계: Encapsulation

캡슐화는 강력한 경계를 그리는 것입니다. 웹 브라우저에서는 사용자의 모바일 코드가 다른 모바일 코드에 의해 오용되지 않도록 하는 것을 의미합니다. 서버에서는 검증된 데이터와 검증되지 않은 데이터, 한 사용자의 데이터와 다른 사용자의 데이터, 데이터 사용자가 볼 수 있는 데이터와 볼 수 없는 데이터 간의 차별화를 의미할 수 있습니다.

Biometric Authentication: Insufficient Touch ID Protection

Objective-C
Swift

Abstract

응용 프로그램이 터치 ID를 사용하여 키 집합에 항목을 저장하지만 유효한 지문을 키 집합 항목 저장 시 사용 가능한 지문으로 제한하지 못합니다.

Explanation

터치 ID 기반 인증은 키 집합에 항목을 저장하고 사용자가 나중에 항목을 검색할 때 자신의 지문을 사용해야 하도록 설정함으로써 키 집합 서비스를 사용하여 구현할 수 있습니다. 다음 정책을 사용하여 사용자가 자신의 지문을 사용하여 인증하는 방법을 정의할 수 있습니다.

- kSecAccessControlUserPresence: 터치 ID 또는 암호를 사용한 액세스로 제한합니다. 터치 ID가 사용 가능하거나 등록될 필요가 없습니다. 지문이 추가되거나 제거되더라도 터치 ID로 항목에 액세스할 수 있습니다.
- kSecAccessControlTouchIDAny: 터치 ID를 사용한 액세스를 등록된 모든 지문으로 제한합니다. 지문이 추가되거나 제거될 때 항목이 무효화되지 않습니다.
- kSecAccessControlTouchIDCurrentSet: 터치 ID를 사용한 액세스를 현재 등록된 모든 지문으로 제한합니다. 지문이 추가되거나 제거될 때 항목이 무효화됩니다.

터치 ID를 사용할 때는 kSecAccessControlTouchIDCurrentSet 특성을 사용하여 향후 지문 추가 또는 제거로부터 보호해야 합니다.

예제 1: 다음 코드에서는 향후 등록되는 모든 지문이 키 집합 항목을 잠금 해제할 수 있도록 허용하는 kSecAccessControlTouchIDAny 제약 조건을 사용합니다.


    ...
    SecAccessControlRef sacRef = SecAccessControlCreateWithFlags(kCFAllocatorDefault,
                 kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly,
                 kSecAccessControlTouchIDCurrentSet, 
                 nil);
    NSMutableDictionary *dict = [NSMutableDictionary dictionary];
    [dict setObject:(__bridge id)kSecClassGenericPassword forKey:(__bridge id) kSecClass];
    [dict setObject:account forKey:(__bridge id)kSecAttrAccount];
    [dict setObject:service forKey:(__bridge id) kSecAttrService];
    [dict setObject:token forKey:(__bridge id)kSecValueData];
    ...
    [dict setObject:sacRef forKey:(__bridge id)kSecAttrAccessControl];
    [dict setObject:@"Please authenticate using the Touch ID sensor." forKey:(__bridge id)kSecUseOperationPrompt];

    dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
        OSStatus status = SecItemAdd((__bridge CFDictionaryRef)dict, nil);
    });
    ...

References

[1] David Thiel iOS Application Security: The Definitive Guide for Hackers and Developers No Starch Press

[2] Integrating Touch ID Into Your iOS Applications Cigital

[3] Don't Touch Me That Way nVisium

[4] SecAccessControlCreateFlags Apple

[5] Standards Mapping - CIS Azure Kubernetes Service Benchmark 1

[6] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4

[7] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 3

[8] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[9] Standards Mapping - Common Weakness Enumeration CWE ID 287

[10] Standards Mapping - Common Weakness Enumeration Top 25 2019 [13] CWE ID 287

[11] Standards Mapping - Common Weakness Enumeration Top 25 2020 [14] CWE ID 287

[12] Standards Mapping - Common Weakness Enumeration Top 25 2021 [14] CWE ID 287

[13] Standards Mapping - Common Weakness Enumeration Top 25 2022 [14] CWE ID 287

[14] Standards Mapping - Common Weakness Enumeration Top 25 2023 [13] CWE ID 287

[15] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001958

[16] Standards Mapping - FIPS200 CM, SC

[17] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[18] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[19] Standards Mapping - OWASP Top 10 2007 A9 Insecure Communications

[20] Standards Mapping - OWASP Top 10 2010 A9 Insufficient Transport Layer Protection

[21] Standards Mapping - OWASP Top 10 2021 A07 Identification and Authentication Failures

[22] Standards Mapping - OWASP Application Security Verification Standard 4.0 2.7.1 Out of Band Verifier Requirements (L1 L2 L3), 2.7.2 Out of Band Verifier Requirements (L1 L2 L3), 2.7.3 Out of Band Verifier Requirements (L1 L2 L3), 2.8.4 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.8.5 Single or Multi Factor One Time Verifier Requirements (L2 L3), 3.7.1 Defenses Against Session Management Exploits (L1 L2 L3), 9.2.3 Server Communications Security Requirements (L2 L3)

[23] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[24] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[25] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1, MASVS-AUTH-2

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 4.1, Requirement 6.5.10

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 4.1, Requirement 6.3.1.4, Requirement 6.5.9

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 4.1, Requirement 6.5.4

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 4.1, Requirement 6.5.4

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 4.1, Requirement 6.5.4

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 4.1, Requirement 6.5.4

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 4.1, Requirement 6.5.4

[33] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 4.2.1, Requirement 6.2.4

[34] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.3 - Authentication and Access Control

[35] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.3 - Authentication and Access Control

[36] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.3 - Authentication and Access Control, Control Objective C.2.1.2 - Web Software Access Controls

[37] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 311

[38] Standards Mapping - SANS Top 25 2011 Porous Defenses - CWE ID 311

[39] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-001650 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-001650 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-001650 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-001650 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-001650 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-001650 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-001650 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-001650 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-001650 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-001650 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001650 CAT II

[57] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001650 CAT II

[58] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001650 CAT II

[59] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001650 CAT II

[60] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authentication (WASC-01)

[61] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authentication

desc.dataflow.objc.biometric_authentication_insufficient_touch_id_protection

Abstract

응용 프로그램이 터치 ID를 사용하여 키 집합에 항목을 저장하지만 유효한 지문을 키 집합 항목 저장 시 사용 가능한 지문으로 제한하지 못합니다.

Explanation


    ...
    let flags = SecAccessControlCreateWithFlags(kCFAllocatorDefault,
        kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly,
        .TouchIDAny, 
        nil)

    var query = [String : AnyObject]()
    query[kSecClass as String] = kSecClassGenericPassword
    query[kSecAttrService as String] = service as AnyObject?
    query[kSecAttrAccount as String] = account as AnyObject?
    query[kSecValueData as String] = secret as AnyObject?
    ...
    query[kSecAttrAccessControl as String] = sacRef
    query[kSecUseOperationPrompt as String] = "Please authenticate using the Touch ID sensor."

    SecItemAdd(query as CFDictionary, nil)
    ...