Skip to main content

Inter-Process Communication

Apps on iOS do not share a filesystem, but they still talk to each other and to the system. The mechanisms they use are the seams where cross-app attacks happen. Insecure IPC is a first-class bug class on iOS.

URL Schemes​

An app registers custom URL schemes in Info.plist:

<key>CFBundleURLTypes</key>
<array>
  <dict>
    <key>CFBundleURLSchemes</key>
    <array><string>myapp</string></array>
  </dict>
</array>
  • Another app (or Safari, or an SMS) opens myapp://path?params.
  • The target app receives the URL in application(_:open:options:) (or scene(_:openURLContexts:)).

Abuse: if the app trusts the URL's parameters without validation, any other app can invoke privileged functionality, this is callback/openURL hijacking. Also, unregistered apps can squat on a scheme you expect to be yours. Test every parameter an app accepts via its scheme.

  • Associated Domains (com.apple.developer.associated-domains entitlement) map https://yourdomain.com/... to your app.
  • iOS checks a server-side apple-app-site-association (AASA) file before routing to the app.
  • HTTPS-only, so they are generally harder to spoof than custom schemes.

Abuse: if the AASA file is misconfigured or the associated domain is registered on a domain you control, you can redirect users into the app with crafted links.

XPC Services​

  • XPC is Apple's IPC framework (Mach messaging + a higher-level API, NSXPCConnection).
  • System daemons expose XPC interfaces; apps can embed XPC services (separate processes) for privilege separation.
  • XPC messages are serialized; the receiving side is a parser, and malformed messages have caused countless daemon vulnerabilities.

Abuse: an XPC service with weak authorization checks lets a sandboxed app drive a privileged daemon to do things it could not do itself. Check whether the XPC interface validates the caller and the message payload.

Distributed Notifications​

  • CFNotificationCenter distributed notifications broadcast across processes by name (e.g. com.apple.myservice.changed).
  • Unlike local notifications, they are observable and forgeable by any process that knows the name.

Abuse: inject forged notifications to flip app state, trigger sync, or change configuration in another app. Names are often guessable or leakable.

App Groups​

  • A container shared by apps with the same group.<team-id>.<name> (declared in the com.apple.security.application-groups entitlement).
  • Provides a shared directory plus shared NSUserDefaults.

Abuse: this is designed as a trust boundary. A malicious app in the same group (or one that can guess the group ID) reads and writes the shared container. Misconfigured group membership (sharing secrets through group defaults) is a common, reportable finding.

Distributed notifications vs. Mach ports​

At the lowest level everything is Mach ports. Tools like MachPort dumping (on jailbroken devices, launchctl and lldb introspection) let you enumerate the services a process exposes. If a daemon exposes a wide-open Mach port, that is a direct cross-process attack surface.

Pentest checklist​

  • Enumerate all URL schemes and fuzz the parameters the app parses.
  • Check associated-domains and the AASA endpoints for misconfigurations.
  • Identify embedded XPC services and daemon XPC interfaces; look for missing caller/message validation.
  • Search for CFNotificationCenter usage and guess/observe notification names.
  • Inspect application-groups entitlements and test group-container trust between apps.