App Transport Security (ATS) is iOS’s “all network traffic must be HTTPS with valid certs” policy. Introduced in iOS 9, it forced developers to migrate to HTTPS. The escape hatch is the NSAppTransp...
iOS - Background Snapshot Leak
When an iOS app backgrounds, the system takes a snapshot of its current screen and uses it for the app switcher’s thumbnails. The snapshot is stored as a PNG in the app’s container under Library/Ca...
iOS - UIPasteboard Clipboard Leak
UIPasteboard’s general pasteboard is shared across every app on the device. When the user copies an OTP from their banking app, it sits in UIPasteboard.general.string until something else replaces ...
iOS - Universal Link Misconfiguration
Universal Links are iOS’s robust deep-link mechanism, they prove domain ownership via a JSON file (apple-app-site-association, AASA) served from the domain’s .well-known/ path. Apple’s framework ve...
iOS - Custom URL Scheme Hijacking
iOS lets apps declare custom URL schemes in their Info.plist. Tap bankapp://, the system opens the registered app. The system does not deduplicate, multiple apps can claim the same scheme. The orde...
iOS - WKWebView JS Bridge
Apps embed WKWebView to render HTML - documentation, dashboards, in-app browsers. To let that HTML do something native (open a file, get a token, run a command), the app registers a JavaScript brid...
iOS - WKWebView allowingReadAccessTo File Read
WKWebView.loadFileURL(_:allowingReadAccessTo:) lets a developer load a local HTML file into a web view and specify the read-access boundary. The allowingReadAccessTo parameter is supposed to be a d...
iOS - Secrets in NSUserDefaults
NSUserDefaults is iOS’s app-preferences API. It is designed for non-sensitive settings, what theme the user picked, what filter they have applied. The backing storage is a plist in the app’s data c...
iOS - Keychain Accessibility Misuse
The iOS Keychain is the right place to store secrets. The detail that determines whether your secrets are actually protected: which kSecAttrAccessible constant the developer chose. iOS provides six...
Android - App Link autoVerify=false
Android App Links let apps claim ownership of HTTPS domains so that links to those domains open directly in the app instead of showing a browser or a chooser. The claim becomes authoritative when t...