> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/ios-appsec/static-analysis/common-issues/plist-files.md).

# plist files

### Insecure Transport Layer — App Transport Security (ATS)

App Transport Security (ATS) is Apple’s system (since iOS 9) that enforces secure network connections from apps. By default, ATS requires TLS 1.2+ (and good ciphers / forward secrecy) for outbound connections. If an app `Info.plist` disables ATS globally (for example: `NSAppTransportSecurity` → `NSAllowsArbitraryLoads = true` the app can make insecure HTTP or weak-TLS connections — increasing the risk of man-in-the-middle (MITM) attacks.

#### How to check.

From inside the extracted `.app` directory:

* Print a readable form of `Info.plist`: (Use vscode for linux)

  ```bash
  plutil -p Info.plist
  ```
* Example output you might see (bad):

  ```xml
  <key>NSAppTransportSecurity</key>
  <dict>
    <key>NSAllowsArbitraryLoads</key>
    <true/> 
  </dict>
  ```

  Note

  ```
    <key>NSAllowsArbitraryLoads</key>
    <true/> 
  ```

***