Home / Attacks & tests / Application Sandbox Security
3 test cases
Application Sandbox Security
Sandbox testing on iOS examines whether the application stays inside the container the platform gives it, and whether the entitlements and permissions it holds are as narrow as its function requires. The platform boundary is strong; what is tested is whether the application widens it.
What an attacker is trying to achieve
The attacker looks for the openings the application itself created: a shared group extending the container to a weaker sibling, a permission held beyond need, or privileged data copied somewhere the sandbox no longer protects.
Test cases
3 test cases in this category. Each states what the test proves, how it is carried out, what has to be in place beforehand, what a positive result looks like, and whether the work is manual, automated or a mixture.
IOS-SBOX-01 Shared User Resources
Objective — Determine whether App Groups and keychain access groups extend the application's container to other applications, and whether every participant merits that access.
How it is tested — Enumerate the App Groups and keychain access groups in the entitlements and identify which other applications declare the same. Inspect the shared containers and keychain items to establish what becomes mutually accessible. Assess whether every participating application is held to the same standard, since the group's security becomes that of its weakest member, and whether the target trusts shared data without verifying who wrote it.
Prerequisites — The entitlements of every application in the group; a device with the group installed and container access.
Indicators — Session or personal data in a shared container; keychain items shared more widely than needed; a participating application materially weaker; shared data trusted without verifying its writer.
Coverage — MASVS-PLATFORM-1MASVS-STORAGE-1CWE-250CWE-276
Depth — Manual Requires assessing the other members of the group, not just the target.
IOS-SBOX-02 Excessive Permissions
Objective — Determine whether the application requests more platform privilege than its function requires, widening what compromising it would yield.
How it is tested — Enumerate the permission usage descriptions declared in the bundle and the capability entitlements the application holds, and trace each to the code that uses it. Identify permissions declared but never exercised, and those required by bundled third-party components rather than by the application. Establish whether permissions are requested at first launch rather than when first needed, and whether the application still functions when one is refused.
Prerequisites — The bundle property list and entitlements; the decrypted binary; a device where permissions can be granted and refused individually.
Indicators — A permission declared but never used; a capability required by a bundled component rather than the application; permissions requested up front; the application refusing to function without an unnecessary permission.
Coverage — MASVS-PRIVACY-1MASVS-PLATFORM-1CWE-250CWE-272
Depth — Hybrid Enumeration automates; tracing each to a genuine use requires reading the binary.
IOS-SBOX-03 Disclosure of Privileged Data to Public Resources
Objective — Determine whether data obtained under a privileged permission is written or transmitted somewhere the permission no longer protects it.
How it is tested — Identify what the application obtains under each permission — location, contacts, photos, health, identifiers — and follow each through the binary and through captured traffic to every destination. Establish whether any reaches the unified log, the general pasteboard, a shared container, a notification payload, or a third-party analytics component. Include crash reports, which frequently carry more than intended.
Prerequisites — A device with the permissions granted and real data behind them; a proxy capturing all destinations; log and container access.
Indicators — Permission-protected data in the log or a shared container; such data sent to a third-party component; location or contacts in crash reports; privileged data in a notification payload.
Coverage — MASVS-PRIVACY-1MASVS-STORAGE-2CWE-359CWE-200
Depth — Manual The work is following privileged data to every destination, including unintended ones.
What we need from you
The signed bundle and its entitlements; a device with container and permission visibility; the vendor's related applications where groups are shared; and a proxy capturing every outbound destination.
Standards this category maps to
Every identifier below is quoted from the published control list it belongs to. Where a test has no defensible mapping, none is given rather than an approximate one.
- MASVS-PLATFORM-1 — The app uses IPC mechanisms securely.
- MASVS-STORAGE-1 — The app securely stores sensitive data.
- CWE-250 — Execution with Unnecessary Privileges
- CWE-276 — Incorrect Default Permissions
- MASVS-PRIVACY-1 — The app minimizes access to sensitive data and resources.
- CWE-272 — Least Privilege Violation
- MASVS-STORAGE-2 — The app prevents leakage of sensitive data.
- CWE-359 — Exposure of Private Personal Information to an Unauthorized Actor
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
Tell us what the system does and what worries you.
If a penetration test is not what you need yet, we will say so.