-
-
Notifications
You must be signed in to change notification settings - Fork 2.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add codesign/ldid to the test Determining Whether the App is Debuggable (MSTG-CODE-2) #2296
Add codesign/ldid to the test Determining Whether the App is Debuggable (MSTG-CODE-2) #2296
Conversation
As I am not a native English speaker, it would be great if you could tell me if I have made any mistakes in English grammar or something. |
Thank you very much for taking the time to open this PR @sohsatoh! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @sohsatoh, thanks for including this. This is exactly what this test case needed!
Could you please also apply the following changes? This way we keep the mitigation part in the overview and the static analysis will only contain what you've added (using codesign and using ldid).
## Determining Whether the App is Debuggable (MSTG-CODE-2)
### Overview
To test if the app is [debuggable](0x06c-Reverse-Engineering-and-Tampering.md#debugging) you need to inspect the app entitlements and check if the value of [`get-task-allow`](https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues, "Resolving common notarization issues") key is set to `true`.
While debugging is a useful feature when developing an app, it has to be turned off before releasing apps to the App Store or within an enterprise program. To do that you need to determine the mode in which your app is to be generated to check the flags in the environment:
- Select the build settings of the project
- Under 'Apple LVM - Preprocessing' and 'Preprocessor Macros', make sure 'DEBUG' or 'DEBUG_MODE' is not selected (Objective-C)
- Make sure that the "Debug executable" option is not selected.
- Or in the 'Swift Compiler - Custom Flags' section / 'Other Swift Flags', make sure the '-D DEBUG' entry does not exist.
### Static Analysis
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks a lot @sohsatoh!
Thank you for submitting a Pull Request to the OWASP MASTG. Please make sure that:
If your PR is related to an issue. Please end your PR test with the following line:
This PR closes #2295