Mobile devices store data locally in databases, preferences, caches, and logs. Insecure storage occurs when sensitive data like credentials, tokens, or personal information is stored without encryption or with weak encryption. Rooted or jailbroken devices make this data easily accessible to attackers.
Encrypt sensitive data at rest using platform-provided encryption APIs. Avoid storing sensitive data in shared preferences, plist files, or SQLite databases without encryption. Use secure enclaves where available and implement data wiping on device compromise detection.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
Rank by release (taller is higher)
2024Latest
#02mobile02-2024 Inadequate Supply Chain Security
No change since 20162016
#02Insecure Data Storage
