Port MASTG-TEST-0082 (by @appknox) #3097
Conversation
|
|
||
| ## Steps | ||
|
|
||
| 1. Run a static analysis using @MASTG-TOOL-0111 to extract entitlements from the binary to check the value of the `get-task-allow` key and is set to `true`. |
There was a problem hiding this comment.
Prefer to use the technique instead of specific tools in TESTS
https://mas.owasp.org/MASTG/techniques/ios/MASTG-TECH-0111/
Also, let's do the evaluation (check for true, in this case) later.
| 1. Run a static analysis using @MASTG-TOOL-0111 to extract entitlements from the binary to check the value of the `get-task-allow` key and is set to `true`. | |
| 1. Use @MASTG-TECH-0111 to extract entitlements from the binary and obtain the value of the `get-task-allow` key. |
| ## Steps | ||
|
|
||
| 1. Run a static analysis using @MASTG-TOOL-0111 to extract entitlements from the binary to check the value of the `get-task-allow` key and is set to `true`. | ||
| 2. Run a [dynamic analysis](../../../techniques/ios/MASTG-TECH-0084.md) using @MASTG-TOOL-0057. |
There was a problem hiding this comment.
The static analysis step should be enough. However, you still can refer to this TECH. See overview
|
|
||
| ## Observation | ||
|
|
||
| The entitlement get-task-allow is false, and anti-reverse engineering measures prevent debugger attachment attempts. |
There was a problem hiding this comment.
| The entitlement get-task-allow is false, and anti-reverse engineering measures prevent debugger attachment attempts. | |
| The output contains the value of the `get-task-allow` entitlement. |
|
|
||
| ## Evaluation | ||
|
|
||
| The test fails as the entitlement get-task-allow is true, allowing debugger attachment. |
There was a problem hiding this comment.
| The test fails as the entitlement get-task-allow is true, allowing debugger attachment. | |
| The test fails if the `get-task-allow` entitlement is `true`. |
|
|
||
| ## Overview | ||
|
|
||
| The test evaluates whether an iOS application is configured to allow debugging. If an app is debuggable, attackers can leverage debugging tools to reverse-engineer the application, analyse its runtime behaviour, and potentially compromise sensitive data or functionality. |
There was a problem hiding this comment.
| The test evaluates whether an iOS application is configured to allow debugging. If an app is debuggable, attackers can leverage debugging tools to reverse-engineer the application, analyse its runtime behaviour, and potentially compromise sensitive data or functionality. | |
| The test evaluates whether an iOS application is configured to allow debugging. If an app is debuggable, attackers can leverage debugging tools (see @MASTG-TECH-0084) to analyse the runtime behaviour of the app, and potentially compromise sensitive data or functionality. |
|
First round of review done. Please remember to include a demo using https://github.com/cpholguera/MASTestApp-iOS Thanks a lot @jeel38! |
|
@cpholguera Please Review it |
There was a problem hiding this comment.
Thanks for contribution. I added a few comments in code.
One more thingy, your demo covers 2 cases:
- detects if an app is debuggable
- detects if an app is currently being debugged
Can you split these two cases into two distinct demos and make sure this subtle difference is clear for the reader?
| print("📄 Info.plist Path: \(infoPath)") | ||
|
|
||
| if let infoDict = NSDictionary(contentsOfFile: infoPath) { | ||
| print("📋 Info.plist Contents: \(infoDict)") |
There was a problem hiding this comment.
Why do we print Info.plist? Does it contain info about a debuggable capability?
|
|
||
| if data.count > 0 { | ||
| if let content = String(data: data, encoding: .ascii), | ||
| content.contains("get-task-allow") { |
There was a problem hiding this comment.
I am afraid this method might cause false positives. For example, if there is a third-party code in the binary that also contains get-task-allow, this would trigger a false positive. It's also a bit slow to search through the whole binary, no? Can you optimise it?
|
|
||
| // Method 4: Process Info | ||
| print("\nMethod 4: Checking Process Info") | ||
| let isDebugger = isDebuggerAttached() |
There was a problem hiding this comment.
Can you make such a function for each method? It would clean up the code a bit.
There was a problem hiding this comment.
Do we need this file at all? If I'm not wrong I think we just need the modified entitlements file, so that we can build the app using it, and the reversed version.
Here's the original: https://github.com/cpholguera/MASTestApp-iOS/blob/main/entitlements.plist
There was a problem hiding this comment.
Reducing this demo to only one method is also ok
closes #3010