312-50 Question 399
Single answer▪ Hacking iOSDuring an authorized mobile app assessment, you are testing an iOS application used by field employees. The client provides a jailbroken test device and asks you to verify whether the app improperly stores sensitive data locally. The app appears to log in successfully even when the network is disabled after the first authentication, suggesting cached credentials or tokens may be present on the device. Which action is the MOST appropriate next step to validate insecure local data storage on iOS?
- A
Inspect the app's sandbox on the jailbroken device for files such as plist databases, SQLite databases, and cache files that may contain tokens, credentials, or session data
- B
Use ARP spoofing on the wireless network to capture the app's credentials in transit, because offline login behavior proves the credentials are being retransmitted
- C
Dump the iOS kernel memory remotely from the device to recover the user's password, since iOS stores all authentication secrets in kernel space
- D
Modify the app's App Store receipt to bypass authentication checks, because receipt validation is the primary mechanism for local credential storage in iOS apps
Show answer and explanation
Correct answer: A
Explanation
The best answer is to inspect the application's local storage within its sandbox on the provided jailbroken device. In a real iOS assessment, signs such as successful offline use after prior authentication often indicate that the app may be storing session tokens, user identifiers, cached API responses, or other sensitive artifacts locally. Testers commonly review plist files, SQLite databases, caches, cookies, and other files in the app container, and also consider whether sensitive values are stored securely in the iOS Keychain versus insecurely in files. This approach is consistent with practical mobile app testing guidance, including OWASP Mobile testing practices and Apple platform data storage concepts. While network interception can help analyze transport security, it is not the most appropriate next step when the key indicator points to local persistence rather than network transmission.
- A. Correct.
Correct. On a jailbroken test device, a practical and standard approach is to inspect the application's sandbox for insecure local storage. In iOS, application data commonly resides under the app container and may include property list files, SQLite databases, cached API responses, cookies, or other artifacts. If the app allows continued access while offline after initial authentication, examining local storage for tokens, session identifiers, or cached sensitive data is an appropriate next step. This aligns with common mobile testing methodology and OWASP Mobile guidance on testing for insecure data storage.
- B. Incorrect.
Incorrect. ARP spoofing is a network interception technique and can be useful for analyzing traffic, but the scenario specifically indicates that the app still functions when the network is disabled. That behavior suggests local persistence of authentication artifacts, not retransmission over the network. Capturing traffic would not be the most direct way to validate insecure local storage in this case.
- C. Incorrect.
Incorrect. This option is technically implausible in the scenario and reflects a misunderstanding of how iOS apps typically store app data. User authentication material is not generally expected to be recovered by remotely dumping kernel memory, and kernel-space analysis is not the normal first step for validating insecure local app storage during an application assessment. App data is far more likely to be found in the app sandbox or keychain, depending on implementation.
- D. Incorrect.
Incorrect. App Store receipts are related to app purchase and licensing validation, not the primary storage location for user login credentials or session tokens. Altering receipts is unrelated to validating whether the application is caching sensitive authentication data locally. This distractor targets confusion between application integrity/licensing checks and credential storage.