Which security parameters to consider before third party SDK integration

user_1220868 0
Viewed 63

Working towards security is critical for any project. Currently looking towards integration of an third party SDK into my iOS App. However before that I would like to thoroughly analyse and scrutinize the SDK.

Some of the checkpoints are -

  • Pasteboard Analysis
  • Use of private API's banned by Apple e.g CTTelephonyNetworkInfo
  • Database encryption (if any is created by the SDK)

What I looking for as an answer here is the way I can achieve the above plus any other things that I should look for.

I know the question might sound off the topic or rather like a discussion, but a checklist like this can turn out to be very important for all developers out there.

security iphone ios
1 Answers

So I was able to check a simple checklist for this. However, I believe this answer would get out of date rather sooner. Still I will share what I should.

  • Pasteboard analysis - This is to check if the SDK copies anything on the public pasteboard. As this is shared across all apps, it could lead to vulnerability.
  • Persistent Data - Add the SDK to the app and check if it creates any persistent storage like .sqlite file. Check the contents of this file to understand what is being stored and if this information is sensitive in any way.
  • UserPreferences - NSUserPreferences can be extensively used in any SDK, this can rather lead to data being stored into simple text format.
  • Private API usage - An SDK can use private iOS API's with help of methods like NSClassFromString and NSSelectorFromString. The usage for such API's is banned by Apple and can lead to rejection in review.

One can closely follow the following post. It would help to understand how to take a class dump. Check for hardcoded strings. Specially usage of Hopper Disassembler turned out helpful for me.

user_12208680
Related