How much of a security risk would the apps on my iPhone pose if I did my banking on iPhone?

Question

I have a bunch of different apps on my iPhone 7 (iOS v.12.4.1). Some of these are made by large companies such as Amazon, McDonalds, and so on. There are also some that have been made by perhaps a single developer. Some of my apps are quite well known in the Apple App Store while others, not so much (judging from very few reviews).

With this question I wanted to ask about what security risks these apps would pose on my banking sessions if I were to do my banking (using the app from my bank) on the iPhone.

For example, many of the apps (but not all) have a "Background App Refresh" toggle switch like what is shown below.

And then there is the possibility to have more than one app running simultaneously, and switch between them using the App Switcher. Like what is shown in below screen shot.

And some apps, such as a VPN app named Freedome (made by F-Secure), are apparently able to run completely in the background, without a visible UI.

So while there is some possibility for background processing, I was thinking that one app cannot have much of any effect on another (or on the banking sessions made from iPhone) because they are in some sense isolated from each other.

But in order to confirm that, here's my questions.

How much damage could some app XYZ cause on the banking sessions I do on my banks app in below cases:

1. If the XYZ app has "Background App Refresh" enabled?
2. If "Background App Refresh" is not enabled but I have it running while I am using my banking app?

Answer 1

iOS does indeed sandbox apps from one another. Unless some of your installed apps had special exceptions to the usual list of permitted capabilities (permissions), they cannot read or write any files in your banking app, nor can they interfere with its execution in any way.

With that said, there are a few exceptions to be aware of:

• Custom keyboards could potentially capture sensitive data. I don't know what the state of third-party keyboards currently is on iOS, but on Android it's been a concern for some time. Apps should be able to force the user to use the standard keyboard for sensitive content (credentials, etc.).
• Local network connections (typically using loopback / 127.0.0.1) are not secure. An app that talks to itself or to another trusted app over the network this way could potentially be attacked at either end by a malicious app running at the same time (that is, the malicious app could launch its own server on the same port and try to get the victim to talk to it, or could make requests from its own client to the legitimate server and try to compromise the process or extract information from it). The insecurity of this design pattern has been known for years, and there are well-known superior options for most use cases, but people insist on doing this anyhow (partially because it's one of the only ways for a web page in the browser app to establish bi-directional communication with a store app). Hopefully your bank isn't doing anything like this - or if it is, it's hardened the channel very carefully - but it it's a risk.
• Apps that use root privileges on jailbroken devices, or that use the kind of privilege-escalation bugs used for jailbreaking, are able to ignore their sandbox and interact with any processes or files on the device. In this way, they're more like a local app running as Admin/root on a PC. Obviously, if such an app is malicious or compromised, there's nothing you can do safely on that device.

Apple does perform a security review of every app before they approve it for the store. This review process has known holes - even manual line-by-line review wouldn't necessarily catch everything, and Apple can't afford that kind of effort so it relies heavily on automated tools that can be tricked - but for the most part there's extremely little malware in the iOS App Store.

Answer 2

If someone installed a monitoring app on your phone such as the Chinese spyware Spyzie it could obviously grab your banking data because it is a key logger. You can use something like the little snitch app to see how your apps communicate with servers. This could help you verify what app is transmitting data including spy a spy app that is designed to be hidden.