Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are there any know security flaws/hacks to gain access to the private storage(file system or SQLite database) of Android and iOS applications?

What measures do Google and Apple take to "prevent" these kinds of attacks, or is it up to the developer of the application to take care of that?

Update Are these file systems/databases encrypted?

share|improve this question
    
Do you consider the owner of the device an attacker? If yes, you're obviously doomed. –  CodesInChaos Nov 24 '13 at 12:27
    
Haven't really thought of it that way. I guess anyone who tries to gain access to the private storage of the app should be considered an attacker. –  Supercell Nov 24 '13 at 12:31

2 Answers 2

up vote 2 down vote accepted

The file system on an Android device is not encrypted. iOS does this by default. However note that once you are at runtime this is not really relevant anymore. They only protect against attackers who have gained access to the phone and have removed the storage for analysis.

On Android, applications are sandboxed and as long as you are not running a rooted device one application cannot access the other application.

Generally if you want to encrypt your database it should be done from the application itself. Furthermore your encryption key should be derived from a password the user needs to supply every single time. Caching the password should be done carefully as you could dump it at runtime. The password or key should not be stored on the device.

Note that there is no foolproof way to protect your data once an attacker has gained access to the phone. You can only make it a bit harder, but not impossible.

share|improve this answer

If the data is served by your application and stored on the mobile phone, then the owner of the phone can and will have access to it one way or the other. You can try use obfuscation as aggressively as you want, the data will be accessed.

Using encryption on the filesystem/database your application accesses means that your application should have access to the cryptographic key, which means it's either served online, stored somewhere on the device, or hard-coded in the application itself. In all of the previous cases, it's completely possible to acquire it and, therefore, access the data.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.