-STORAGE-1CWE-89CWE-943
Depth — Manual The reachable input is usually server or inter-application content rather than anything the user types.
IOS-STOR-07 Privacy and Metadata Leaks
Objective — Determine whether the application collects, retains or transmits more personal data than its function requires, and whether its stated disclosures match its behaviour.
How it is tested — Capture all outbound traffic including third-party destinations and inventory what is sent, comparing against the privacy disclosure the application publishes and the permissions it requests. Examine media the application uploads for retained location and device metadata. Establish whether identifiers persist across reinstalls and whether tracking occurs before any consent is given.
Prerequisites — A proxy capturing traffic to all destinations; the published privacy disclosure; sample media carrying metadata; a device permitting reinstall.
Indicators — Data collected beyond the stated purpose; metadata transmitted with uploads; an identifier surviving reinstall; transmission to a third party before consent.
Coverage — MASVS-PRIVACY-1MASVS-PRIVACY-3CWE-359CWE-200
Depth — Manual The comparison is against a published disclosure, which has to be read and interpreted.
What we need from you
A device permitting access to the application container, which generally means elevated privileges; the ability to produce and inspect a device backup; a decrypted binary for the code paths; and an account whose data is recognisable when found.
Standards this category maps to
Every identifier below is quoted from the published control list it belongs to. Where a test has no defensible mapping, none is given rather than an approximate one.
- MASVS-STORAGE-1 — The app securely stores sensitive data.
- MASVS-CRYPTO-2 — The app performs key management according to industry best practices.
- CWE-798 — Use of Hard-coded Credentials
- CWE-321 — Use of Hard-coded Cryptographic Key
- MASVS-PLATFORM-1 — The app uses IPC mechanisms securely.
- CWE-922 — Insecure Storage of Sensitive Information
- CWE-276 — Incorrect Default Permissions
- MASVS-STORAGE-2 — The app prevents leakage of sensitive data.
- CWE-524 — Use of Cache Containing Sensitive Information
- CWE-359 — Exposure of Private Personal Information to an Unauthorized Actor
- MASVS-CRYPTO-1 — The app employs current strong cryptography and uses it according to industry best practices.
- CWE-311 — Missing Encryption of Sensitive Data
- CWE-522 — Insufficiently Protected Credentials
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
- CWE-285 — Improper Authorization
- MASVS-CODE-4 — The app validates and sanitizes all untrusted inputs.
- CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- CWE-943 — Improper Neutralization of Special Elements in Data Query Logic
- MASVS-PRIVACY-1 — The app minimizes access to sensitive data and resources.
- MASVS-PRIVACY-3 — The app is transparent about data collection and usage.
Tell us what the system does and what worries you.
If a penetration test is not what you need yet, we will say so.