Apple DeviceCheck and AppAttest Limitations

Here are some notes for an episode of the Upwardly Mobile podcast about Apple App Attest and Device Check: What are Apple App Attest and Device Check? ● DeviceCheck is an iOS framework introduced in iOS 11.1 It allows developers to set and query two binary flags per device, helping them track information like whether a user has claimed a free offer.23 ● App Attest, added to DeviceCheck in iOS 14, verifies that an app is genuine and untampered.4 It uses cryptographic keys generated on the device and verified by Apple.3 How do they work? ● DeviceCheck generates a unique token for each device, allowing developers to track basic information about the device.5 ● App Attest uses a challenge-response system. The server sends a challenge to the app, which generates a cryptographic key pair.6 A hash of the challenge and key identifier is sent to Apple for verification.6 What are the limitations? ● iOS only: These solutions only work with iOS devices.789 ● Not all iOS devices are covered: App Attest is not compatible with all devices or most app extensions.10 ● Potential for circumvention: Sophisticated attackers could potentially bypass these checks.11 ● Limited client integrity checks: App Attest only verifies the app's integrity, not the device's.11 It doesn't detect jailbroken devices or runtime manipulation.1112 ● Limited analytics: App Attest provides minimal usage data.13 ● Implementation challenges: App Attest can be difficult to implement.14 ● No API secret protection: App Attest doesn't prevent API secrets from being stolen.15 ● Doesn't prevent MitM attacks: App Attest doesn't stop Man-in-the-Middle attacks.16 ● Performance and rate limits: Apple may throttle requests, impacting app performance.17 ● Reliance on Apple's servers: App Attest relies on Apple's servers, which can experience downtime.18 ● Privacy concerns: Some users have concerns about Apple storing device data.18 Why are these limitations important for developers? ● Developers need to be aware of the limitations to make informed decisions about their app's security.19 ● Relying solely on these tools could leave apps vulnerable to sophisticated attacks.20 ● Developers should consider implementing additional security measures, like those offered by Approov, to enhance protection.821222324 Approov and Apple App Attest/Device Check ● Approov can complement Apple's solutions, mitigating some of their limitations.25 ● It provides comprehensive mobile app security that works across platforms, including iOS and Android.21 Key takeaways for the episode: ● Apple App Attest and Device Check offer basic app and device attestation capabilities. ● However, they have limitations that developers should be aware of. ● To achieve robust mobile app security, developers should consider additional measures, such as Approov, to complement Apple's solutions. This content was created in partnership and with the help of Artificial Intelligence AI.