Mobile Insecure Data Storage

What Is Broken and Why

Mobile apps often store sensitive data (credentials, tokens, PII, keys) in locations accessible to other apps, backups, or physical device extraction. Android's SharedPreferences and iOS's NSUserDefaults are plaintext XML/plist files readable with root/jailbreak. External storage is world-readable. Backups (ADB/iCloud) can expose the entire app sandbox unless explicitly excluded. Logging APIs persist sensitive data in system logs readable by other apps. The attacker gains access to credentials or session tokens without ever touching the backend.

Key Signals

• allowBackup="true" in AndroidManifest.xml without fullBackupContent exclusion rules
• SharedPreferences files in /data/data/<pkg>/shared_prefs/ containing tokens, passwords, or keys
• SQLite databases in the app sandbox without SQLCipher encryption
• Files in /sdcard/ or getExternalStorageDirectory() containing sensitive content
• iOS files lacking NSFileProtectionComplete data protection class
• Keychain items with kSecAttrAccessibleAlways or no accessibility constraints
• Log statements (Log.d, NSLog, print) containing session tokens or user data
• Input fields without inputType="textPassword" or secureTextEntry=true
• App switcher screenshots capturing password or payment screens

Methodology