Local authentication bypass
Local authentication bypass involves bypassing authentication, either because it's not implemented, through instrumentation by using a instrumentation tool like Frida to trick the app into exposing credentials or believing that authentication has happened, or by forcing the app to throw an error that leaves the app unlocked.
Example
The Norton App Lock prior to version 1.3.0.13 was susceptible to an authentication bypass exploit (CVE-2017-15534). The exploit allowed a user to kill the app to prevent it from locking the device, thereby allowing the individual to gain device access.
Links
- CVE-2017-15534 - The Norton App Lock exploit
- CAPEC-115: Authentication Bypass
- CWE-306: Missing Authentication for Critical Function
- CWE-287: Improper Authentication
- CWE-288: Authentication Bypass Using an Alternate Path or Channel
- MASWE-0018
- MASVS: Android Local Authentication
- MASVS: IOS Local Authentication
- OWASP Mobile Top 10, M3: Insecure Authentication/Authorization
- OWASP Cheat Sheet Series: Mobile Application Security Cheat Sheet - Authentication & Authorization
- Apple: Local authentication
- Android: Local authentication
