Overview

On iOS, apps implementing enforced updating typically read the app version, for example CFBundleShortVersionString via Bundle.main.infoDictionary, and send it to a backend that returns a minimum version policy. Apps may also read CFBundleVersion when the backend policy is based on build numbers. Alternatively, they may query the App Store using the iTunes Search API, for example https://itunes.apple.com/lookup?bundleId=<bundleId> or https://itunes.apple.com/lookup?id=<appId>, with an optional country parameter, to compare results[0].version against the installed CFBundleShortVersionString. If an update is required, the app should block usage and redirect to the App Store via UIApplication.shared.open, typically using results[0].trackViewUrl, or by presenting a SKStoreProductViewController. If the app does not perform these checks or if the enforcement can be bypassed, the app fails to properly enforce the update.

This test checks whether the app triggers the expected update enforcement behavior at runtime by capturing version-related network traffic where applicable and hooking update-related API calls (MASTG-KNOW-0074).

Steps

  1. Use MASTG-TECH-0056 to install the app.
  2. Use MASTG-TECH-0062 to capture the app traffic.
  3. Use MASTG-TECH-0095 to hook the relevant APIs.
  4. Exercise the app extensively to trigger as many flows as possible and enter sensitive data wherever you can.

Observation

The output should contain:

Evaluation

The test case fails if the app does not perform a runtime update check, or if the update is not enforced at runtime.

Further Validation Required:

Using the backtraces from the hook output, inspect the code locations using MASTG-TECH-0076: