IOS Capture Prevention Capture Prevention

Question

I have an application that opens from another application through a URL scheme. URL contains tokens for subscription. Since any application can register the same URL scheme as my application, I am worried that a “fake” application may attack a “person in the middle” and capture registration tokens.

My idea is to verify that the URL scheme does not open another application when my application is open.

From a security point of view, if the URL scheme opens my application for the first time, will it always open my application in the future?

Answer 1

How about using iOS 9 universal links?

Unlike custom URL schemes, universal links cannot be approved by other applications because they use standard HTTP or HTTPS links to your site.

https://developer.apple.com/library/prerelease/ios/documentation/General/Conceptual/AppSearch/UniversalLinks.html

Thus, the "distribution table" is located on your server, so no other application can capture the registration URL. (Submit URL based on AppID)

Answer 2

This is a valid (and usually ignored) attack vector. This is not strictly a man-in-the-middle attack, as it will not redirect the URL to your application (it cannot). This is almost worse, because an attacking application can actually crash, and it looks like your application ...

Another application can be installed at any time when your application is in the background. It is technically possible that an update has been released and installed for an existing application while your application is running (it’s hard to know if this will happen). Thus, it is not safe to check only when your application is open.