Overview

The Network framework operates entirely outside of ATS. Apps using NWConnection with NWProtocolTLS.Options can configure TLS settings directly via the Security framework, including minimum and maximum supported TLS versions through sec_protocol_options_set_min_tls_protocol_version) and sec_protocol_options_set_max_tls_protocol_version).

Since ATS does not apply to Network.framework connections, any weak TLS configuration here is not mitigated by ATS. Setting a minimum TLS version below 1.2 creates the risk of connection downgrade attacks without any ATS-level safety net. Apple's documentation notes that "ATS doesn't apply to calls your app makes to lower-level networking interfaces like the Network framework or CFNetwork. In these cases, you take responsibility for ensuring the security of the connection." See Preventing Insecure Network Connections.

For more information on iOS network APIs and when ATS applies, see MASTG-KNOW-0071 and MASTG-KNOW-0073.

Steps

  1. Use MASTG-TECH-0058 to extract the relevant binaries from app package.
  2. Use MASTG-TECH-0066 to look for the relevant APIs in the app binaries.

Observation

The output should contain any calls to TLS protocol version configuration functions in the Network.framework, if found.

Evaluation

The test case fails if the app calls:

Further Validation Required:

Inspect each reported code location using MASTG-TECH-0076 to determine the TLS version values passed to those functions.

Because Network.framework operates entirely outside of ATS, a connection configured this way will succeed against a server that supports the deprecated TLS version, bypassing ATS.

Powiązane zgłoszenia

Powiązania
is related to MASTG-BEST-0043 Enforce Strong TLS Settings When ATS Doesn't Apply (iOS)