iOS Screen Caching Security Vulnerability

iOS takes screenshot of current screen opened when app is going background and uses that screenshot for animation while the app is coming to foreground.  So that user will have a nice experience whenever app goes to background and comes to foreground. This may be a security issue if the screen opened is displaying any sensitive data. It is application developer's responsibility to prevent the background screen caching of this sensitive information.

If it's a web application, you might have observed in some websites where they display any sensitive information by masking it as shown below.

      Credit card number    XXXX XXXX XXXX 1234

      Mobile number           XXXXXXX812

In the same way we need to prevent the background screen caching in our application. We an also mask the sensitive data while displaying in UILabels. This masking has to done for each and every label in all the views which displays sensitive data. As this is bit tedious to take care of all the labels in the application, We can mask the entire app window while it is going to background and remove that mask when the app is coming to foreground.

Let me show you how I prevented this screen caching in one of my iOS applications. 

I am taking an UIImageView with a black background color and added it to the application window in AppDelegate's applicationWillResignActive method.

        screenCacheImageView = [[UIImageView alloc]initWithFrame:
                                                                                    [self.window frame]];

        [screenCacheImageView setTintColor:[UIColor blackColor]];

        [screenCacheImageView setBackgroundColor:[UIColor blackColor]];

        [self.window addSubview:screenCacheImageView];

And in the applicationDidBecomeActive method, remove the added black image view mask to prevent background screen caching for the whole application.

      

        if(screenCacheImageView != nil) {

              [screenCacheImageView removeFromSuperview];

              screenCacheImageView = nil;

        }

Hope this post is useful. Feel free to comment incase of any queries.