iOS Lab 01 — ATS & Entitlements Analyzer
WARMUP: Chapters 2–3, 5 (sandbox/entitlements, ATS, URL schemes).
Threat model
An iOS app's Info.plist and entitlements declare what it can reach and how it talks to the network —
and they're where reviewable misconfigurations hide: a global NSAllowsArbitraryLoads (cleartext/
weak TLS app-wide), a debuggable release (get-task-allow), library-validation disabled
(loads unsigned code), a wildcard associated domain or broad Keychain group, and a sensitive
action on a hijackable custom URL scheme. This engine turns that metadata into severity-ranked
findings and a release gate.
What you build (lab.py)
analyze(config)— ATS findings (global + per-domain insecure-HTTP / weak-TLS / no-FS), dangerous entitlements, wildcard associated domain, broad Keychain group, sensitive-action-on-custom-scheme; severity-sorted.is_release_safe(config)— no high-or-above (a release gate).
Attack cases the tests cover
- Clean config is release-safe;
NSAllowsArbitraryLoads= high; a fully-weak per-domain exception yields insecure-http/weak-tls/no-fs; a TLS-1.3 exception is clean;get-task-allowand disable-library-validation = high; wildcard domain & broad Keychain = medium; sensitive-action on a custom scheme = high (but only when a scheme exists); severity-sorted.
Run
pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q
Hardening / extensions
- Parse a real
Info.plist/.entitlements(plist XML) instead of the dataclass. - Add more entitlement checks (network extensions, keychain-access-groups breadth, push in dev).
- Flag App Store review blockers (missing usage-description strings for requested TCC resources).
Interview / resume
"Built an iOS configuration analyzer that flags ATS exceptions, debug/unsafe entitlements, wildcard associated domains, and sensitive actions on hijackable custom URL schemes — with a release gate on high-severity findings."
Limitations: analyzes config metadata (not a parsed binary/plist); rule set is the common high-value items, not exhaustive.