iOS Lab 02 — Data-Protection & Privacy Evaluator

WARMUP: Chapters 4, 6, 7 (Data Protection/Keychain, lifecycle leaks, privacy).

Threat model

A lost or stolen phone, a backup, or a curious other app. Even apps that "encrypt" data leak it by storing secrets in UserDefaults (plaintext plist), in the Keychain with Always accessibility (readable while locked), in files at NSFileProtectionNone, on the system pasteboard, in logs, or by syncing device-bound secrets to iCloud. Plus privacy obligations: undeclared required-reason APIs and tracking without ATT. This engine checks each stored datum against its sensitivity and checks the privacy posture.

What you build (lab.py)

  • evaluate_item / evaluate_items — per-datum findings: plaintext-userdefaults (critical), on-system-pasteboard, keychain-always, file-protection-none, logged-secret (critical), synced-secret; non-sensitive data is ignored.
  • privacy_check — undeclared required-reason APIs (medium) and tracking-without-ATT (high).
  • is_safe — no item finding medium-or-above.

Attack cases the tests cover

  • A token in the Keychain when-unlocked, device-only, is clean; the same secret in UserDefaults is critical, on the pasteboard / Always / NSFileProtectionNone is high, logged is critical, synced is medium.
  • Non-sensitive data isn't flagged; an undeclared required-reason API and tracking without ATT are flagged (declared API / ATT-requested are clean); severity-sorted.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q

Hardening / extensions

  • Add SecAccessControl checks (biometric/Secure-Enclave-gated items) and per-class file-protection recommendations by data type.
  • Detect screenshot/app-switcher exposure for sensitive screens.
  • Parse a real PrivacyInfo.xcprivacy and bundled-SDK manifests; cross-check the App Store data labels.

Interview / resume

"Built an iOS data-protection evaluator that checks each datum's storage/protection/Keychain accessibility and sync against its sensitivity, flags pasteboard/log leaks, and checks privacy obligations (required-reason APIs, ATT) — encoding 'secure the whole data lifecycle, not just the store.'"

Limitations: metadata model (not a parsed app); the rule set is the common high-value protections; sensitivity classification is an input.