界: Encapsulation

封裝是要劃定清楚的界限。在網頁瀏覽器中，這可能意味著確保您的行動程式碼不會被其他行動程式碼濫用。在伺服器上，這可能意味著區分經過驗證的資料與未經驗證的資料、區分一個使用者的資料與另一個使用者的資料，或區分允許使用者查看的資料與不允許查看的資料。

Biometric Authentication: Insufficient Touch ID Protection

Objective-C
Swift

Abstract

應用程式使用 Touch ID 在金鑰鏈中儲存某個項目，但無法將有效指紋限制為儲存金鑰鏈項目時可用的指紋。

Explanation

以 Touch ID 為基礎的驗證可使用金鑰鏈服務進行實作，方法是，將某個項目儲存在金鑰鏈中，並設定要求使用者稍後使用其指紋擷取項目的存取控制。以下策略可用於定義使用者如何使用指紋進行驗證。

-kSecAccessControlUserPresence：限制使用 Touch ID 或密碼進行存取。不一定非要提供或註冊 Touch ID。即使新增或移除指紋，仍可透過 Touch ID 存取項目。
-kSecAccessControlTouchIDAny：限制使用 Touch ID 中任何註冊的指紋進行存取。新增或移除指紋不會使項目失效。
-kSecAccessControlTouchIDCurrentSet：限制使用 Touch ID 中目前註冊的指紋進行存取。新增或移除指紋會使項目失效。

使用 Touch ID 時，應使用 kSecAccessControlTouchIDCurrentSet 屬性，以免指紋在未來被新增或移除。

範例 1：以下程式碼使用 kSecAccessControlTouchIDAny 限制，該限制允許任何未來註冊的指紋來解除鎖定金鑰鏈項目：


    ...
    SecAccessControlRef sacRef = SecAccessControlCreateWithFlags(kCFAllocatorDefault,
                 kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly,
                 kSecAccessControlTouchIDCurrentSet, 
                 nil);
    NSMutableDictionary *dict = [NSMutableDictionary dictionary];
    [dict setObject:(__bridge id)kSecClassGenericPassword forKey:(__bridge id) kSecClass];
    [dict setObject:account forKey:(__bridge id)kSecAttrAccount];
    [dict setObject:service forKey:(__bridge id) kSecAttrService];
    [dict setObject:token forKey:(__bridge id)kSecValueData];
    ...
    [dict setObject:sacRef forKey:(__bridge id)kSecAttrAccessControl];
    [dict setObject:@"Please authenticate using the Touch ID sensor." forKey:(__bridge id)kSecUseOperationPrompt];

    dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
        OSStatus status = SecItemAdd((__bridge CFDictionaryRef)dict, nil);
    });
    ...

References

[1] David Thiel iOS Application Security: The Definitive Guide for Hackers and Developers No Starch Press

[2] Integrating Touch ID Into Your iOS Applications Cigital

[3] Don't Touch Me That Way nVisium

[4] SecAccessControlCreateFlags Apple

[5] Standards Mapping - Common Weakness Enumeration CWE ID 287

[6] Standards Mapping - Common Weakness Enumeration Top 25 2019 [13] CWE ID 287

[7] Standards Mapping - Common Weakness Enumeration Top 25 2020 [14] CWE ID 287

[8] Standards Mapping - Common Weakness Enumeration Top 25 2021 [14] CWE ID 287

[9] Standards Mapping - Common Weakness Enumeration Top 25 2022 [14] CWE ID 287

[10] Standards Mapping - Common Weakness Enumeration Top 25 2023 [13] CWE ID 287

[11] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001958

[12] Standards Mapping - FIPS200 CM, SC

[13] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[14] Standards Mapping - NIST Special Publication 800-53 Revision 4 IA-3 Device Identification and Authentication (P1)

[15] Standards Mapping - NIST Special Publication 800-53 Revision 5 IA-3 Device Identification and Authentication

[16] Standards Mapping - OWASP Application Security Verification Standard 4.0 2.7.1 Out of Band Verifier Requirements (L1 L2 L3), 2.7.2 Out of Band Verifier Requirements (L1 L2 L3), 2.7.3 Out of Band Verifier Requirements (L1 L2 L3), 2.8.4 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.8.5 Single or Multi Factor One Time Verifier Requirements (L2 L3), 3.7.1 Defenses Against Session Management Exploits (L1 L2 L3), 9.2.3 Server Communications Security Requirements (L2 L3)

[17] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[18] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[19] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1, MASVS-AUTH-2

[20] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[21] Standards Mapping - OWASP Top 10 2007 A9 Insecure Communications

[22] Standards Mapping - OWASP Top 10 2010 A9 Insufficient Transport Layer Protection

[23] Standards Mapping - OWASP Top 10 2021 A07 Identification and Authentication Failures

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 4.1, Requirement 6.5.10

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 4.1, Requirement 6.3.1.4, Requirement 6.5.9

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 4.1, Requirement 6.5.4

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 4.1, Requirement 6.5.4

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 4.1, Requirement 6.5.4

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 4.1, Requirement 6.5.4

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 4.1, Requirement 6.5.4

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 4.2.1, Requirement 6.2.4

[32] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.3 - Authentication and Access Control

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.3 - Authentication and Access Control

[34] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.3 - Authentication and Access Control, Control Objective C.2.1.2 - Web Software Access Controls

[35] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 311

[36] Standards Mapping - SANS Top 25 2011 Porous Defenses - CWE ID 311

[37] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-001650 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-001650 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-001650 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-001650 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-001650 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-001650 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-001650 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-001650 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-001650 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001650 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-001650 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001650 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001650 CAT II

[57] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001650 CAT II

[58] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-001650 CAT II

[59] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authentication (WASC-01)

[60] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authentication

desc.dataflow.objc.biometric_authentication_insufficient_touch_id_protection

Abstract

應用程式使用 Touch ID 在金鑰鏈中儲存某個項目，但無法將有效指紋限制為儲存金鑰鏈項目時可用的指紋。

Explanation


    ...
    let flags = SecAccessControlCreateWithFlags(kCFAllocatorDefault,
        kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly,
        .TouchIDAny, 
        nil)

    var query = [String : AnyObject]()
    query[kSecClass as String] = kSecClassGenericPassword
    query[kSecAttrService as String] = service as AnyObject?
    query[kSecAttrAccount as String] = account as AnyObject?
    query[kSecValueData as String] = secret as AnyObject?
    ...
    query[kSecAttrAccessControl as String] = sacRef
    query[kSecUseOperationPrompt as String] = "Please authenticate using the Touch ID sensor."

    SecItemAdd(query as CFDictionary, nil)
    ...