Weak Biometric Authentication

import LocalAuthentication

class BiometricAuthManager {
    // VULNERABLE: Boolean-based authentication can be bypassed
    func authenticateUser_vulnerable(completion: @escaping (Bool) -> Void) {
        let context = LAContext()  // WEAK! Creates bypassable auth context
        var error: NSError?

        // Check if biometric authentication is available
        guard context.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &error) else {
            print("Biometric authentication not available")
            completion(false)
            return
        }

        // VULNERABLE: evaluatePolicy returns a boolean that can be hooked
        context.evaluatePolicy(
            .deviceOwnerAuthenticationWithBiometrics,
            localizedReason: "Authenticate to access your account"
        ) { success, error in
            if success {
                // Attacker can force 'success' to true using Frida!
                print("✅ Authentication successful")
                completion(true)
            } else {
                print("❌ Authentication failed: \(error?.localizedDescription ?? "Unknown error")")
                completion(false)
            }
        }
    }

    // VULNERABLE: Using boolean result to gate access to sensitive operations
    func accessSensitiveData_vulnerable() {
        authenticateUser_vulnerable { authenticated in
            if authenticated {
                // WEAK! This check can be bypassed
                self.loadSensitiveUserData()
                self.displayAccountBalance()
            } else {
                print("Access denied")
            }
        }
    }

    private func loadSensitiveUserData() {
        // Load sensitive data...
    }

    private func displayAccountBalance() {
        // Display financial information...
    }
}

// VULNERABLE: Simple boolean check for authentication
class LoginViewController {
    let authManager = BiometricAuthManager()

    func loginWithBiometrics_vulnerable() {
        authManager.authenticateUser_vulnerable { success in
            if success {
                // WEAK! Attacker can bypass this by hooking evaluatePolicy
                self.transitionToHomeScreen()
            } else {
                self.showErrorAlert()
            }
        }
    }

    private func transitionToHomeScreen() {
        // Navigate to authenticated area...
    }

    private func showErrorAlert() {
        // Show error message...
    }
}

import Security
import LocalAuthentication

enum KeychainError: Error {
    case accessControlCreationFailed
    case keyGenerationFailed
    case dataRetrievalFailed
    case authenticationRequired
}

class SecureBiometricAuth {
    // SECURE: Store encryption key in Keychain with biometric ACL
    func createBiometricProtectedKey() throws {
        // Create access control with biometric requirement
        guard let accessControl = SecAccessControlCreateWithFlags(
            kCFAllocatorDefault,
            kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
            .biometryCurrentSet,  // Secure Enclave enforces this
            nil
        ) else {
            throw KeychainError.accessControlCreationFailed
        }

        let privateKeyAttrs: [String: Any] = [
            kSecAttrIsPermanent as String: true,
            kSecAttrApplicationTag as String: "com.example.authkey".data(using: .utf8)!,
            kSecAttrAccessControl as String: accessControl
        ]

        let attributes: [String: Any] = [
            kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
            kSecAttrKeySizeInBits as String: 256,
            kSecPrivateKeyAttrs as String: privateKeyAttrs
        ]

        var error: Unmanaged<CFError>?
        guard let privateKey = SecKeyCreateRandomKey(attributes as CFDictionary, &error) else {
            throw KeychainError.keyGenerationFailed
        }

        print("✅ Biometric-protected key created in Secure Enclave")
        print("   • Authentication enforced by hardware, not app code")
        print("   • Cannot be bypassed by Frida or similar tools")
    }

    // SECURE: Access to key automatically requires biometric authentication
    func accessProtectedKey() throws -> SecKey {
        let query: [String: Any] = [
            kSecClass as String: kSecClassKey,
            kSecAttrApplicationTag as String: "com.example.authkey".data(using: .utf8)!,
            kSecReturnRef as String: true
        ]

        var item: CFTypeRef?
        let status = SecItemCopyMatching(query as CFDictionary, &item)

        guard status == errSecSuccess else {
            if status == errSecInteractionNotAllowed {
                // Biometric authentication required but not provided
                throw KeychainError.authenticationRequired
            }
            throw KeychainError.dataRetrievalFailed
        }

        guard let key = item else {
            throw KeychainError.dataRetrievalFailed
        }

        print("✅ Key accessed - Secure Enclave verified biometric authentication")
        return (key as! SecKey)
    }

    // SECURE: Store sensitive data with biometric protection
    func storeSensitiveData(data: Data) throws {
        guard let accessControl = SecAccessControlCreateWithFlags(
            kCFAllocatorDefault,
            kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
            .biometryCurrentSet,
            nil
        ) else {
            throw KeychainError.accessControlCreationFailed
        }

        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: "sensitive_data",
            kSecValueData as String: data,
            kSecAttrAccessControl as String: accessControl
        ]

        // Delete existing item
        SecItemDelete(query as CFDictionary)

        let status = SecItemAdd(query as CFDictionary, nil)
        guard status == errSecSuccess else {
            throw KeychainError.accessControlCreationFailed
        }

        print("✅ Sensitive data stored with biometric protection")
    }

    // SECURE: Retrieve sensitive data (biometric auth enforced by Secure Enclave)
    func retrieveSensitiveData() throws -> Data {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: "sensitive_data",
            kSecReturnData as String: true
        ]

        var item: CFTypeRef?
        let status = SecItemCopyMatching(query as CFDictionary, &item)

        guard status == errSecSuccess else {
            if status == errSecInteractionNotAllowed {
                throw KeychainError.authenticationRequired
            }
            throw KeychainError.dataRetrievalFailed
        }

        guard let data = item as? Data else {
            throw KeychainError.dataRetrievalFailed
        }

        print("✅ Data retrieved after Secure Enclave verified authentication")
        return data
    }
}

class LAContextWithWarning {
    // ACCEPTABLE but WEAKER: Using LAContext with explicit UI
    // NOTE: This is still vulnerable to Frida bypass!
    func authenticateForExplicitAction() {
        let context = LAContext()
        context.localizedReason = "Authenticate to delete your account"

        var error: NSError?
        guard context.canEvaluatePolicy(
            .deviceOwnerAuthenticationWithBiometrics,
            error: &error
        ) else {
            print("Biometrics not available")
            return
        }

        // This boolean can still be bypassed by Frida
        context.evaluatePolicy(
            .deviceOwnerAuthenticationWithBiometrics,
            localizedReason: "Confirm account deletion"
        ) { success, error in
            if success {
                // ⚠️ WARNING: Still bypassable!
                // For critical operations, use Keychain + biometric ACL instead
                print("User authenticated for action")
            }
        }
    }
}

// App code
context.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics) { success, error in
    if success {
        self.showSensitiveData()  // Should require biometric
    }
}

// Frida script - attacker's device
Java.perform(function() {
    var LAContext = ObjC.classes.LAContext;

    Interceptor.attach(LAContext['- evaluatePolicy:localizedReason:reply:'].implementation, {
        onEnter: function(args) {
            console.log("[+] LAContext.evaluatePolicy called");
        },
        onLeave: function(retval) {
            console.log("[+] Forcing authentication to succeed");
            // Force the reply block to receive true
            // This bypasses ALL biometric checks
        }
    });
});

// With Keychain + biometric ACL
let key = try accessProtectedKey()  // Secure Enclave checks biometric

// OK: Convenience for auto-filling username
func autofillUsername() {
    let context = LAContext()
    context.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics,
                          localizedReason: "Autofill your username") { success, _ in
        if success {
            // OK: Just a convenience, not security-critical
            self.usernameField.text = self.savedUsername
        }
    }
}

// OK: Shortcut to user preferences
func quickAccessSettings() {
    let context = LAContext()
    context.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics,
                          localizedReason: "Quick access to settings") { success, _ in
        if success {
            // OK: Just a UX shortcut, settings aren't sensitive
            self.showSettingsScreen()
        }
    }
}