📱 iOS Common Vulnerabilities

1. Insecure Data Storage

Sensitive information like tokens, passwords, or personal user data is sometimes stored unencrypted in places like UserDefaults, NSCachesDirectory, or SQLite databases.

// Example (bad practice)
UserDefaults.standard.set("supersecrettoken", forKey: "auth_token")

Mitigation: Use Keychain for sensitive data and always encrypt local storage.

2. Weak Jailbreak Detection

Many apps attempt to detect jailbroken devices but use outdated or easily bypassable techniques (e.g., checking for Cydia.app).

// Weak check
if FileManager.default.fileExists(atPath: "/Applications/Cydia.app") {
    print("Jailbroken")
}

Mitigation: Use multiple and obfuscated checks; integrate runtime integrity verification.

3. Insecure Communication

Apps transmitting sensitive data over HTTP instead of HTTPS, or failing to validate SSL certificates, are vulnerable to man-in-the-middle (MitM) attacks.

Mitigation: Enforce HTTPS, enable App Transport Security (ATS), and implement SSL pinning if needed.

4. Reverse Engineering & Lack of Obfuscation

iOS apps can be decompiled using tools like Hopper or class-dumped to reveal method names, logic, and API keys.

Mitigation: Strip symbols from builds, use Swift’s obfuscation tools, and avoid hardcoding secrets in code.

5. Insecure API Endpoints

Many iOS apps expose APIs that lack authentication, authorization, or proper input validation, leading to issues like IDOR or injection.

Mitigation: Use proper authentication tokens (JWT, OAuth), validate user roles, and sanitize input on the server side.

6. Biometric Misconfigurations

Improper use of Touch ID / Face ID can lead to privilege escalation or unauthorized access to sensitive features.

Mitigation: Always verify biometric results server-side and avoid relying on them as the sole security mechanism.

7. Improper Session Handling

Sessions that never expire or fail to properly handle logout can be hijacked, especially on jailbroken devices.

Mitigation: Use short-lived tokens, rotate them frequently, and invalidate sessions server-side upon logout.