security-mcp 1.1.4 → 1.3.1

package/skills/ios-security-auditor/SKILL.md

@@ -75,3 +75,285 @@ Only activated if iOS or cross-platform mobile is detected.
 - MASVS control ID violated
 - Swift/ObjC code fix written inline
 - CVSSv4, CWE
+- `intelligenceForOtherAgents` block (see schema below)
+- `coverageManifest` (see §ZERO-MISS-MANDATE)
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+These expansions cover attack surfaces that OWASP MASVS alone does not fully address. Each
+check is mandatory — do not skip without documented justification.
+
+1. **CVE-2023-23530 / CVE-2023-23531 — NSPredicate Injection via SpringBoard:**
+   Any app that constructs `NSPredicate` strings from user input is vulnerable to sandbox
+   escape on unpatched iOS 16.3 and below. Test: grep codebase for `NSPredicate(format:` with
+   non-literal format strings. Finding: any variable interpolated into the format string without
+   `SELF == %@` substitution. Fix: only use `NSPredicate(format:)` with `%@`, `%d`, `%K`
+   substitution — never string concatenation.
+
+2. **Frida / Objection Dynamic Instrumentation Bypass Detection:**
+   Attackers attach Frida to a running app via `frida-server` on jailbroken devices to hook
+   `LAContext.evaluatePolicy` and return `true` unconditionally. Test: check for
+   `MSHookFunction` / `fishhook` resistance and integrity checks around auth decision points.
+   Concrete detection: compute a runtime hash of `LAContext`'s method IMP; compare against a
+   compile-time constant. Finding: absence of any IMP integrity check near biometric evaluation.
+
+3. **iOS Backup Keychain Extraction (CVE class: MASVS-STORAGE-2):**
+   Items stored with `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly` are excluded from
+   iTunes/iCloud backup, but items with the non-`ThisDeviceOnly` variants ARE included in
+   unencrypted backups. Test: enumerate all `SecItemAdd`/`SecItemUpdate` calls; flag any
+   `kSecAttrAccessible` value without `ThisDeviceOnly` suffix for sensitive item classes
+   (`kSecClassGenericPassword`, `kSecClassInternetPassword`). Tool: `idevicebackup2` +
+   `KeychainDumper` on a backup image. Finding: auth tokens or PII in backup-eligible
+   Keychain slots.
+
+4. **Universal Link Hijacking via Misconfigured AASA (apple-app-site-association):**
+   If `apple-app-site-association` specifies an overly broad path (`"paths": ["*"]`) or is
+   served from an HTTP endpoint, an attacker-controlled domain can intercept OAuth redirects.
+   Test: fetch `https://<domain>/.well-known/apple-app-site-association`; validate JSON
+   structure, HTTPS enforcement, and path specificity. Script: `curl -s
+   https://TARGET/.well-known/apple-app-site-association | jq '.applinks.details[].paths'`.
+   Finding: wildcard `*` path or missing HTTPS redirect.
+
+5. **Swift Concurrency Race on Authentication State (`async`/`await` TOCTOU):**
+   Post-iOS 15 Swift async/await patterns introduce new TOCTOU windows: an `actor`-isolated
+   authentication state may be read by one task while a concurrent task is resetting it.
+   Test: search for `actor` definitions that guard auth state; verify that all mutations and
+   reads use the same actor isolation. Grep: `nonisolated` adjacent to auth-state-bearing
+   actors. Finding: `nonisolated` method on an auth actor that reads sensitive state without
+   re-entering the actor.
+
+6. **AI-Assisted Reverse Engineering of Obfuscated Swift Binaries (Post-2024 Threat):**
+   LLM-powered tools (e.g., IDA + GPT-4 plugins, BinaryNinja Sidekick) can reconstruct
+   business logic from stripped Swift binaries in under an hour — vastly reducing the time
+   to extract hardcoded secrets or forge authentication tokens. Test: run `strings` + `nm` on
+   the release `.ipa`; confirm no API keys, JWT secrets, or internal hostnames appear in
+   plain text. Additionally, verify that certificate pinning logic is not trivially identified
+   by pattern-matching on `SecCertificateCopyData` call sites alone. Finding: any secret
+   detectable by automated string extraction from the binary.
+
+7. **LLM Prompt-Injection via On-Device AI Features (Post-2024 Threat — Apple Intelligence):**
+   Apps integrating Apple Intelligence / Core ML LLM features that pass user-controlled text
+   directly to an on-device model without sanitisation are vulnerable to prompt injection
+   resulting in privilege escalation within the app's own data scope. Test: identify
+   `MLModel`, `NaturalLanguage`, or `CreateML` usage where user text is interpolated into a
+   system prompt. Finding: system prompt concatenation with unsanitised `UITextField` or
+   clipboard content that can redirect model output to exfiltrate in-app data.
+
+8. **WebView JavaScript Bridge Exposure (`WKScriptMessageHandler`):**
+   `WKScriptMessageHandler` creates a named bridge callable from JavaScript inside a
+   `WKWebView`. If the WebView loads remote or user-controlled content, any registered message
+   handler becomes an RCE or data-exfiltration surface. Test: grep for
+   `add(_:name:)` on `userContentController`; for each handler, verify the loaded URL origin
+   is pinned to an allowlist. Script: `grep -rn "add.*name:" --include="*.swift"`. Finding:
+   handler registered without origin validation, or WebView loads `http://` or a
+   user-supplied URL.
+
+---
+
+## §IOS_SECURITY_AUDITOR-CHECKLIST
+
+1. **Keychain accessibility class audit** — Search all `SecItemAdd` calls; verify
+   `kSecAttrAccessible` is `WhenUnlockedThisDeviceOnly` or `WhenPasscodeSetThisDeviceOnly`
+   for auth tokens and PII. Finding: any non-`ThisDeviceOnly` or `Always*` value for
+   sensitive data.
+
+2. **ATS exception audit** — Parse `Info.plist`; flag `NSAllowsArbitraryLoads`, any
+   `NSExceptionDomains` entry with `NSExceptionAllowsInsecureHTTPLoads: true`, or
+   `NSAllowsLocalNetworking: true` in production builds. Finding: any ATS exception not
+   accompanied by a documented compliance reason.
+
+3. **Certificate pinning implementation review** — Locate `URLSession` delegate
+   `urlSession(_:didReceive:completionHandler:)`; verify leaf or intermediate certificate
+   hash is pinned (not just hostname); verify backup pin exists. Finding: absent pinning,
+   hostname-only validation, or pinned only to a single certificate with no fallback.
+
+4. **Biometric auth enrollment-change invalidation** — After `LAContext.evaluatePolicy`
+   success, check that `evaluatedPolicyDomainState` is compared against a stored baseline.
+   Finding: no `evaluatedPolicyDomainState` persistence between app launches — biometric
+   re-enrollment is not detected.
+
+5. **Universal Link / AASA integrity check** — Fetch the AASA file over HTTPS; validate
+   the JSON schema against Apple's spec; confirm paths are not `*`; confirm the file is
+   served with `Content-Type: application/json`. Finding: any deviation from spec, wildcard
+   path, or HTTP delivery.
+
+6. **Pasteboard sensitive-data leak** — Grep for `UIPasteboard.general.string =` and
+   `UIPasteboard.general.setValue`; verify no auth tokens, card numbers, or PII are written.
+   Finding: any sensitive value written to the general pasteboard (accessible by all apps).
+
+7. **NSUserDefaults / UserDefaults PII audit** — Grep for `UserDefaults.standard.set` and
+   `UserDefaults.standard.setValue`; verify keys do not store credentials, tokens, or PII.
+   Finding: any token or PII key in `UserDefaults` (unencrypted, included in iCloud backup
+   by default).
+
+8. **WKWebView JavaScript bridge origin validation** — For each `WKScriptMessageHandler`
+   registration, verify the WebView's navigation delegate `decidePolicyFor` restricts origins
+   to a hardcoded allowlist. Finding: handler accessible from arbitrary or remote URLs.
+
+9. **Binary hardening flags** — Run `otool -hv <binary>` and `otool -l <binary> | grep
+   stack_chk`; verify PIE flag set, stack canaries present, ARC enabled. Finding: missing
+   PIE or stack canary in any framework or main binary.
+
+10. **Info.plist secrets scan** — Search `Info.plist` for keys containing `key`, `secret`,
+    `token`, `password`, `apiKey` (case-insensitive). Run `plutil -convert json -o - Info.plist
+    | jq 'keys[] | ascii_downcase | select(contains("key","secret","token","password"))'`.
+    Finding: any non-empty value for a matched key.
+
+11. **NSPredicate injection audit** — Grep for `NSPredicate(format:` with string interpolation
+    or concatenation (not solely `%@`/`%K`/`%d` substitution). Finding: user-controlled data
+    in predicate format string (arbitrary property access or sandbox escape on iOS < 16.3.2).
+
+12. **Secure Enclave key usage for authentication** — Verify that private keys used in
+    authentication flows are generated with `kSecAttrTokenIDSecureEnclave`. Finding: auth
+    private key stored in software Keychain rather than Secure Enclave — extractable via
+    Keychain dump on jailbroken device.
+
+---
+
+## §POC-REQUIREMENT
+
+Every CRITICAL or HIGH finding MUST follow this exact sequence before being recorded:
+
+1. **Write working PoC FIRST** — exact payload, request sequence, or tool command that
+   reproduces the vulnerability. For iOS findings this means: the exact `security
+   dump-keychain` command, `frida` script, or `curl` invocation that demonstrates impact.
+2. **Confirm reproduction** — execute the PoC and capture output proving the finding is real.
+3. **Write fix** — provide inline Swift/ObjC code that remediates the root cause.
+4. **Verify PoC fails against fix** — re-run the identical PoC against the fixed code; confirm
+   it no longer succeeds.
+5. **Record in findings JSON** — include `exploitPoC` key with the exact reproduction steps
+   and the verification output showing the fix is effective.
+
+**PoC skipping = severity automatically downgraded to MEDIUM.** If runtime access is
+unavailable (e.g., CI-only environment), document the limitation in `exploitPoC` and flag
+for manual validation before release.
+
+---
+
+## §PROJECT-ESCALATION
+
+Immediately alert the CISO orchestrator and reprioritise the run if ANY of the following
+conditions are detected:
+
+1. **Keychain data accessible without device unlock** — any item found with
+   `kSecAttrAccessibleAlways` or `kSecAttrAccessibleAlwaysThisDeviceOnly` containing
+   authentication credentials or cryptographic key material.
+
+2. **ATS fully disabled in production build** — `NSAllowsArbitraryLoads: true` confirmed
+   in a non-debug `Info.plist`; all network traffic is cleartext-eligible.
+
+3. **Hardcoded private key or JWT secret in binary or plist** — `strings` / `grep` confirms
+   a PEM block, base64 key, or JWT `HS256`/`RS256` secret appears verbatim in a shipped
+   artifact.
+
+4. **NSPredicate injection on iOS < 16.3.2 confirmed** — user-controlled input reaches
+   an `NSPredicate(format:)` call; SpringBoard sandbox escape is within attacker reach.
+
+5. **WKWebView bridge with no origin check loading remote URL** — any `WKScriptMessageHandler`
+   accessible from a remotely loaded page; classified as RCE-class vulnerability on the
+   app's data scope.
+
+6. **Apple Wallet / PassKit credential stored outside Secure Enclave** — payment or transit
+   pass private key material found in software Keychain rather than Secure Enclave.
+
+7. **LLM prompt injection confirmed in Apple Intelligence integration** — attacker-controlled
+   clipboard or text field content demonstrably redirects on-device model output to access
+   app-internal data or bypass app-level access controls.
+
+8. **Certificate pinning absent on a financial or health data endpoint** — MitM is trivially
+   possible on endpoints transmitting PCI-DSS or HIPAA-regulated data.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+---
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+---
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+---
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "SQL Injection", "filesReviewed": 47, "patterns": ["queryRaw", "string concat"], "result": "CLEAN" }],
+    "filesReviewed": 47,
+    "negativeAssertions": ["SQL Injection: queryRaw pattern searched across 47 files — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```
+
+---
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{
+  "findingId": "FINDING_ID",
+  "agentName": "ios-security-auditor",
+  "resolved": true,
+  "remediationTemplate": "one-line description of what was done",
+  "falsePositive": false
+}
+```
+Call `security.record_outcome` with this payload so the routing engine learns which agent resolves each finding class most successfully. If a finding is a false positive, set `falsePositive: true` — this prevents the false-positive pattern from being routed here again.