HackTricks Press
Search K

Appearance

iOS App Extensions ​

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

App extensions enhance the functionality of apps by allowing them to interact with other apps or the system, providing custom features or content. These extensions include:

  • Custom Keyboard: Offers a unique keyboard across all apps, replacing the default iOS keyboard.
  • Share: Enables sharing to social networks or with others directly.
  • Today (Widgets): Delivers content or performs tasks quickly from the Notification Center's Today view.

When a user engages with these extensions, such as sharing text from a host app, the extension processes this input within its context, leveraging the shared information to perform its task, as detailed in Apple's documentation.

Security Considerations ​

Key security aspects include:

  • Extensions and their containing apps communicate via inter-process communication, not directly.
  • The Today widget is unique in that it can request its app to open via a specific method.
  • Shared data access is allowed within a private container, but direct access is restricted.
  • Certain APIs, including HealthKit, are off-limits to app extensions, which also cannot start long-running tasks, access the camera, or microphone, except for iMessage extensions.

Static Analysis ​

Identifying App Extensions ​

To find app extensions in source code, search for NSExtensionPointIdentifier in Xcode or inspect the app bundle for .appex files indicating extensions. Without source code, use grep or SSH to locate these identifiers within the app bundle.

Supported Data Types ​

Check the Info.plist file of an extension for NSExtensionActivationRule to identify supported data types. This setup ensures only compatible data types trigger the extension in host apps.

Data Sharing ​

Data sharing between an app and its extension requires a shared container, set up via "App Groups" and accessed through NSUserDefaults. This shared space is necessary for background transfers initiated by extensions.

Restricting Extensions ​

Apps can restrict certain extension types, particularly custom keyboards, ensuring sensitive data handling aligns with security protocols.

Dynamic Analysis ​

Dynamic analysis involves:

  • Inspecting Shared Items: Hook into NSExtensionContext - inputItems to see shared data types and origins.
  • Identifying Extensions: Discover which extensions process your data by observing internal mechanisms, like NSXPCConnection.

Tools like frida-trace can aid in understanding the underlying processes, especially for those interested in the technical details of inter-process communication.

References ​

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks: