deardaniel/secdata-raw huggingface dataset:
OWASP Mobile Application Security Testing Guide: MASTG TEST 0269

---
platform: ios
title: Runtime Use Of APIs Allowing Fallback to Non-Biometric Authentication
id: MASTG-TEST-0269
apis: [kSecAccessControlUserPresence, kSecAccessControlDevicePasscode, SecAccessControlCreateWithFlags]
type: [dynamic]
weakness: MASWE-0045
profiles: [L2]
knowledge: [MASTG-KNOW-0056]
---

## Overview

This test is the dynamic counterpart to @MASTG-TEST-0268.

## Steps

1. Use runtime method hooking (see @MASTG-TECH-0095) and look for uses of [`SecAccessControlCreateWithFlags`](https://developer.apple.com/documentation/security/secaccesscontrolcreatewithflags(_:_:_:_:)) and specific flags.

## Observation

The output should contain a list of locations where the `SecAccessControlCreateWithFlags` function is called including all used flags.

## Evaluation

The test fails if the app uses `SecAccessControlCreateWithFlags` with the `kSecAccessControlUserPresence` or `kSecAccessControlDevicePasscode` flags for any sensitive data resource that needs protection.

The test passes only if the app uses `SecAccessControlCreateWithFlags` with stricter flags, such as [`kSecAccessControlBiometryAny`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/biometryany), [`kSecAccessControlBiometryCurrentSet`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/biometrycurrentset) to enforce biometric-only access for any sensitive data resource that needs protection (being `kSecAccessControlBiometryCurrentSet` the one considered the most secure).
OWASP Mobile Application Security Testing Guide: MASTG TEST 0267

---
platform: ios
title: Runtime Use Of Event-Bound Biometric Authentication
id: MASTG-TEST-0267
apis: [LAContext.evaluatePolicy]
type: [dynamic]
weakness: MASWE-0044
best-practices: []
profiles: [L2]
knowledge: [MASTG-KNOW-0056]
---

## Overview

This test is the dynamic counterpart to @MASTG-TEST-0266.

## Steps

1. Use runtime method hooking (see @MASTG-TECH-0095) and look for uses of [LAContext.evaluatePolicy(...)](https://developer.apple.com/documentation/localauthentication/lacontext/evaluatepolicy(_:localizedreason:reply:)) and [`SecAccessControlCreateWithFlags`](https://developer.apple.com/documentation/security/secaccesscontrolcreatewithflags(_:_:_:_:)), including all flags.

## Observation

The output should contain a list of locations where the `LAContext.evaluatePolicy` and `SecAccessControlCreateWithFlags` functions are called including all used flags.

## Evaluation

The test fails if for each sensitive data resource worth protecting:

- `LAContext.evaluatePolicy` is used explicitly.
- There are no calls to `SecAccessControlCreateWithFlags` requiring user presence with [any of the possible flags](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags).
OWASP Mobile Application Security Testing Guide: MASTG TEST 0270

---
platform: ios
title: References to APIs Detecting Biometric Enrollment Changes
id: MASTG-TEST-0270
apis: [kSecAccessControlBiometryCurrentSet,SecAccessControlCreateWithFlags]
type: [static]
weakness: MASWE-0046
profiles: [L2]
knowledge: [MASTG-KNOW-0056]
---

## Overview

This test checks whether the app fails to protect sensitive operations against unauthorized access following biometric enrollment changes. An attacker who obtains the device passcode could add a new fingerprint or facial representation via system settings and use it to authenticate in the app.

The test identifies the absence of the [`kSecAccessControlBiometryCurrentSet`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/biometrycurrentset) access control flag when storing sensitive items in the Keychain via [`SecAccessControlCreateWithFlags`](https://developer.apple.com/documentation/security/secaccesscontrolcreatewithflags(_:_:_:_:)). This flag ensures that the associated Keychain item becomes inaccessible if the biometric database changes (e.g., when a new fingerprint or face is added). As a result, only users whose biometric data was enrolled at the time the item was created can unlock it, preventing unauthorized access through later-enrolled biometrics.

## Steps

1. Run a static analysis tool such as @MASTG-TOOL-0073 on the app binary and look for uses of [`SecAccessControlCreateWithFlags`](https://developer.apple.com/documentation/security/secaccesscontrolcreatewithflags(_:_:_:_:)) API with [`kSecAccessControlBiometryCurrentSet`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/biometrycurrentset) flag.

## Observation

The output should contain a list of locations where relevant APIs are used.

## Evaluation

The test fails if the app uses `SecAccessControlCreateWithFlags` with any flag except the `kSecAccessControlBiometryCurrentSet` flag for any sensitive data resource worth protecting.
OWASP Mobile Application Security Testing Guide: MASTG TEST 0271

---
platform: ios
title: Runtime Use Of APIs Detecting Biometric Enrollment Changes
id: MASTG-TEST-0271
apis: [kSecAccessControlBiometryCurrentSet,SecAccessControlCreateWithFlags]
type: [static]
weakness: MASWE-0046
profiles: [L2]
knowledge: [MASTG-KNOW-0056]
---

## Overview

This test is the dynamic counterpart to @MASTG-TEST-0270.

## Steps

1. Use runtime method hooking (see @MASTG-TECH-0095) and look for uses of [`SecAccessControlCreateWithFlags`](https://developer.apple.com/documentation/security/secaccesscontrolcreatewithflags(_:_:_:_:)) and specific flags.

## Observation

The output should contain a list of locations where the `SecAccessControlCreateWithFlags` function is called including all used flags.

## Evaluation

The test fails if the app uses `SecAccessControlCreateWithFlags` with any flag except the `kSecAccessControlBiometryCurrentSet` flag for any sensitive data resource worth protecting.
OWASP Mobile Application Security Testing Guide: MASTG TEST 0266

---
platform: ios
title: References to APIs for Event-Bound Biometric Authentication
id: MASTG-TEST-0266
apis: [LAContext.evaluatePolicy]
type: [static]
weakness: MASWE-0044
profiles: [L2]
knowledge: [MASTG-KNOW-0056]
---

## Overview

This test checks if the app insecurely accesses sensitive resources (e.g., tokens, keys) that should be protected by user authentication relying **solely** on the LocalAuthentication API for access control instead of using the Keychain API and requiring user presence.

The **LocalAuthentication** API (e.g., `LAContext`) provides user authentication (Touch ID, Face ID, device passcode), returning only a success or failure result. However, it **does not** securely store secrets or enforce any security. This makes it susceptible to logic manipulation (e.g., bypassing an `if authenticated { ... }` check).

In contrast, the **Keychain** API securely stores sensitive data, and can be configured with access control policies (e.g., require user presence such as biometrics) via `kSecAccessControl` flags. This ensures authentication is not just a one-time boolean, but part of a **secure data retrieval path (out-of-process)**, so bypassing authentication becomes significantly harder.

## Steps

1. Run a static analysis scan with @MASTG-TOOL-0073 to detect usage of `LAContext.evaluatePolicy`
2. Run a static analysis scan with @MASTG-TOOL-0073 to detect usage of Keychain APIs, especially `SecAccessControlCreateWithFlags` (which should go accompanied by other APIs such as `SecItemAdd` and `SecItemCopyMatching`).

## Observation

The output should contain the locations where the `LAContext.evaluatePolicy` and Keychain APIs are used in the codebase (or the lack of their use).

## Evaluation

The test fails if for each sensitive data resource worth protecting:

- `LAContext.evaluatePolicy` is used explicitly.
- There are no calls to `SecAccessControlCreateWithFlags` requiring user presence with [any of the possible flags](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags).
OWASP Mobile Application Security Testing Guide: MASTG TEST 0268

---
platform: ios
title: References to APIs Allowing Fallback to Non-Biometric Authentication
id: MASTG-TEST-0268
apis: [kSecAccessControlUserPresence, kSecAccessControlDevicePasscode, SecAccessControlCreateWithFlags]
type: [static]
weakness: MASWE-0045
profiles: [L2]
knowledge: [MASTG-KNOW-0056]
---

## Overview

This test checks if the app uses authentication mechanisms that rely on the user's passcode instead of biometrics or allow fallback to device passcode when biometric authentication fails. Specifically, it checks for use of [`kSecAccessControlDevicePasscode`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/devicepasscode) or [`kSecAccessControlUserPresence`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/userpresence).

The `kSecAccessControlUserPresence` flag is described in the Apple docs as the option that's typically used as it "lets the system choose a mechanism, depending on the current situation". However, this allows fallback to passcode in some cases (e.g. when biometrics aren't configured yet), which is considered weaker than requiring biometrics alone because passcodes are more susceptible to compromise (e.g., through shoulder surfing).

**Note:** This test does not consider [`LAPolicy.deviceOwnerAuthentication`](https://developer.apple.com/documentation/localauthentication/lapolicy/deviceownerauthentication) for LocalAuthentication flows because that shouldn't be used on its own. See @MASTG-TEST-0266.

## Steps

1. Run a static analysis scan using @MASTG-TOOL-0073 to detect usage of `SecAccessControlCreateWithFlags` with the `kSecAccessControlUserPresence` or `kSecAccessControlDevicePasscode` flags.

## Observation

The output should contain a list of locations where relevant APIs are used.

## Evaluation

The test fails if the app uses `SecAccessControlCreateWithFlags` with the `kSecAccessControlUserPresence` or `kSecAccessControlDevicePasscode` flags for any sensitive data resource that needs protection.

The test passes only if the app uses `SecAccessControlCreateWithFlags` with stricter flags, such as [`kSecAccessControlBiometryAny`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/biometryany), [`kSecAccessControlBiometryCurrentSet`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/biometrycurrentset) to enforce biometric-only access for any sensitive data resource that needs protection (being `kSecAccessControlBiometryCurrentSet` the one considered the most secure).

**Note:** Using `kSecAccessControlUserPresence` or `kSecAccessControlDevicePasscode` is not inherently a vulnerability, but in high-security applications (e.g., finance, government, health), their use can represent a weakness or misconfiguration that reduces the intended security posture. This issue is therefore better categorized as a security weakness or hardening issue, not a critical vulnerability.
OWASP Mobile Application Security Testing Guide: MASTG TEST 0215

---
platform: ios
title: Sensitive Data Not Marked For Backup Exclusion
id: MASTG-TEST-0215
type: [static]
weakness: MASWE-0004
best-practices: [MASTG-BEST-0023]
profiles: [L1, L2, P]
knowledge: [MASTG-KNOW-0102]
---

## Overview

This test verifies whether your app uses the `isExcludedFromBackup` API to instruct the system to exclude sensitive files from backups. This API [does not guarantee the actual exclusion](https://developer.apple.com/documentation/foundation/optimizing_your_app_s_data_for_icloud_backup/#3928527). According to the documentation:

> "The `isExcludedFromBackup` resource value exists only to provide guidance to the system about which files and directories it can exclude; it's not a mechanism to guarantee those items never appear in a backup or on a restored device."

In this test, we identify all locations where the `isExcludedFromBackup` API is used to mark files that might still end up in a backup.

!!! note
    Files stored in an app's `/tmp` and `/Library/Caches` directories are **excluded** from iCloud backups. These directories are intended for temporary or cache data, and the system may automatically delete their contents at any time to free up space. Therefore, you don't need to mark these files with `isExcludedFromBackup`. For more details, see the [Apple documentation](https://developer.apple.com/documentation/foundation/optimizing-your-app-s-data-for-icloud-backup#Exclude-Purgeable-Data).

## Steps

1. Run a static analysis tool such as @MASTG-TOOL-0073 on the app binary, or use a dynamic analysis tool like @MASTG-TOOL-0039, and look for uses of the `isExcludedFromBackup` API.

## Observation

The output should contain the disassembled code of the functions using `isExcludedFromBackup`, and, if possible, the list of affected files.

## Evaluation

The test fails if the `isExcludedFromBackup` API is used and any of the affected files are considered sensitive.

For any sensitive files found, in addition to using `isExcludedFromBackup`, make sure to encrypt them, as `isExcludedFromBackup` does not guarantee exclusion.
OWASP Mobile Application Security Testing Guide: MASTG TEST 0301

---
platform: ios
title: Runtime Use of APIs for Storing Unencrypted Data in Private Storage
id: MASTG-TEST-0301
type: [dynamic]
profiles: [L2]
weakness: MASWE-0006
best-practices: [MASTG-BEST-0024]
knowledge: [MASTG-KNOW-0091, MASTG-KNOW-0057, MASTG-KNOW-0108]
---

## Overview

This test is the dynamic counterpart to @MASTG-TEST-0300 and is designed to be used together with @MASTG-TEST-0302.

It uses runtime method hooking to identify if sensitive data is written unencrypted to private storage or directly in the Keychain by monitoring file and Keychain APIs.

Note that some of the target APIs route I/O through system daemons or otherwise avoid direct `open` and `write` syscalls, so you'll have to hook the relevant Objective C or Swift APIs rather than tracing syscalls only.

## Steps

1. Use runtime method hooking (see @MASTG-TECH-0095) and look for uses of file system APIs that create or write files.
2. Use runtime method hooking (see @MASTG-TECH-0095) and look for uses of Keychain APIs.
3. Exercise app features that could handle sensitive data (authentication flows, session establishment, offline caching, profile viewing/editing, cryptographic operations, secure messaging, payment, or token refresh logic).

## Observation

The output should contain:

- A list of calls to the relevant Keychain APIs
- A list of calls to the relevant File System APIs

## Evaluation

The test case fails if the sensitive data is not encrypted before being written to private storage or the Keychain API isn't used to store the sensitive data.

Determining whether data is encrypted when written to private storage may be challenging. However, by monitoring the APIs used for writing data and analyzing the data written, you can infer whether encryption is being applied based on the methods and libraries used. You'll have to correlate the data written to private storage with the APIs used to write it, as identified through runtime method hooking. You'll also have to correlate the File System APIs with the Keychain APIs to verify that they are used together to store sensitive data securely. Sensitive data can be stored securely in the Keychain or be encrypted using a key from the Keychain before being written to private storage.
OWASP Mobile Application Security Testing Guide: MASTG TEST 0297

---
platform: ios
title: Insertion of Sensitive Data into Logs
id: MASTG-TEST-0297
type: [static]
weakness: MASWE-0001
prerequisites:
- identify-sensitive-data
best-practices: [MASTG-BEST-0022]
profiles: [L1, L2]
knowledge: [MASTG-KNOW-0101]
---

## Overview

On the iOS platform, logging APIs like `NSLog`, `NSAssert`, `NSCAssert`, `print`, and `printf` can inadvertently lead to the leakage of sensitive information. Log messages are recorded in the console, and you can access them by using @MASTG-TECH-0060. Although other apps on the device cannot read these logs, direct logging is generally discouraged due to its potential for data leakage.

In this test, we will use static analysis to verify whether an app has any logging APIs which take sensitive data.

## Steps

1. Run a static analysis tool such as @MASTG-TOOL-0073 on the app binary and look for uses of logging APIs.

## Observation

The output should include the location of all logging functions. Check the decompiled code to verify if they receive sensitive data as input.

## Evaluation

The test case fails if you can find the use of logging APIs logging any sensitive data.
OWASP Mobile Application Security Testing Guide: MASTG TEST 0296

---
platform: ios
title: Sensitive Data Exposure Through Insecure Logging
id: MASTG-TEST-0296
type: [dynamic]
weakness: MASWE-0001
prerequisites:
- identify-sensitive-data
best-practices: [MASTG-BEST-0022]
profiles: [L1, L2]
knowledge: [MASTG-KNOW-0101]
---

## Overview

This test is the dynamic counterpart to @MASTG-TEST-0297.

In this test, we will monitor and capture the device logs and then analyze them for sensitive data.

!!! warning Limitation
    - Linking the logs back to specific locations in the app can be difficult and requires manual analysis of the code. As an alternative you can use dynamic analysis with @MASTG-TOOL-0039.
    - Dynamic analysis works best when you interact extensively with the app. But even then there could be corner cases which are difficult or impossible to execute on every device. The results from this test therefore are likely not exhaustive.

## Steps

1. Install the app on a device (@MASTG-TECH-0056).
2. Monitor the logs with @MASTG-TECH-0060.
3. Open the app.
4. Navigate to the mobile app from which you wish to analyse the log output.
5. Close the app.

## Observation

The output should contain all logged data.

## Evaluation

The test case fails if you can find sensitive data inside the output.
OWASP Mobile Application Security Testing Guide: MASTG TEST 0302

---
platform: ios
title: Sensitive Data Unencrypted in Private Storage Files
id: MASTG-TEST-0302
type: [dynamic, filesystem]
prerequisites:
- identify-sensitive-data
profiles: [L2]
weakness: MASWE-0006
best-practices: [MASTG-BEST-0024]
knowledge: [MASTG-KNOW-0108]
---

## Overview

This test is designed to complement @MASTG-TEST-0301. Instead of monitoring APIs during execution, it performs a differential analysis of the app's private storage by comparing snapshots taken before and after exercising the app. It also enumerates Keychain items created or modified during the session.

The goal is to identify new or modified files and determine whether they contain sensitive data in plaintext or trivially encoded form, and to identify new Keychain entries that may contain sensitive data or keys used for file encryption.

## Steps

1. Ensure the device / simulator is in a clean state (no prior test artifacts). Terminate the app if running.
2. Take an initial snapshot of the app's private storage (sandbox) directory tree (@MASTG-TECH-0052).
3. Take an initial snapshot of the Keychain items (@MASTG-TECH-0061). Optionally record attributes (accessible class, access control flags, etc).
4. Exercise app features that could handle sensitive data (authentication flows, session establishment, offline caching, profile viewing/editing, cryptographic operations, secure messaging, payment, or token refresh logic).
5. Take a second snapshot of the private storage directory tree.
6. Diff the two private storage snapshots to identify new, deleted, and modified files. For modified files, determine whether content changes involve potential sensitive values.
7. Take a second snapshot of the Keychain items
8. Diff the two Keychain snapshots to identify new, deleted, and modified items during the session using @MASTG-TECH-0061.

## Observation

The output should contain:

- List of new or modified files with: path, size, hash, inferred type, encoding/encryption status (plaintext / encoded / encrypted / unknown).
- List of new or modified Keychain entries.

## Evaluation

The test case fails if sensitive data appears in plaintext or trivially encoded in new or modified files.

Inspect the list of files and Keychain entries for sensitive data. Attempt to identify and decode data that has been encoded using methods such as base64 encoding, hexadecimal representation, URL-encoding, escape sequences, binary plist files, compressed archives like zip, wide characters and common data obfuscation methods such as xoring. Also consider identifying and decompressing compressed files such as tar or zip. These methods obscure but do not protect sensitive data.
OWASP Mobile Application Security Testing Guide: MASTG TEST 0300

---
platform: ios
title: References to APIs for Storing Unencrypted Data in Private Storage
id: MASTG-TEST-0300
type: [static]
profiles: [L2]
best-practices: [MASTG-BEST-0024]
weakness: MASWE-0006
knowledge: [MASTG-KNOW-0091, MASTG-KNOW-0057, MASTG-KNOW-0108]
---

## Overview

This test checks whether the app writes unencrypted sensitive data to private storage. It focuses on:

- APIs that persist data in the app sandbox directories, including Foundation `FileManager` methods, low-level POSIX and BSD file I/O calls and high-level APIs such as `UserDefaults`, Core Data and SQLite wrappers.
- Keychain APIs used to:
    - store sensitive data directly within the Keychain
    - manage keys from the Keychain (that could be used to encrypt data before writing to private storage).

## Steps

1. Run a static analysis tool such as @MASTG-TOOL-0073 and look for uses of file system APIs that create or write files.
2. Run a static analysis tool such as @MASTG-TOOL-0073 and look for uses of Keychain APIs.

## Observation

The output should contain:

- A list of locations where the app writes or may write data to private storage.
- A list of locations where the app uses Keychain APIs, including access control and accessibility attributes.

## Evaluation

The test case fails if the sensitive data is not encrypted before being written to private storage or the Keychain API isn't used to store the sensitive data.