Adversaries may collect keychain data from an iOS device to acquire credentials. Keychains are the built-in way for iOS to keep track of users' passwords and credentials for many services and features such as Wi-Fi passwords, websites, secure notes, certificates, private keys, and VPN credentials.
On the device, the keychain database is stored outside of application sandboxes to prevent unauthorized access to the raw data. Standard iOS APIs allow applications access to their own keychain contained within the database. By utilizing a privilege escalation exploit or existing root access, adversaries can access the entire encrypted database.[1][2]
| ID | Name | Description |
|---|---|---|
| S0463 | INSOMNIA | |
| S1185 | LightSpy |
LightSpy has accessed the device’s KeyChain data.[4][5][6][7] |
| C0054 | Operation Triangulation |
During Operation Triangulation, the threat actors have dumped the device’s keychain.[8][9] |
| S1216 | TriangleDB |
TriangleDB has extracted the device’s keychain.[8] |
| ID | Mitigation | Description |
|---|---|---|
| M1002 | Attestation |
Device attestation can often detect jailbroken devices. |
| M1010 | Deploy Compromised Device Detection Method |
Mobile security products can take appropriate action when jailbroken devices are detected, potentially limiting the adversary’s access to password stores. |
| M1001 | Security Updates |
Apple regularly provides security updates for known OS vulnerabilities. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0664 | Detection of Keychain | AN1757 |
For iOS, detect Keychain by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |