iOS Swift penetration testing: Bypassing keychain and local controls

Akande Simpa Lead Security Engineer & Cofounder, Simpa Labs Comprehensive Security Partner (CSP)

Dumping decrypted iOS application IPA binaries

iOS applications distributed via the App Store are encrypted using Apple's FairPlay DRM. During an audit, we must decrypt the binary to inspect its structure. We run the app on a jailbroken iOS device and dump the decrypted memory space to reconstruct the Mach-O binary file using tools like frida-ios-dump or bfdecrypt:

# Run frida-ios-dump to decrypt and packaging the application as IPA
python3 dump.py com.fintech.iosapp -o app_decrypted.ipa
# Load the decrypted Mach-O binary into Hopper or Ghidra for analysis

Bypassing jailbreak detection and SSL pinning

Swift applications implement client-side checks to detect jailbroken devices and enforce SSL pinning (using libraries like TrustKit). We bypass these checks at runtime by intercepting calls to security APIs. Using Frida, we hook the system files checks (like checking for `/Applications/Cydia.app`) or class methods to force them to return clean states:

if (ObjC.available) {
  // Hook and bypass a custom Swift Jailbreak detector class
  const JailbreakDetector = ObjC.classes.JailbreakDetector;
  Interceptor.attach(JailbreakDetector["- isDeviceJailbroken"].implementation, {
    onLeave: function (retval) {
      console.log("[iOS Audit] Bypassing iOS jailbreak verification check.");
      retval.replace(ptr("0x0")); // Force return false
    }
  });
}

Extracting secrets from iOS Keychain storage

The iOS Keychain is the secure place to store persistent secrets. However, if the device is jailbroken, the Keychain is accessible. During a penetration test, we execute scripts that interface with the Security framework to dump all Keychain items associated with the application's access group:

# Connect via SSH to jailbroken iPhone and dump keychain entries
ssh root@192.168.1.50
cd /tmp
./keychain_dumper -a

The Fix: Bind highly sensitive operations to biometric credentials by setting the kSecAccessControlBiometryAny or kSecAccessControlBiometryCurrentSet flags on Keychain entries. This forces the Secure Enclave to verify biometric presence before releasing the secret token.

Insecure temp storage (Pasteboard and Snapshots)

We audit how the iOS application handles temporary data. Common findings include:

• Pasteboard Leakage: App failing to clear the general pasteboard after copying sensitive data (e.g., wallet recovery phrases), exposing it to other installed apps.
• Background Screen Snapshots: When an app goes to the background, iOS takes a snapshot of the screen. If sensitive transaction data or balances are visible, the snapshot is cached on disk. Developers must mask the screen before background transitions.

Set the Keychain rule for each secret

Choose an accessibility class from the action the secret supports. A background refresh token needs a different rule from a key that approves a payment. Use access control flags for user presence and hardware-backed keys when the action requires fresh biometric or passcode proof.

Keep the item service, account label, accessibility class, access-control flags, device state, extraction result, and server action. The iOS app test plan covers links, backups, logout, and the full data life cycle.

Related reading

Blog: iOS penetration testing · React Native pentesting guide · Hardcoded key leaks

Services: Mobile penetration testing · Secure architecture review