Lost or stolen devices, malware with storage access, rooted or jailbroken devices, and unencrypted backups all give attackers access to data at rest. Plaintext tokens, personal data, and cached API responses on external storage or in logs are among the most common findings in mobile penetration tests.
Avoid storing sensitive data on the device when possible. When needed, use Keychain/Keystore-backed encryption (EncryptedSharedPreferences, SQLCipher, Data Protection classes), keep files in app-private storage, and clear caches and temporary files.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2024Latest
#09mobile09-2024 Insecure Data Storage
