Fix authorization bypass leading to access private information

[aurelticot]

Vulnerability:

Authorization Bypass Leads To Access Private Information | IOS APP

IOS App:

https://apps.apple.com/us/app/verida-wallet/id1546599632

Description:

Keychain is an encrypted container to store passwords for multiple applications and secure services. Apple uses a keychain as the password management system in iOS.
During local authentication, an app authenticates the user against credentials stored locally on the device. In other words, the user "unlocks" the app or some inner layer of functionality by providing a valid PIN, password, or biometric characteristics such as face or fingerprint, which is verified by referencing local data. Generally, this is done so that users can more conveniently resume an existing session with a remote service or as a means of step-up authentication to protect some critical function.

Impact:

I can see no verification needed in any area. But when navigating to any private info container like keychain there is no prompt to TouchID to Access info, they directly show information without any authentication.

Fix:

1. First validate with TouchID or pin to authorize access to private info.
2. Add an authentication layer to protect user details.
3. Prompt TouchID first, then show sensitive details in the keychain.

Reference:

https://developer.apple.com/documentation/localauthentication/accessing_keychain_items_with_face_id_or_touch_id

[aurelticot]

Summary: it's possible to display sensitive information without checking authorisation (PIN/Bio)

Probably refers to the Seed phrase which has several no-homogeneous screens in the app. (in some case, the PIN is requested)

Applicable to both Android and iOS.

[aurelticot]

Also, we still don't check for the app state change, so the app can stay in the background for hours, when the user goes back to it, no authentication is requested.

We should listen to app state change and if in the background for more than xx seconds, lock the app and request the PIN/Bio again.

[aurelticot]

There are a few things at play here:

• The PIN/Bio library we use. Do we want to keep it? Is it still maintained? Do we have enough flexibility in the UI?
• The overall flow of when PIN/Bio is requested, in term of screens and navigation between them
• The current non-separation of PIN/Bio authentication and identity connection. We need to split them, so that we can control the PIN/Bio more accurately and fix the flow mentioned above