Insecure Storage: Lacking Data Protection

The identified method writes data to a file lacking sufficient encryption settings.

The Data Protection API is designed to let applications declare when items in the Keychain and files stored on the file system should be accessible. It is available for most file and database APIs, including NSFileManager, CoreData, NSData, and SQLite. By specifying one of four protection classes for a given resource, a developer can instruct the underlying file system to encrypt it either using a key derived from both the device's UID and the user's passcode or using a key solely based on the device's UID (as well as when to automatically decrypt it).

The Data Protection classes are defined in NSFileManager as constants meant to be assigned as the value for the NSFileProtectionKey key in a Dictionary associated with the NSFileManager instance. Files can be created or have their data protection class modified through use of NSFileManager functions including setAttributes(_:ofItemAtPath:), attributesOfItemAtPath(_:), and createFileAtPath(_:contents:attributes:). In addition, corresponding Data Protection constants are defined for NSData objects in the NSDataWritingOptions enum that can be passed as the options argument to NSData functions such as
writeToFile(_:options:). The definitions for the various Data Protection class constants for NSFileManager and NSData are as follows:

-NSFileProtectionComplete, NSDataWritingOptions.DataWritingFileProtectionComplete:
The resource is stored in an encrypted format on disk and cannot be read from, or written to, while the device is locked or booting.
Available in iOS 4.0 and later.
-NSFileProtectionCompleteUnlessOpen, NSDataWritingOptions.DataWritingFileProtectionCompleteUnlessOpen:
The resource is stored in an encrypted format on disk. Resources can be created while the device is locked, but once closed, cannot be opened again until the device is unlocked. If the resource is opened when unlocked, you may continue to access the resource normally, even if the user locks the device.
Available in iOS 5.0 and later.
-NSFileProtectionCompleteUntilFirstUserAuthentication, NSDataWritingOptions.DataWritingFileProtectionCompleteUntilFirstUserAuthentication:
The resource is stored in an encrypted format on disk and cannot be accessed until after the device has booted. After the user unlocks the device for the first time, your app can access the resource and continue to access it even if the user subsequently locks the device.
Available in iOS 5.0 and later.
-NSFileProtectionNone, NSDataWritingOptions.DataWritingFileProtectionNone:
The resource has no special protections associated with it. It can be read from, or written to, at any time.
Available in iOS 4.0 and later.

Even though all files on an iOS device, including those without an explicitly assigned Data Protection class, are stored in an encrypted form, specifying NSFileProtectionNone results in encryption using a key derived solely based on the device's UID. This leaves such files accessible any time the device is powered on, including when locked with a passcode or when booting. As such, usages of NSFileProtectionNone should be carefully reviewed to determine if further protection with a stricter Data Protection class is warranted.

Example 1: In the following example, the given file is not protected (accessible anytime the device is powered on):

...
let documentsPath = NSURL(fileURLWithPath: NSSearchPathForDirectoriesInDomains(.DocumentDirectory, .UserDomainMask, true)[0])
let filename = "\(documentsPath)/tmp_activeTrans.txt"
let protection = [NSFileProtectionKey: NSFileProtectionNone]
do {
    try NSFileManager.defaultManager().setAttributes(protection, ofItemAtPath: filename)
} catch let error as NSError {
    NSLog("Unable to change attributes: \(error.debugDescription)")
}
...
BOOL ok = textToWrite.writeToFile(filename, atomically:true)
...

Example 2: In the following example, the given data is not protected (accessible anytime the device is powered on):

...
let documentsPath = NSURL(fileURLWithPath: NSSearchPathForDirectoriesInDomains(.DocumentDirectory, .UserDomainMask, true)[0])
let filename = "\(documentsPath)/tmp_activeTrans.txt"
...
BOOL ok = textData.writeToFile(filepath, options: .DataWritingFileProtectionNone);
...