CAPEC-498: Probe iOS Screenshots

Description

An adversary examines screenshot images created by iOS in an attempt to obtain sensitive information. This attack targets temporary screenshots created by the underlying OS while the application remains open in the background.

Likelihood of attack: Not rated by MITRE
Typical severity: Not rated by MITRE
Abstraction: DetailedA low-level, detailed pattern, often for a particular technology.

Mechanism of attack: Collect and Analyze Information

Prerequisites

This type of an attack requires physical access to a device to either excavate the image files (potentially by leveraging a Jailbreak) or view the screenshots through the multitasking switcher (by double tapping the home button on the device).

Mitigations

To mitigate this type of an attack, an application that may display sensitive information should clear the screen contents before a screenshot is taken. This can be accomplished by setting the key window's hidden property to YES. This code to hide the contents should be placed in both the applicationWillResignActive() and applicationDidEnterBackground() methods.

Related weaknesses (CWE)

CWE-359Exposure of Private Personal Information to an Unauthorized Actor

Related attack patterns

Parent

CAPEC-545Pull Data from System ResourcesStandard

Mitigations

To mitigate this type of an attack, an application that may display sensitive information should clear the screen contents before a screenshot is taken. This can be accomplished by setting the key window's hidden property to YES. This code to hide the contents should be placed in both the applicationWillResignActive() and applicationDidEnterBackground() methods.