📱 Insecure Data Storage Attack Flow
OWASP Mobile #2 - Extracting Sensitive Data from Devices
flowchart TD
A[👤 Attacker] -->|1. Physical access| B[📱 Target Device]
A -->|2. Install malware| B
A -->|3. Root/Jailbreak| C[🔓 Elevated Privileges]
B -->|4. Extract app data| D[📂 App Directories]
C -->|5. Access keychain| E[🔑 iOS Keychain]
C -->|6. Access shared prefs| F[⚙️ Android SharedPreferences]
D -->|7. Read SQLite DBs| G[(💾 Local Databases)]
D -->|8. Read log files| H[📝 Application Logs]
D -->|9. Access SD card| I[💿 External Storage]
E -->|10. Extract credentials| J[🔐 Passwords/Tokens]
F -->|11. Read config files| J
G -->|12. Dump user data| J
H -->|13. Sensitive info in logs| J
I -->|14. Unencrypted files| J
J -->|15. Account takeover| A
style A fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style B fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
style C fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style D fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style E fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style F fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style G fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style H fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
style I fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style J fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
K[🔒 Defense:
Encryption at Rest] -.->|Encrypt sensitive data| D
L[🛡️ Defense:
Secure Keychain] -.->|Use OS protections| E
M[⚙️ Defense:
No Sensitive Logs] -.->|Sanitize logs| H
style K fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style L fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style M fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
📋 Attack Flow Breakdown
1
Physical Access: Lost/stolen device or malware installation.
Scenario: Device theft, repair shop access, malicious app
2
Root/Jailbreak Extraction: Bypass OS security on compromised devices.
Tools: Magisk (Android), checkra1n (iOS)
3
SharedPreferences Exposure (Android): Read unencrypted XML files.
/data/data/com.app/shared_prefs/config.xml
<string name="api_key">sk_live_12345</string>
4
Keychain Extraction (iOS): Extract credentials from iOS Keychain.
keychain-dumper tool on jailbroken devices
5
SQLite Database Dump: Extract unencrypted local databases.
/data/data/com.app/databases/user.db
Contains: passwords, tokens, PII
6
Log File Analysis: Sensitive data logged in plaintext.
Log.d("API", "User token: " + authToken)
7
SD Card/External Storage: Access world-readable files.
/sdcard/AppData/credentials.json
8
Clipboard Sniffing: Capture sensitive data from clipboard.
9
Backup Extraction: iTunes/Google backups may contain unencrypted data.
🛡️ Defense Mechanisms
✅ Encrypt Sensitive Data at Rest:
Use AES-256 encryption for all sensitive local storage.
iOS: Data Protection API | Android: EncryptedSharedPreferences
✅ Use Secure Storage APIs:
Leverage OS-provided secure storage mechanisms.
iOS: Keychain with kSecAttrAccessibleWhenUnlockedThisDeviceOnly
Android: Android Keystore System
✅ Never Store Sensitive Data Unnecessarily:
Minimize data retention. Use session tokens instead of passwords.
Don't store: passwords, credit cards, SSN
✅ Sanitize Logs:
Never log sensitive information, even in debug builds.
Production: Disable debug logs completely
✅ Secure SQLite Databases:
Use SQLCipher for encrypted database storage.
SQLCipher.loadLibrary() | AES-256 encryption
✅ Disable Backups for Sensitive Data:
Exclude sensitive files from cloud backups.
iOS: NSFileProtectionComplete | Android: android:allowBackup="false"
✅ Implement Root/Jailbreak Detection:
Warn users or restrict functionality on compromised devices.