PTKDMobile App Security
Knowledge base / PTKD-IOS-KEYCHAIN-ACCESSIBLE
medium M9 MASVS-STORAGE-2 static analysis PTKD-IOS-KEYCHAIN-ACCESSIBLE

Keychain item accessible while locked

A Keychain item uses kSecAttrAccessibleAlways (or …AlwaysThisDeviceOnly), so it is readable even when the device is locked — including from a backup or a lost/stolen locked device.

How it's exploited

A Keychain item is stored with kSecAttrAccessibleAlways, so it stays readable even while the device is locked. An attacker with a lost or stolen locked device, or an unencrypted backup, extracts the secret without ever unlocking the phone.

Why it matters

Tokens and credentials meant to be protected by the lock screen are recoverable from a locked or backed-up device.

How to fix it

  1. Use kSecAttrAccessibleWhenUnlockedThisDeviceOnly for secrets that only need foreground access.
  2. Use kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly only when a background task genuinely needs the item; kSecAttrAccessibleAlways is deprecated.

References