Skip to main content

Excessive privileges - Mobile App

Need​

Restriction of app permissions to only necessary and authorized operations

Context​

  • Usage of Swift for iOS and macOS app development
  • Usage of UIKit for building modern and responsive user interfaces
  • Usage of CoreLocation for accessing location services in iOS development

Description​

Non compliant code​

import UIKit
import CoreLocation

class ViewController: UIViewController, CLLocationManagerDelegate {
    var locationManager: CLLocationManager!

    override func viewDidLoad() {
        super.viewDidLoad()

        // Requesting excessive privileges
        locationManager = CLLocationManager()
        locationManager.delegate = self
        locationManager.desiredAccuracy = kCLLocationAccuracyBest
        locationManager.requestAlwaysAuthorization()
        locationManager.startUpdatingLocation()
    }
    
    func locationManager(_ manager: CLLocationManager, didUpdateLocations locations: [CLLocation]) {
        let userLocation:CLLocation = locations[0] as CLLocation
        print("user latitude = \\(userLocation.coordinate.latitude)")
        print("user longitude = \\(userLocation.coordinate.longitude)")
    }
}

The above Swift code is for a view controller in an iOS application that requests location permissions from the user. The application is requesting requestAlwaysAuthorization(), which is a high level of privilege that allows the application to access the user's location at all times, even when the application is not in use.

This is considered a security vulnerability because the application is requesting more permissions than necessary. If an attacker were able to exploit this application, they could potentially gain access to the user's location at all times, which is a serious invasion of privacy.

The application should only request the minimum level of permissions necessary to perform its functions. In this case, if the application only needs to access the user's location while the application is in use, it should request requestWhenInUseAuthorization() instead.

This excessive privilege vulnerability can be abused by an attacker to perform unauthorized read or write operations in the device.

Steps​

  • Review the permissions required by the application and identify the necessary ones for its functionality.
  • Remove any unnecessary permissions from the application's code.
  • Ensure that the application only requests the minimum required permissions from the user.
  • Regularly review and update the permissions requested by the application as its functionality evolves.
  • Test the application thoroughly to ensure that it functions correctly with the reduced permissions.

Compliant code​

import UIKit
import CoreLocation

class ViewController: UIViewController, CLLocationManagerDelegate {
    var locationManager: CLLocationManager!

    override func viewDidLoad() {
        super.viewDidLoad()

        // Requesting only necessary privileges
        locationManager = CLLocationManager()
        locationManager.delegate = self
        locationManager.desiredAccuracy = kCLLocationAccuracyBest
        locationManager.requestWhenInUseAuthorization() // Changed from requestAlwaysAuthorization to requestWhenInUseAuthorization
        locationManager.startUpdatingLocation()
    }
    
    func locationManager(_ manager: CLLocationManager, didUpdateLocations locations: [CLLocation]) {
        let userLocation:CLLocation = locations[0] as CLLocation
        print("user latitude = \\(userLocation.coordinate.latitude)")
        print("user longitude = \\(userLocation.coordinate.longitude)")
    }
}

The original code was requesting excessive permissions from the user's device. Specifically, it was using the requestAlwaysAuthorization() method of the CLLocationManager class, which requests permission to access the user's location data at all times, even when the app is not in use. This is a potential security vulnerability, as it gives the app more access to sensitive data than it needs.

The fixed code changes the requestAlwaysAuthorization() method to requestWhenInUseAuthorization(). This method only requests permission to access the user's location data when the app is in use. This reduces the potential for abuse of the app's permissions, as it can no longer access location data when it is not in use.

This change ensures that the app only has the minimum permissions it needs to function, reducing the potential for unauthorized access to sensitive data. It is important to regularly review and update the permissions requested by the app as its functionality evolves, and to thoroughly test the app to ensure it functions correctly with the reduced permissions.

References​

Last updated on