mobile-insecure-storage

Mobile Insecure Data Storage

What Is Broken and Why

Mobile apps often store sensitive data (credentials, tokens, PII, keys) in locations accessible to other apps, backups, or physical device extraction. Android's SharedPreferences and iOS's NSUserDefaults are plaintext XML/plist files readable with root/jailbreak. External storage is world-readable. Backups (ADB/iCloud) can expose the entire app sandbox unless explicitly excluded. Logging APIs persist sensitive data in system logs readable by other apps. The attacker gains access to credentials or session tokens without ever touching the backend.

Key Signals

• allowBackup="true" in AndroidManifest.xml without fullBackupContent exclusion rules
• SharedPreferences files in /data/data/<pkg>/shared_prefs/ containing tokens, passwords, or keys
• SQLite databases in the app sandbox without SQLCipher encryption
• Files in /sdcard/ or getExternalStorageDirectory() containing sensitive content
• iOS files lacking NSFileProtectionComplete data protection class
• Keychain items with kSecAttrAccessibleAlways or no accessibility constraints
• Log statements (Log.d, NSLog, print) containing session tokens or user data
• Input fields without inputType="textPassword" or secureTextEntry=true
• App switcher screenshots capturing password or payment screens

Methodology

Android:

1. Decompile APK: apktool d app.apk — review AndroidManifest.xml for allowBackup, fullBackupContent
2. Pull sandbox via ADB: adb backup -f backup.ab -noapk <pkg> → extract with android-backup-extractor
3. Inspect /data/data/<pkg>/ (rooted): shared_prefs/, databases/, files/
4. Check SharedPreferences XML for plaintext credentials or tokens
5. Open SQLite databases: sqlite3 app.db .dump — look for unencrypted sensitive tables
6. Search for external storage usage: grep -r "getExternalStorage" in decompiled source
7. Check for sensitive log output: adb logcat | grep -i "password\|token\|secret\|key"
8. Use objection: android hooking list activities → android clipboard monitor