Lesson 3.17: What the app stores on the phone
Apps keep data in their private folder: preference files, SQLite databases, caches. The sandbox stops other apps, but not a phone that is rooted, stolen and unlocked, backed up, or analysed with forensic tools, so sensitive data must be kept to a minimum and protected with the platform's keystore. Files written to shared storage are not private at all. In the lab you use run-as on the debug build to look inside Northwind Shop's folder and find a stored password, a token, full card numbers with the security code in a plain database, and an order export with customers' addresses in the shared Downloads folder.
18 min
You will learn to
- Explain where Android apps store data
- Inspect a debuggable app's data with run-as
- Read SharedPreferences and SQLite databases
- Recognise data that must not be stored
- Explain why shared storage isn't private
Key terms
- SharedPreferences
- Key-value settings stored as XML in shared_prefs/.
- run-as
- Runs a command as a debuggable app's user.
- Shared storage
- /sdcard (Downloads, Pictures…): files the user and other apps can reach.
- PCI DSS
- Payment Card Industry Data Security Standard: rules for anyone storing, processing or transmitting card data.
- Tokenisation
- Replacing card data with a token from the payment provider that's useless elsewhere.
← Strings and indicators · All lessons · Private addresses, NAT and port forwarding →