MITM attack reported on deprecated NSURLConnectionDelegate

Question

I have an Objective-C project whose .ipa was tested with this tool online: https://www.immuniweb.com/mobile

It reports that my app has a high risk security issue, pointing to the canAuthenticateAgainstProtectionSpace in the NSURLConnectionDelegate protocol.

This method has been deprecated by iOS after 8.0 version. My app is not using it directly anywhere and I suppose this is not used by apple also even indirectly, since it is deprecated.

I tried a sample ipa (new project with nothing in it) with Objective-C project and the same issue came for that as well. But it did not come for a sample ipa which supported Swift. Even if this is just a warning, is there a way to fix other than just supporting Swift language only?

Fionafionna

Answer 1

The tool has detected that the .h file that defines the NSURLConnectionDelegate protocol declares the canAuthenticateAgainstProtectionSpace function. This is, of course, to be expected.

It would make more sense for the tool to report implementations of the method, not simply declarations of it

Since you haven’t implemented this method you don’t need to worry about flaws in your implementation.

As for getting rid of the issue...Don’t use the tool? It doesn’t seem very good based on this.

Is there an option to tell it not to scan .h files?

Noctambulous

No there is no option to leave .h files. This tool even displays what apps were tested previously on their portal and I see for every iOS app it is reporting the same. We don't use this tool anyway, its more of a client side QA testing. – Fionafionna

Answer 2

TBH it seems like a bug in the tool if not any of your Libraries or Frameworks internally uses that.

In your test for the sample Objective C project it's reported as bug however for a sample swift project it's not reported Hence I guess it's more of bug from the tool side.

I would suggest you to report this issue to them.Hopefully they will get you back with some suggestions.

or

you can try some other pen-testing tools as well.

Pashalik

Yes, it reports the same high risk warning for every iOS app (you can see what apps were tested with their report online). – Fionafionna

Evidently it's a bug so if I were you I would ignore this bug or send the QA team about my POC and findings and I would not worry much about it. – Pashalik

Can you suggest some other tools which you might have used or which have some reputed test cases and might leave this deprecated declaration out. – Fionafionna