Home / Attacks & tests / Application Keychain Security
3 test cases
Application Keychain Security
The keychain is the platform's facility for storing secrets, and it is strong when used as intended. This category examines whether the application uses it at all, whether the accessibility and access-control attributes on each item match the sensitivity of what it holds, and who else can reach those items.
What an attacker is trying to achieve
The attacker with the device wants the keychain items: session tokens, refresh credentials and keys. Whether they get them depends almost entirely on attributes the developer chose — when an item becomes readable, whether it requires authentication, and which applications share its access group.
Test cases
3 test cases in this category. Each states what the test proves, how it is carried out, what has to be in place beforehand, what a positive result looks like, and whether the work is manual, automated or a mixture.
IOS-KEYC-01 Keychain Resource Usage
Objective — Determine whether secrets are stored in the keychain at all, or held in the container where the platform's protection is weaker.
How it is tested — Inventory what the application stores and where: credentials, session and refresh tokens, encryption keys and recovery material. Establish which reside in the keychain and which in preferences, databases or files in the container. For each item outside the keychain, establish what protects it instead. Confirm by inspecting both the keychain and the container after an authenticated session.
Prerequisites — A device with keychain and container access; an authenticated session with recognisable credentials.
Indicators — Credentials or tokens in preferences or a container file rather than the keychain; secrets stored in more than one place; keychain items remaining after sign-out or uninstall.
Coverage — MASVS-STORAGE-1MASVS-CRYPTO-2CWE-522CWE-312
Depth — Manual Requires inspecting the device's actual state after real use; the code alone does not show what ends up where.
IOS-KEYC-02 Misuse of Keychain Storage Attributes
Objective — Determine whether the accessibility and access-control attributes on keychain items match the sensitivity of what they hold.
How it is tested — For every item the application creates, record its accessibility class and any access control requiring user presence or biometry. Establish which items become readable after first unlock, which are readable whenever the device is unlocked, and which require authentication. Test retrieval in each device state. Establish whether items are marked non-migratory, since a migratory item can travel to another device in a backup.
Prerequisites — A device permitting keychain inspection in more than one lock state; the ability to produce and restore a backup for the migration case.
Indicators — A high-value secret readable after first unlock; no access control on an item the application treats as authentication-gated; a migratory item recoverable from a backup on another device.
Coverage — MASVS-STORAGE-1MASVS-AUTH-3CWE-311CWE-522
Depth — Manual Attributes only mean something relative to device state, so the states have to be varied deliberately.
IOS-KEYC-03 Developer Group Keychain Usage
Objective — Determine which other applications can read the application's keychain items through a shared access group, and whether that sharing is warranted.
How it is tested — Read the keychain access groups from the entitlements and identify every application of the vendor's that declares the same. Establish which items are written into the shared group rather than the application's private one, and what those items authorise. Assess each participating application against the same standard, and establish whether the target verifies which application wrote an item before trusting it.
Prerequisites — The entitlements of every application in the group; a device with the group installed and keychain access.
Indicators — Session or credential material in a shared access group without need; a participating application materially weaker; a shared item trusted without verifying its writer; a group broader than the applications that use it.
Coverage — MASVS-STORAGE-1MASVS-PLATFORM-1CWE-522CWE-276
Depth — Manual Requires reviewing the vendor's other applications, since the group's security is that of its weakest member.
What we need from you
A device permitting keychain inspection in more than one lock state, which generally requires elevated privileges; the bundle entitlements listing access groups; the decrypted binary; and an account whose credentials are recognisable when found.
Standards this category maps to
Every identifier below is quoted from the published control list it belongs to. Where a test has no defensible mapping, none is given rather than an approximate one.
- MASVS-STORAGE-1 — The app securely stores sensitive data.
- MASVS-CRYPTO-2 — The app performs key management according to industry best practices.
- CWE-522 — Insufficiently Protected Credentials
- CWE-312 — Cleartext Storage of Sensitive Information
- MASVS-AUTH-3 — The app secures sensitive operations with additional authentication.
- CWE-311 — Missing Encryption of Sensitive Data
- MASVS-PLATFORM-1 — The app uses IPC mechanisms securely.
- CWE-276 — Incorrect Default Permissions
Tell us what the system does and what worries you.
If a penetration test is not what you need yet, we will say so.