Mobile › Module 6 › Lesson 2
App Store Sandbox
App Store and sandbox literacy — review pipeline, code signing, container isolation on $MOB_LAB defender reading.
Visual · t27_app_store_sandbox
App Store + sandbox = distribution and isolation. $MOB_LAB. Original Cyberlium.
Opening
The App Store gate and per-app sandbox are iOS's first blue-team walls — name them before you assess any lab app.
App Store sandbox literacy covers: Apple review pipeline (malware/policy screening at category level), notarization and code signing requirements, app-specific container directories, IPC via XPC with entitlement checks, no arbitrary filesystem access without entitlement. Defenders map findings to 'escaped sandbox' vs 'misused entitled API.' Cyberlium on $MOB_LAB intentional apps (DVIA, MSTG samples) — read sandbox boundaries in reports, trace container paths in YOUR lab — NOT sideloading pirated IPAs on stranger phones, NOT distributing enterprise profiles without authorization, NOT 'test' malware on App Store production without vendor scope. Lab row: sandbox container fields (Documents, Library, tmp) with data-class note and one MASVS storage control stub.
1. Distribution gates
App Store review, code signing, AMFI — named gates that reduce unsigned code on stock devices.
Enterprise/ad-hoc distribution has separate trust models — literacy for MDM Module 8.
Command guide
Try these commands — Distribution gates
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
App Store review — https://developer.apple.com/app-store/review/guidelines/ (distribution security) Apple sandbox — https://support.apple.com/guide/security/about-the-security-of-apps-and-the-app-store-sec978498e4/web OWASP MASTG iOS — https://mas.owasp.org/MASTG/0x06b-iOS-Platform-Overview/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export MOB_LAB=${MOB_LAB:-$HOME/cyberlium-lab/t27-mob}
cat > "$MOB_LAB/notes/ios-sandbox.txt" <<'EOF'
App Store: signed IPA distribution + notarization/review pipeline
sandbox: app container + entitlements gate capabilities
enterprise: MDM-managed devices — separate authorized track
never: sideload pirated IPAs or bypass stranger device locks
EOFCommand — copy this
grep -E 'sandbox|never|MDM' "$MOB_LAB/notes/ios-sandbox.txt" curl -sS https://developer.apple.com/app-store/review/guidelines/ | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: App Store review (https://developer.apple.com/app-store/review/guidelines/); Apple sandbox (https://support.apple.com/guide/security/about-the-security-of-apps-and-the-app-store-sec978498e4/web); OWASP MASTG iOS (https://mas.owasp.org/MASTG/0x06b-iOS-Platform-Overview/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Sandbox containers
Per-app container: Documents, Library, tmp — no cross-app read without shared group entitlement.
Sensitive data in tmp without encryption = common $MOB_LAB finding row.
3. Scope refuse
No sideload attacks on devices you do not own; no bypassing review to ship malware.
Sandbox literacy supports defender hardening — not unauthorized App Store fraud.
4. What you ship: sandbox literacy card
Three distribution gates + container paths + one storage finding row + scope line.
5. What you record before the next lesson
Sandbox literacy card path.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Sideload cracked IPA on roommate iPhone to 'study sandbox.'
Right
Sandbox literacy card from $MOB_LAB app review. Next: Jailbreak Named.
Mission: sandbox literacy card
1) Name three distribution gates. 2) List container subpaths. 3) One storage finding row. 4) Write NEVER unauthorized sideload line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Shared Keychain group — sandbox impact?”
Knowledge Check
APPLY: App sandbox limits:
Multiple choice
Knowledge Check
APPLY: True or False: Sideload on stranger phone is lab.
True or False
Knowledge Check
APPLY: Code signing enforced by:
Multiple choice