iOS App Extensions

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!
Get the official PEASS & HackTricks swag
Discover The PEASS Family, our collection of exclusive NFTs
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @carlospolopm.
Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

App extensions enhance the functionality of apps by allowing them to interact with other apps or the system, providing custom features or content. These extensions include:

Custom Keyboard: Offers a unique keyboard across all apps, replacing the default iOS keyboard.
Share: Enables sharing to social networks or with others directly.
Today (Widgets): Delivers content or performs tasks quickly from the Notification Center's Today view.

When a user engages with these extensions, such as sharing text from a host app, the extension processes this input within its context, leveraging the shared information to perform its task, as detailed in Apple's documentation.

Security Considerations

Key security aspects include:

Extensions and their containing apps communicate via inter-process communication, not directly.
The Today widget is unique in that it can request its app to open via a specific method.
Shared data access is allowed within a private container, but direct access is restricted.
Certain APIs, including HealthKit, are off-limits to app extensions, which also cannot start long-running tasks, access the camera, or microphone, except for iMessage extensions.

Static Analysis

Identifying App Extensions

To find app extensions in source code, search for NSExtensionPointIdentifier in Xcode or inspect the app bundle for .appex files indicating extensions. Without source code, use grep or SSH to locate these identifiers within the app bundle.

Supported Data Types

Check the Info.plist file of an extension for NSExtensionActivationRule to identify supported data types. This setup ensures only compatible data types trigger the extension in host apps.

Data sharing between an app and its extension requires a shared container, set up via "App Groups" and accessed through NSUserDefaults. This shared space is necessary for background transfers initiated by extensions.

Restricting Extensions

Apps can restrict certain extension types, particularly custom keyboards, ensuring sensitive data handling aligns with security protocols.

Dynamic Analysis

Dynamic analysis involves:

Inspecting Shared Items: Hook into NSExtensionContext - inputItems to see shared data types and origins.
Identifying Extensions: Discover which extensions process your data by observing internal mechanisms, like NSXPCConnection.

Tools like frida-trace can aid in understanding the underlying processes, especially for those interested in the technical details of inter-process communication.

References