Issue Details
Insecure Data Storage
mobile02 • Rank #2 in OWASP 2024
Explanation
Mobile devices store data locally in databases, preferences, caches, and logs. Insecure storage occurs when sensitive data like credentials, tokens, or personal information is stored without encryption or with weak encryption. Rooted or jailbroken devices make this data easily accessible to attackers.
Remedy
Encrypt sensitive data at rest using platform-provided encryption APIs. Avoid storing sensitive data in shared preferences, plist files, or SQLite databases without encryption. Use secure enclaves where available and implement data wiping on device compromise detection.
| Year | Rank | Category |
|---|---|---|
| 2016 | #2 | mobile02 - Insecure Data Storage |
| 2024 | #2 | mobile02 - Insecure Data Storage and Privacy Leakage |