Objective-C : Third-party keyboard extensions usage

The application allows third-party keyboard extensions to be installed. The leakage of confidential data is possible.

Keyboard extensions are allowed to read each keystroke made by the user. Third-party keyboards are usually used to facilitate text entry or add additional emojis and they may log what the user enters or even sends to the remote server for processing. Malicious keyboards can be used to act as a keylogger and read each user-entered key to steal confidential data, such as credentials or credit card numbers.

Insecure Data Storage vulnerabilities take the second place in the “OWASP Top 10 2016” mobile application vulnerabilities ranking.