1

An answer on SO to a question on whether or not you could access stuff in the cache of Mobile Safari, stated that no, this was not possible, as each app runs in its own sandbox. I am unsure how this really answers the question on whether you can access the application, as even if each application lives in its own sandbox, not being able to access stuff on the outer filesystem, it might be that there is a way to access stuff in the sandbox from the outside. For instance, a VM lives inside of a sandbox, but one could still mount the filesystem in the VM from outside of the VM.

We make an app that makes use of a WKWebView and I would like to know whether caching images locally on the phone would enable an attacker to gain access to those images or if there are mechanisms built into iOS that prevents anyone with physical access to the device from getting to them.

I know that a lot of stuff is possible if a device is jailbroken, but there might be other ways as well?

Improve this question
3
  • 1
    I can't speak to the apps specifically, but as to whether an attacker had physical access to a device - the general rule of thumb is to assume that if they have it, it's compromised.
    – Allan
    Commented Nov 2, 2020 at 16:36
  • @Allan Yes, that is what we assume as well. Since the user can access private medical photos we have disabled caching, but I would like to assess how much a real risk this really is.
    – oligofren
    Commented Nov 2, 2020 at 20:57
  • That's not a realistically quantifiable risk; is more binary than anything else. . It depends on who is in possession of the phone; what's their skill level, what's their resources, what's their determination? If you're concerned about access, you should encrypt your data/images as stated in the answer.
    – Allan
    Commented Nov 3, 2020 at 14:07

1 Answer 1

Reset to default
2

The sandbox protects data from app A from being accessed by app B, it doesn't protect data against the OS or any OS-level access. And as has already been mentioned in the comments: Once an attacker gets physical access to a device, all bets are off anyway.

If you want to specifically protect data items you need to add encryption within your app to handle this.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .