Thread by @harshbothra_

#securityexplained
S-6: Bypassing Biometrics in iOS with Objection

Many applications in iOS platform provides a functionality to enable touch/face ID to act as an added layer of protection to the application. However, it is possible to bypass this layer.

(1/n)

(2/n)
If the attack has "physical access" to the device, there are multiple options to bypass the checks, however, one of the simplest methods is to use "Objection".
Before, performing the attack ensure that the Frida is running. Also, the Objection must be installed.

(3/n)
# How to perform the attack:

1. Run the following command: objection --gadget <package_name_here>
2. In the objection run following command: ios ui biometrics_bypass

(4/n)
3. Now, give the wrong "biometric", the application says it is wrong, now simply click on "Cancel" to observe that the biometrics are bypassed.

# How this works:
- LAContext is a class that is responsible for the local authentication.

(5/n)
In this, there is an evaluatePolicy method that is responsible to present a dialog and authenticate the user. When the command mentioned in "Step-2" is executed, the objection creates a hook on "-[LAContext evaluatePolicy:localizedReason:reply:]"

(n/n)
and manipulates the boolean value from "False" to "True".

A detailed explanation can be found here: github.com/sensepost/obje…

#AppSec #infosecurity #bugbountytips #mobilepentesting #iospentesting