Back

M09: Insecure Data Storage - Overview

Table of Contents

What is Insecure Data Storage?

Insecure Data Storage occurs when mobile applications store sensitive data in an unprotected or inadequately protected manner on the device. This includes storing data in plain text in local databases, shared preferences, files, or other storage mechanisms that are accessible to attackers with physical device access or through malware.

Mobile applications frequently need to store various types of sensitive data:

Core Concept

Unlike server-side applications where data is stored in controlled environments, mobile apps store data on user devices that may be:

``

Mobile App Stores Data → Device Storage → Multiple Attack Vectors

↓

Unencrypted Local Storage → Device Compromise → Data Extracted

↓

Sensitive Data Exposed to Attacker

``

Key Vulnerability Points

  1. Insecure SharedPreferences/UserDefaults: Storing sensitive data in plain text preferences
  2. Unencrypted Databases: SQLite databases without encryption
  3. Plain Text Files: Writing sensitive data to unprotected files
  4. External Storage: Storing data on SD cards or shared storage
  5. Logs and Caches: Sensitive data persisting in logs or cache directories
  6. Keyboard Cache: Input data cached by keyboard applications
  7. Screenshots and Snapshots: Sensitive data captured in app screenshots
  8. Cloud Backups: Sensitive data synced to cloud without protection

Why Does This Matter?

The Business Impact

The Technical Impact

Technical Context

Mobile Storage Mechanisms

Android Storage Options: iOS Storage Options:

Platform Security Features

| Platform | Secure Storage | Default Protection | Backup Behavior |

|----------|---------------|-------------------|-----------------|

| Android | Encrypted SharedPreferences, KeyStore | App sandboxing (breakable on rooted devices) | ADB backup includes app data |

| iOS | Keychain with Data Protection | File-level encryption (requires configuration) | iCloud backup includes app data |

Attack Surface

  1. Physical Access: Lost or stolen devices
  2. Malware: Apps with escalated privileges
  3. Rooting/Jailbreaking: Sandbox escape
  4. Backup Analysis: iTunes/ADB backups
  5. Forensic Tools: Professional data recovery
  6. Side-channel Attacks: Keyboard cache, screenshots

Real-World Impact

Case Study 1: Banking App Unencrypted Database

Incident: Major banking application stored transaction history in plain text SQLite database. Impact: Cost: $89 million in fines, remediation, and customer compensation

Case Study 2: Healthcare App Data Leak

Incident: Medical appointment app stored patient records in unencrypted local files. Impact: Cost: $78 million settlement, app removed from stores for 6 months

Case Study 3: Messaging App Private Conversations

Incident: Popular messaging app cached decrypted messages in plain text. Impact: Cost: $12 million fine, major architectural redesign, user exodus to competitors

Case Study 4: E-commerce App Payment Data

Incident: Shopping app stored credit card numbers in SharedPreferences. Impact: Cost: $34 million in fraud losses, fines, and security overhaul

Prevalence and Statistics

Industry Research Findings

OWASP Mobile Security Testing Guide 2024: Verizon Mobile Security Index 2024: Common Storage Vulnerabilities:

Data Types Commonly Exposed

| Data Type | Prevalence | Average Records |

|-----------|-----------|-----------------|

| Authentication Tokens | 78% | N/A |

| Personal Information | 65% | 1,200 per user |

| Location History | 43% | 15,000 points |

| Financial Data | 31% | 8 records |

| Health Information | 27% | 45 records |

| Private Messages | 58% | 3,500 messages |

Common Misunderstandings

❌ Myth 1: "Device Encryption Protects App Data"

Reality: Device-level encryption (full disk encryption) only protects data when the device is powered off. Once unlocked, app data is accessible to malware and attackers with physical access.

❌ Myth 2: "App Sandboxing Is Sufficient"

Reality: While sandboxing prevents apps from accessing each other's data, it doesn't protect against:

❌ Myth 3: "Internal Storage Is Secure"

Reality: Internal storage on Android is only protected by Linux permissions, which are bypassed on rooted devices. iOS internal storage requires explicit encryption configuration to be secure.

❌ Myth 4: "Nobody Will Root Their Device"

Reality: Studies show 10-15% of Android devices are rooted globally, with higher percentages in some markets. Jailbreaking affects 5-10% of iOS devices. That's millions of vulnerable users.

❌ Myth 5: "Small Apps Aren't Targeted"

Reality: Automated tools and malware target all apps indiscriminately. Any app storing valuable data is a potential target, regardless of size or popularity.

❌ Myth 6: "Obfuscation Equals Encryption"

Reality: Base64 encoding, XOR operations, and code obfuscation are NOT encryption. They provide minimal security and are easily reversed.

❌ Myth 7: "Users Can Disable Backups"

Reality: Most users don't understand backup implications. Developers must programmatically exclude sensitive data from backups, not rely on user configuration.

The Mobile Security Difference

Storage Challenges on Mobile

| Aspect | Server Applications | Mobile Applications |

|--------|-------------------|---------------------|

| Environment Control | Full control | User-controlled device |

| Physical Security | Data center security | Pocket, could be stolen |

| Access Control | Network-based | Device-level bypass possible |

| Backup Security | Managed backups | User cloud backups |

| Update Speed | Instant patching | User must update app |

| Storage Duration | Controlled retention | Data persists indefinitely |

| Forensic Risk | Low (no physical access) | High (device seizure) |

Defense Requirements

Mobile applications must protect data against:

Regulatory Implications

GDPR (Europe): CCPA (California): HIPAA (Healthcare - USA): PCI-DSS (Payment Cards):

What's Next?

Now that you understand the importance and impact of insecure data storage:

  1. Attack Vectors: Learn how attackers exploit insecure data storage
  2. Prevention: Implement secure data storage practices
  3. Examples: See vulnerable vs secure code patterns
  4. Lab: Practice identifying and fixing storage vulnerabilities

Key Takeaways

✅ Never store sensitive data in plain text on mobile devices

✅ Use platform-provided secure storage (Keychain, KeyStore, EncryptedSharedPreferences)

✅ Encrypt all local databases containing sensitive information

✅ Exclude sensitive data from backups programmatically

✅ Minimize data storage - don't store what you don't need

✅ Implement data expiration - clear old sensitive data

✅ Use file-level encryption with Data Protection (iOS) or encryption libraries (Android)

✅ Validate storage security in every release with security testing

✅ Assume device compromise - defense in depth is critical

---

Remember: The device is in the user's hands. Once data is stored insecurely, it's only a matter of time before it's compromised. Part of OWASP Mobile Top 10 - Educational Repository