Reino: Encapsulation

La encapsulación consiste en crear límites fuertes. En un explorador web esto puede suponer la seguridad de que tu codificación móvil no se vea comprometido por otro código móvil. En el servidor puede significar la diferenciación entre los datos validados y los que no lo están, entre los datos de un usuario y los de otro, o entre los diferentes usuarios, los datos que pueden ver y los que no.

Biometric Authentication: Insufficient Touch ID Protection

Objective-C
Swift

Abstract

La aplicación usa Touch ID para almacenar un elemento en las llaves, pero no restringe las huellas digitales válidas a aquellas que estaban disponibles cuando se almacenó el elemento de las llaves.

Explanation

La autenticación basada en Touch ID puede implementarse con los servicios de llaves mediante el almacenamiento de un elemento en las llaves y la configuración de un control de accesos que requiera que el usuario utilice su huella digital para recuperar el elemento más tarde. Las siguientes directivas pueden usarse para definir cómo se autenticará al usuario con su huella digital:

- kSecAccessControlUserPresence: restricción de acceso con Touch ID o un código de acceso. No es necesario que Touch ID esté disponible o registrado. Touch ID puede tener acceso al elemento aunque se agreguen o eliminen huellas digitales.
- kSecAccessControlTouchIDAny: restricción de acceso con Touch ID para las huellas digitales registradas. No se invalida el elemento si se agregan o eliminan huellas digitales.
- kSecAccessControlTouchIDCurrentSet: restricción de acceso con Touch ID para las huellas digitales registradas actualmente. Se invalida el elemento si se agregan o eliminan huellas digitales.

Cuando usa Touch ID, debe utilizar el atributo kSecAccessControlTouchIDCurrentSet para impedir que se agreguen o eliminen huellas digitales en el futuro.

Ejemplo 1: el siguiente código usa la restricción kSecAccessControlTouchIDAny que permite que el elemento de las llaves se desbloquee con cualquier huella digital que se registre en el futuro:


    ...
    SecAccessControlRef sacRef = SecAccessControlCreateWithFlags(kCFAllocatorDefault,
                 kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly,
                 kSecAccessControlTouchIDCurrentSet, 
                 nil);
    NSMutableDictionary *dict = [NSMutableDictionary dictionary];
    [dict setObject:(__bridge id)kSecClassGenericPassword forKey:(__bridge id) kSecClass];
    [dict setObject:account forKey:(__bridge id)kSecAttrAccount];
    [dict setObject:service forKey:(__bridge id) kSecAttrService];
    [dict setObject:token forKey:(__bridge id)kSecValueData];
    ...
    [dict setObject:sacRef forKey:(__bridge id)kSecAttrAccessControl];
    [dict setObject:@"Please authenticate using the Touch ID sensor." forKey:(__bridge id)kSecUseOperationPrompt];

    dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
        OSStatus status = SecItemAdd((__bridge CFDictionaryRef)dict, nil);
    });
    ...

References

[1] David Thiel iOS Application Security: The Definitive Guide for Hackers and Developers No Starch Press

[2] Integrating Touch ID Into Your iOS Applications Cigital

[3] Don't Touch Me That Way nVisium

[4] SecAccessControlCreateFlags Apple

[5] Standards Mapping - CIS Azure Kubernetes Service Benchmark 1.0

[6] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4.0

[7] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 3

[8] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[9] Standards Mapping - Common Weakness Enumeration CWE ID 287

[10] Standards Mapping - Common Weakness Enumeration Top 25 2019 [13] CWE ID 287

[11] Standards Mapping - Common Weakness Enumeration Top 25 2020 [14] CWE ID 287

[12] Standards Mapping - Common Weakness Enumeration Top 25 2021 [14] CWE ID 287

[13] Standards Mapping - Common Weakness Enumeration Top 25 2022 [14] CWE ID 287

[14] Standards Mapping - Common Weakness Enumeration Top 25 2023 [13] CWE ID 287

[15] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001958

[16] Standards Mapping - FIPS200 CM, SC

[17] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[18] Standards Mapping - NIST Special Publication 800-53 Revision 4 IA-3 Device Identification and Authentication (P1)

[19] Standards Mapping - NIST Special Publication 800-53 Revision 5 IA-3 Device Identification and Authentication

[20] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[21] Standards Mapping - OWASP Top 10 2007 A9 Insecure Communications

[22] Standards Mapping - OWASP Top 10 2010 A9 Insufficient Transport Layer Protection

[23] Standards Mapping - OWASP Top 10 2021 A07 Identification and Authentication Failures

[24] Standards Mapping - OWASP Application Security Verification Standard 4.0 2.7.1 Out of Band Verifier Requirements (L1 L2 L3), 2.7.2 Out of Band Verifier Requirements (L1 L2 L3), 2.7.3 Out of Band Verifier Requirements (L1 L2 L3), 2.8.4 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.8.5 Single or Multi Factor One Time Verifier Requirements (L2 L3), 3.7.1 Defenses Against Session Management Exploits (L1 L2 L3), 9.2.3 Server Communications Security Requirements (L2 L3)

[25] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[26] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[27] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1, MASVS-AUTH-2

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 4.1, Requirement 6.5.10

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 4.1, Requirement 6.3.1.4, Requirement 6.5.9

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 4.1, Requirement 6.5.4

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 4.1, Requirement 6.5.4

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 4.1, Requirement 6.5.4

[33] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 4.1, Requirement 6.5.4

[34] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 4.1, Requirement 6.5.4

[35] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 4.2.1, Requirement 6.2.4

[36] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.3 - Authentication and Access Control

[37] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.3 - Authentication and Access Control

[38] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.3 - Authentication and Access Control, Control Objective C.2.1.2 - Web Software Access Controls

[39] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 311

[40] Standards Mapping - SANS Top 25 2011 Porous Defenses - CWE ID 311

[41] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-001650 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-001650 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-001650 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-001650 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-001650 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-001650 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-001650 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-001650 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-001650 CAT II

[57] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-001650 CAT II

[58] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001650 CAT II

[59] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001650 CAT II

[60] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001650 CAT II

[61] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001650 CAT II

[62] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authentication (WASC-01)

[63] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authentication

desc.dataflow.objc.biometric_authentication_insufficient_touch_id_protection

Abstract

Explanation


    ...
    let flags = SecAccessControlCreateWithFlags(kCFAllocatorDefault,
        kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly,
        .TouchIDAny, 
        nil)

    var query = [String : AnyObject]()
    query[kSecClass as String] = kSecClassGenericPassword
    query[kSecAttrService as String] = service as AnyObject?
    query[kSecAttrAccount as String] = account as AnyObject?
    query[kSecValueData as String] = secret as AnyObject?
    ...
    query[kSecAttrAccessControl as String] = sacRef
    query[kSecUseOperationPrompt as String] = "Please authenticate using the Touch ID sensor."

    SecItemAdd(query as CFDictionary, nil)
    ...