DΛΣMӨП

// HackTricks · Mobile

iOS App Extensions

iOS App Extensions

App extensions enhance the functionality of apps by allowing them to interact with other apps or the system, providing custom features or content. These extensions include:

  • Custom Keyboard: Offers a unique keyboard across all apps, replacing the default iOS keyboard.
  • Share: Enables sharing to social networks or with others directly.
  • Widgets: Modern widgets use WidgetKit. Legacy Today extensions may still appear in older applications and remain relevant during assessment.[3]

When a user engages with these extensions, such as sharing text from a host app, the extension processes this input within its context, leveraging the shared information to perform its task, as detailed in Apple’s documentation.[1]

Security Considerations

Key security aspects include:[1]

  • Extensions and their containing apps communicate via inter-process communication, not directly.
  • A legacy Today widget can request that the system open its containing app through its extension context; do not generalize this behavior to every extension point.
  • Shared data access is allowed within a private container, but direct access is restricted.
  • Certain APIs, including HealthKit, are off-limits to app extensions, which also cannot start long-running tasks, access the camera, or microphone, except for iMessage extensions.

Static Analysis

Identifying App Extensions

To find app extensions in source code, search for NSExtensionPointIdentifier in Xcode or inspect the app bundle for .appex files indicating extensions. Without source code, use grep or SSH to locate these identifiers within the app bundle.[1][2]

Supported Data Types

Check the Info.plist file of an extension for NSExtensionActivationRule to identify supported data types. This setup ensures only compatible data types trigger the extension in host apps.[1][2]

Data Sharing

Data sharing between a containing app and its extension normally uses an App Group container. Shared preferences can use UserDefaults(suiteName:) (NSUserDefaults in Objective-C), while files and databases use the group container URL. Background URLSession transfers initiated by an extension also require a shared container configured on the session.[1][2]

Restricting Extensions

Apps can restrict certain extension types, particularly custom keyboards, ensuring sensitive data handling aligns with security protocols.[1][2]

Dynamic Analysis

Dynamic analysis involves:[1][2]

  • Inspecting Shared Items: Hook into NSExtensionContext - inputItems to see shared data types and origins.
  • Identifying Extensions: Discover which extensions process your data by observing internal mechanisms, like NSXPCConnection.

Tools like frida-trace can aid in understanding the underlying processes, especially for those interested in the technical details of inter-process communication.

References