Home / Vulnerability Database / Swift : Keyboard caching
Swift

Swift : Keyboard caching

Classification

OWASP Mobile Top 10 2014
OWASP Mobile Top 10 2016
CWE/SANS Top 25 2021

Overview

The identified text field does not disable the iOS keyboard caching mechanism, as a result any information recently entered from the keyboard will be cached in order to improve the autocorrect feature.

iOS caches input to text fields in order to improve the performance of the autocorrect feature and predictive typing. Any information entered into such a text field or other input control can be written to the keyboard cache file stored in the file system. Since this file is stored on the device, then if device is lost, you can restore it and reveal any confidential information contained in it.

Private data can enter a program in a variety of ways:

  • Directly from the user in the form of a password or personal information,
  • Accessed from a database,
  • From other database,
  • Indirectly from other fird party,
  • From the cloud storage (for instance, iCloud), including Address book, configuration files, archived messages, snapped photos and etc.

Generally, the overall risk is associated with inappropriate reliance on the operating environment in which the program runs. Storage of personal information in file systems, registries or other locally managed resources is unacceptable.

MEDIUM

DerScanner Severity Score

Do you want to fix Swift : Keyboard caching in your application?

See also

Swift

Swift : Nill password

Swift

Swift : Hardcoded salt

Swift

Swift : Undocumented feature: special account