Distinguished Practical Paper Award at RAID 2026
The paper Supply Chain Insecurity: Exposing Vulnerabilities in iOS Dependency Management Systems, received the Distinguished Practical Paper Award at the International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2026) in Lancaster, UK.
The paper was led by first author David Schmidt, postdoctoral researcher at the University of Vienna, and co-authored by Gabriel Gegenhuber, postdoctoral researcher at IT:U, Edgar Weippl, research director of SBA Research and full professor and dean of the Faculty of Computer Science at the University of Vienna, and Sebastian Schrittwieser, key researcher at SBA Research and head of the CD-Lab AsTra.
© Caroline König, David Schmidt
Congratulations to all authors on this achievement!
Abstract
Dependency management systems are a critical component in software development, enabling the incorporation of existing functionality. However, misconfigurations and malicious actors in these systems pose security risks, leading to supply chain attacks. Despite the widespread use of smartphone apps, the security of dependency management systems in the iOS software supply chain has received limited attention. In this paper, we focus on CocoaPods, one of the most widely used dependency management systems for iOS app development, but also examine the security of Carthage and Swift Package Manager (SwiftPM).
We demonstrate that iOS apps expose internal dependency names and versions. Attackers can exploit this information to register previously unclaimed dependencies in CocoaPods, enabling remote code execution (RCE) on developer machines and build servers. Additionally, we show that attackers can compromise dependencies by reclaiming abandoned domains and GitHub URLs. Analyzing 9,491 real-world iOS applications, we find that a significant fraction is vulnerable to these attacks, putting millions of users at risk, including applications from major organizations for which we confirmed exploitation via responsible disclosure.
Finally, we compare iOS dependency management systems with Cargo, Go modules, npm, pip, and Maven, and discuss conceptual issues and practical mitigation strategies.
Authors: David Schmidt, Gabriel K. Gegenhuber, Edgar Weippl, and Sebastian Schrittwieser
About the conference
The International Symposium on Research in Attacks, Intrusions and Defenses (RAID) is an international scientific conference focused on cybersecurity. It brings together researchers and professionals from academia, industry, and government to present and discuss the latest research on cyberattacks, intrusion detection, malware, network security, and methods for protecting computer systems. The symposium provides an opportunity to exchange knowledge, share innovative ideas, and collaborate on solutions to emerging cybersecurity challenges.