I'am writing some small security report about Android devices in general related to accessing information from RAM. Main condition is that device initially is non-rooted.
Use case: User opens 3rd-party app, enters some password in password field. After that the device is lost with this running application. Source code of this application shows that this password information available in RAM while application is up and running. For example in class AllMyAppPasswords in public String myPassword. Now is the question about possible way to access this password info (correct me if I am wrong):
- The way to access this pwd is to dump the memory.
- For memory dump I need to have device to be rooted.
- In order to root the device I need to unlock bootloader.
- To achieve unlock bootloader and root operations it is requires that device needs to be rebooted at least once.
- After device is rebooted the information about password is gone from RAM
More info to current use case: We assume that user just un-boxed new device and 100% sure that it is not rooted and not contain any keylogger apps. So user just installed my app, entered password, and application uses this password internally during run-time for periodically connecting the server (password only RAM, never stored on disk). So, visually there is nothing left in Edit text fields, info about password only in application memory for internal use, of course it is not possible just to read password text from the screen. Now user lost his phone.
Conclusion and my question: It is not possible to get password residing in RAM memory from app if device is non-rooted (without physical disassembling frozen memory chip). Is it correct? Should user concern about someone who found his phone can get this password info from RAM?