Home / Attacks & tests / Privacy Breaches
6 test cases
Privacy Breaches
Privacy testing examines what the application discloses about the person using it, rather than what it discloses about itself. The question is whether identifiers, personal data and behavioural signals travel further than the function requires and further than the user was told.
What an attacker is trying to achieve
The adversary here is often not an intruder but an observer: another application on the device, an embedded analytics component, or a network position. What they want is correlation — a stable identifier that ties activity to a person across applications, installs and time.
Test cases
6 test cases in this category. Each states what the test proves, how it is carried out, what has to be in place beforehand, what a positive result looks like, and whether the work is manual, automated or a mixture.
Android
Android exposes several device-scoped identifiers and permits broad inter-application visibility, so the emphasis is on which identifiers are used and what is left where other applications can read it.
AND-PRIV-01 Device Identifiers in Attacker-Visible Elements
Objective — Determine whether device- or installation-scoped identifiers are placed where another application on the device, or a network observer, can read and correlate them.
How it is tested — Identify every identifier the application reads or generates and follow each to its destinations: outbound requests, the system log, shared storage, the clipboard, inter-application messages and exported components. Establish which are resettable by the user and which persist. Determine whether any identifier is sent to third-party components alongside data that names the user, which is what makes correlation possible.
Prerequisites — A device with log, storage and clipboard visibility; a proxy capturing third-party destinations; a test application to read what is exposed on-device.
Indicators — A non-resettable identifier transmitted or logged; an identifier readable by another application; an identifier sent to a third party together with account data.
Coverage — MASVS-PRIVACY-2MASVS-PRIVACY-1CWE-359CWE-200
Depth — Manual The finding is correlation across destinations, which requires following each identifier rather than detecting it.
AND-PRIV-02 Private User Data Exposed to Visible Components
Objective — Determine whether personal data reaches components other applications can observe, defeating the sandbox that otherwise protects it.
How it is tested — Drive workflows handling personal data and establish where each item ends up: notification content, exported component payloads, broadcast messages, shared storage, the clipboard, and the recent-tasks preview. From a test application, observe what is readable. Establish whether notifications display sensitive content on a locked screen, and whether the application obscures its preview when backgrounded.
Prerequisites — A device; a second application able to observe broadcasts and read shared surfaces; an account with recognisable personal data.
Indicators — Personal data in a broadcast or notification readable by another application; sensitive content on the lock screen; an unobscured task preview; personal data in shared storage.
Coverage — MASVS-PRIVACY-1MASVS-PLATFORM-3CWE-359CWE-200
Depth — Manual Requires observing from a second application and from the locked device, not from inside the application.
AND-PRIV-03 Insecure Installation and Attribution Tracking
Objective — Determine whether install attribution and analytics are performed in a way that discloses more than intended or can be observed and influenced by a third party.
How it is tested — Capture the traffic generated at first launch, before any consent is given, and establish what is transmitted and to whom. Determine which identifiers accompany attribution data and whether the referral information is delivered over a channel another application could read or forge. Establish whether analytics begins before the user accepts it, and whether opting out actually stops transmission.
Prerequisites — A device that can be reset to a clean state; a proxy capturing first-launch traffic; the consent flow exercised both ways.
Indicators — Transmission to third parties before consent; attribution data carrying persistent identifiers; referral data readable or forgeable by another application; opting out not stopping transmission.
Coverage — MASVS-PRIVACY-3MASVS-PRIVACY-4CWE-359CWE-200
Depth — Manual First-launch behaviour only happens once, so the device has to be reset between attempts.
iOS
iOS restricts device identifiers and requires an explicit prompt before cross-application tracking, so the emphasis moves to whether those constraints are respected or worked around.
IOS-PRIV-01 Device Identifiers in Attacker-Visible Elements
Objective — Determine whether the application constructs or uses identifiers that survive the controls the platform provides for resetting and limiting them.
How it is tested — Identify every identifier used, including the vendor identifier, the advertising identifier and any value derived from device characteristics or stored in the keychain to outlive reinstallation. Reinstall the application and establish which identifiers persist. Determine whether the advertising identifier is requested without the tracking prompt, and whether a fingerprint is assembled from device attributes as a substitute.
Prerequisites — A device permitting reinstall and keychain inspection; a proxy capturing all destinations; the tracking permission exercised both ways.
Indicators — An identifier surviving reinstall via the keychain; a device fingerprint assembled from attributes; tracking identifiers used without the prompt; identifiers sent alongside account data.
Coverage — MASVS-PRIVACY-2MASVS-PRIVACY-1CWE-359CWE-200
Depth — Manual The reinstall-survival case requires actually reinstalling and comparing, which no static review shows.
IOS-PRIV-02 Private User Data Exposed to Visible Components
Objective — Determine whether personal data reaches surfaces outside the application's container where the platform no longer protects it.
How it is tested — Drive workflows handling personal data and establish where each item ends up: notification payloads, widget and complication content, Spotlight index entries, the general pasteboard, shared App Group containers and the backgrounded application snapshot. Establish whether notifications reveal content on a locked screen and whether the snapshot is obscured before the application backgrounds.
Prerequisites — A device with container access; a second application able to read the pasteboard; an account with recognisable personal data.
Indicators — Sensitive notification content on the lock screen; personal data in the Spotlight index or a widget; an unobscured background snapshot; personal data on the general pasteboard.
Coverage — MASVS-PRIVACY-1MASVS-PLATFORM-3CWE-359CWE-200
Depth — Manual The snapshot and index cases are produced by the platform and are only found by inspecting the device.
IOS-PRIV-03 Insecure Installation and Attribution Tracking
Objective — Determine whether attribution and analytics respect the consent the platform requires, and whether transmission begins before it is given.
How it is tested — Reset the device state and capture all traffic from first launch, establishing what is sent and to whom before any prompt is answered. Determine whether the tracking prompt is presented at all, and whether declining it changes what is transmitted. Establish whether attribution frameworks receive identifiers or account data, and whether the privacy disclosure the application publishes matches what is observed.
Prerequisites — A device that can be reset; a proxy capturing first-launch traffic; the published privacy disclosure; the consent flow exercised both ways.
Indicators — Transmission to third parties before consent; the tracking prompt absent while tracking occurs; declining consent not changing behaviour; observed collection exceeding the published disclosure.
Coverage — MASVS-PRIVACY-3MASVS-PRIVACY-4CWE-359CWE-200
Depth — Manual First-launch behaviour happens once; the device must be reset between attempts and the disclosure read for comparison.
What we need from you
A proxy capturing every outbound destination including third parties, with certificate pinning defeated where present; the application's published privacy disclosure for comparison; a device that can be reset and the application reinstalled; and a second application to test what is visible on-device.
Standards this category maps to
Every identifier below is quoted from the published control list it belongs to. Where a test has no defensible mapping, none is given rather than an approximate one.
- MASVS-PRIVACY-2 — The app prevents identification of the user.
- MASVS-PRIVACY-1 — The app minimizes access to sensitive data and resources.
- CWE-359 — Exposure of Private Personal Information to an Unauthorized Actor
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
- MASVS-PLATFORM-3 — The app uses the user interface securely.
- MASVS-PRIVACY-3 — The app is transparent about data collection and usage.
- MASVS-PRIVACY-4 — The app offers user control over their data.
Tell us what the system does and what worries you.
If a penetration test is not what you need yet, we will say so.