Port MASTG-TEST-0073 (by @guardsquare) #3051

pascalj · 2024-11-07T10:37:37Z

Your contribution is written in the 2nd person (e.g. you)
Your contribution is written in an active present form for as much as possible.
You have made sure that the reference section is up to date (e.g. please add sources you have used, make sure that the references to MITRE/MASVS/etc. are up to date)
Your contribution has proper formatted markdown and/or code
Any references to website have been formatted as [TEXT](URL “NAME”)
You verified/tested the effectiveness of your contribution (e.g.: is the code really an effective remediation? Please verify it works!)

This PR closes #2966

pascalj · 2024-11-07T10:52:16Z

A couple of comments:

Persistence is handled automatically with iOS 10.0, i.e. if you have sensitive data just don't add it to the generalPasteboard. All app-specific pasteboards are not persistent.
Handoff is handled securely and locally (BLE and Wifi like Airdrop), so I think it doesn't pose an additional risk.
Since iOS 14 the user must show intent to allow apps to read from the pasteboard which makes this only a risk when you consider user error as a threat.

TheDauntless · 2024-11-07T17:26:08Z

tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0x73-1.md

+
+The systemwide general pasteboard can be obtained by the [`generalPasteboard`](https://developer.apple.com/documentation/uikit/uipasteboard/1622106-generalpasteboard "UIPasteboard generalPasteboard") function. The general pasteboard enables easy sharing of information between apps. However, it can also leak sensitive data, since every app and [potentially even other devices](https://developer.apple.com/documentation/uikit/uipasteboard#3671087 "UIPasteboard") can request the contents. Since iOS 16.0 this requires user interaction.
+
+When you are dealing with sensitive data, usage of the general pasteboard should be avoided. This static test case identifies whether the app uses the general keyboard.


Suggested change

When you are dealing with sensitive data, usage of the general pasteboard should be avoided. This static test case identifies whether the app uses the general keyboard.

When you are dealing with sensitive data, usage of the general pasteboard should be avoided. This static test case identifies whether the app uses the general pasteboard.

pascalj changed the title ~~Port MASTG-TEST-0073~~ Port MASTG-TEST-0073 (by @guardsquare) Nov 7, 2024

TheDauntless reviewed Nov 7, 2024

View reviewed changes

Port MASTG-TEST-0073

535e846

pascalj force-pushed the mastg-0073 branch from c32141d to 535e846 Compare November 7, 2024 17:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Port MASTG-TEST-0073 (by @guardsquare) #3051

Port MASTG-TEST-0073 (by @guardsquare) #3051

pascalj commented Nov 7, 2024

pascalj commented Nov 7, 2024

TheDauntless Nov 7, 2024


		The systemwide general pasteboard can be obtained by the [`generalPasteboard`](https://developer.apple.com/documentation/uikit/uipasteboard/1622106-generalpasteboard "UIPasteboard generalPasteboard") function. The general pasteboard enables easy sharing of information between apps. However, it can also leak sensitive data, since every app and [potentially even other devices](https://developer.apple.com/documentation/uikit/uipasteboard#3671087 "UIPasteboard") can request the contents. Since iOS 16.0 this requires user interaction.

		When you are dealing with sensitive data, usage of the general pasteboard should be avoided. This static test case identifies whether the app uses the general keyboard.

Port MASTG-TEST-0073 (by @guardsquare) #3051

Are you sure you want to change the base?

Port MASTG-TEST-0073 (by @guardsquare) #3051

Conversation

pascalj commented Nov 7, 2024

pascalj commented Nov 7, 2024

TheDauntless Nov 7, 2024

Choose a reason for hiding this comment