Home / Attacks & tests / Inter-Process Communication (IPC) Security
8 test cases
Inter-Process Communication (IPC) Security
iOS constrains inter-application communication far more tightly than Android, so the surface here is narrower and more specific: custom URL schemes, universal links, extensions, the pasteboard and shared containers. Each is a place where data crosses the application boundary in one direction or the other.
What an attacker is trying to achieve
The attacker's application cannot address the target's internals, but it can register a competing URL scheme, send the target a crafted link, read the pasteboard, and receive whatever the target hands to a share sheet. The narrow surface is not the same as no surface.
Test cases
8 test cases in this category. Each states what the test proves, how it is carried out, what has to be in place beforehand, what a positive result looks like, and whether the work is manual, automated or a mixture.
IOS-IPC-01 User Data in the System Log
Objective — Determine whether personal or account data belonging to the user reaches the device log during ordinary operation.
How it is tested — Capture the unified log while driving workflows handling personal data, including background refresh and synchronisation which run outside any user action, and search for that data in the capture. Establish whether the application relies on the platform's default redaction of dynamic values or defeats it by formatting them as public explicitly, which is a common convenience during development that survives into release. Establish whether bundled analytics and crash-reporting frameworks log independently of the application's own calls.
Prerequisites — A device with unified log access; the release build; an account populated with recognisable personal data.
Indicators — Personal data in the log; explicit formatting defeating redaction; background synchronisation logging record content; a bundled framework logging independently.
Coverage — MASVS-PRIVACY-1MASVS-STORAGE-2CWE-532CWE-359
Depth — Hybrid Capture and search automate; exercising background paths does not.
IOS-IPC-02 Technical Data in the System Log
Objective — Determine whether the log discloses tokens, endpoints, keys or internal structure that would assist an attacker with device access.
How it is tested — Capture the log across authentication, failure and retry paths and search for session material, request and response content and internal identifiers. Provoke failures deliberately, including by removing connectivity mid-request, since error handlers log most fully. Where a token is found, replay it against the server to establish whether it is still valid and therefore directly usable.
Prerequisites — A device with log access; the ability to interrupt connectivity; a proxy for replaying logged values.
Indicators — A session token or key in the log; request or response bodies logged; internal endpoints disclosed; a logged token that still authenticates.
Coverage — MASVS-STORAGE-2MASVS-AUTH-1CWE-532CWE-522
Depth — Hybrid Searching automates; proving a logged token is live requires replaying it.
IOS-IPC-03 URL Schemes, Universal Links and Cross-Application Authorization
Objective — Determine whether the entry points other applications can address perform actions or return data without establishing who is calling.
How it is tested — Enumerate the custom URL schemes and universal link domains the application registers, and recover from the binary how each incoming link is parsed and what it can trigger. From a test application, invoke each with crafted parameters and establish what state can be reached and what is returned. Determine whether the application identifies the calling application at all, and whether a scheme can be registered by another application to intercept links intended for it.
Prerequisites — The bundle property list; the decrypted binary; a device; a test application able to register a competing scheme and to send links.
Indicators — A privileged action triggered by an incoming link; data returned to an unidentified caller; a scheme claimable by another application; a link reaching an authenticated flow.
Coverage — MASVS-PLATFORM-1MASVS-AUTH-1CWE-939CWE-862
Depth — Manual The interception case requires installing a competing handler, which static review does not reveal.
IOS-IPC-04 Entitlements and Signature-Based Data Sharing
Objective — Determine whether the entitlements the application holds, and the trust it places in applications sharing them, are as narrow as its function requires.
How it is tested — Review the entitlements in the signed bundle: App Groups, keychain access groups, associated domains and any privileged capability. For each shared group, identify the other participating applications and establish whether each is held to the same standard. Determine whether the application verifies the identity of a peer before trusting data from a shared container, or assumes membership implies trustworthiness.
Prerequisites — The signed bundle and its entitlements; the vendor's related applications; a device with the group installed.
Indicators — A keychain access group shared more widely than needed; a shared container trusted without verifying the writer; an associated domain the vendor does not control; a capability entitlement beyond the application's function.
Coverage — MASVS-PLATFORM-1MASVS-STORAGE-1CWE-250CWE-276
Depth — Manual Requires assessing the other members of each shared group, not just the target.
IOS-IPC-05 Pasteboard Separation
Objective — Determine whether sensitive values reach the system pasteboard, where any application running on the device can read them.
How it is tested — Exercise every path that copies — explicit copy controls, one-time code auto-fill, share flows, and any field the application populates automatically — then read the general pasteboard from a separate application. Establish whether sensitive fields are excluded from copy, whether the application uses a private pasteboard where sharing is internal, and whether copied content expires.
Prerequisites — A device; a second application able to read the pasteboard; an account with sensitive values such as codes or card details.
Indicators — A credential, code or card number readable from the general pasteboard; content persisting without expiry; internal sharing performed through the general pasteboard rather than a private one.
Coverage — MASVS-PLATFORM-3MASVS-STORAGE-2CWE-200CWE-359
Depth — Manual Confirmation requires reading the pasteboard from outside the application.
IOS-IPC-06 Code Puzzling and Application State Abuse
Objective — Determine whether incoming links and extension invocations can drive the application into a state its own navigation cannot reach.
How it is tested — Map the states the interface produces and the parameters each incoming link carries. Then send links that address later stages directly: a post-authentication view before signing in, a confirmation before its preceding step, a resumption without an originating session. Establish whether the handler verifies the preconditions it depends on or assumes them from the navigation that normally precedes it.
Prerequisites — The link-handling code from the decrypted binary; a device; a test application or browser able to send arbitrary links.
Indicators — An authenticated view reachable without signing in; a confirmation completing without its preceding step; state assembled by link parameters that the interface guards.
Coverage — MASVS-PLATFORM-1MASVS-AUTH-2CWE-841CWE-287
Depth — Manual Requires understanding the intended sequence before it can be broken.
IOS-IPC-07 Race Conditions and Concurrency
Objective — Determine whether the application remains correct when link handling, extension invocation and background work overlap rather than occurring in sequence.
How it is tested — Send repeated and simultaneous links to the same handler, and invoke extensions while the main application is active. Concentrate on operations that should be exclusive — consuming a one-time value, completing a purchase, applying a state transition — and establish whether exclusivity is enforced or merely implied by the interface's ordering. Observe for unresponsiveness as well as duplicated effect.
Prerequisites — A device; a means of sending concurrent links; the ability to observe the resulting state in the container.
Indicators — An exclusive operation completing twice; inconsistent state after concurrent invocation; the application becoming unresponsive; a one-time value consumed more than once.
Coverage — MASVS-PLATFORM-1MASVS-CODE-4CWE-367CWE-662
Depth — Manual Concurrency has to be arranged deliberately; ordinary use does not produce it.
IOS-IPC-08 On-Device Denial of Service
Objective — Determine whether another application on the device can render the target unusable through the entry points it exposes.
How it is tested — Send malformed, oversized and unexpected parameters through each registered URL scheme and universal link, and to each extension, observing whether the application terminates rather than rejecting them. Send them repeatedly to establish whether resource use is bounded. Test whether a crafted link can leave persistent state that prevents the application from launching cleanly afterwards.
Prerequisites — A device where the application can be reinstalled after being rendered unusable; a test application able to send arbitrary links; the registered entry point list.
Indicators — A crash from an incoming link; failure to launch after receiving one; unbounded resource use under repetition; persistent state preventing recovery.
Coverage — MASVS-PLATFORM-1MASVS-CODE-4CWE-400CWE-20
Depth — Manual The persistent-state case only appears if the application is relaunched after the attack, which is a deliberate step.
What we need from you
The bundle property list and entitlements; a device; a test application able to register schemes and send links; the decrypted binary to see how incoming links are parsed; and access to the unified log.
Standards this category maps to
Every identifier below is quoted from the published control list it belongs to. Where a test has no defensible mapping, none is given rather than an approximate one.
- MASVS-PRIVACY-1 — The app minimizes access to sensitive data and resources.
- MASVS-STORAGE-2 — The app prevents leakage of sensitive data.
- CWE-532 — Insertion of Sensitive Information into Log File
- CWE-359 — Exposure of Private Personal Information to an Unauthorized Actor
- MASVS-AUTH-1 — The app uses secure authentication and authorization protocols and follows the relevant best practices.
- CWE-522 — Insufficiently Protected Credentials
- MASVS-PLATFORM-1 — The app uses IPC mechanisms securely.
- CWE-939 — Improper Authorization in Handler for Custom URL Scheme
- CWE-862 — Missing Authorization
- MASVS-STORAGE-1 — The app securely stores sensitive data.
- CWE-250 — Execution with Unnecessary Privileges
- CWE-276 — Incorrect Default Permissions
- MASVS-PLATFORM-3 — The app uses the user interface securely.
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
- MASVS-AUTH-2 — The app performs local authentication securely according to the platform best practices.
- CWE-841 — Improper Enforcement of Behavioral Workflow
- CWE-287 — Improper Authentication
- MASVS-CODE-4 — The app validates and sanitizes all untrusted inputs.
- CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition
- CWE-662 — Improper Synchronization
- CWE-400 — Uncontrolled Resource Consumption
- CWE-20 — Improper Input Validation
Tell us what the system does and what worries you.
If a penetration test is not what you need yet, we will say so.