The question is for both Android and iOS. Recently, the information security team of my company raised a concern about the Application cache being maintained after the app (made using Cordova) was uninstalled.
What is the nature of this Application cache (is it sensitive data)? What is the location of this Application cache data?
During the installation process, Android isolates apps from one another and from the system by assigning them a distinct Linux User ID (UID) for security reasons. This UID doesn't change for duration of app's lifetime on the device. The system maintains a list of UIDs in use, and assigns the next available one to the newly installed app. Device rebooting will force the system to reconstruct the UID list, so the UIDs of the uninstalled apps will be recycled and be possibly assigned to the newly installed apps. Now here lies the risk. When an app is uninstalled, the user will be deleted. Any data left behind by this app now become what one can call "parent less", because their owner no longer exists. They don't possess any harm if they remain so.
However, if they are inherited or possessed by another app, i.e., another user (UID), there will be potential security consequences if the “parent less” knows a lot about its previous parent or still possesses some privileges of the previous parent. This problem is called data residue problem . The data residue vulnerability is particularly complicated due to the fact that the residue might take several forms. During runtime, the system may store various types of data on behalf of apps, ranging from app permissions, operation history, user configuration choices, etc. These data can be files, databases, and in-memory data structures. They may not be simply data; they can represent privileges (such as capabilities), i.e., whoever possesses them can gain additional power.
For example, the URI placed on Android Clipboard by an app gives recipients the capability to access that app’s private data. If an app uses Android’s credential management services, such as AccountManager or Keystore, the credentials for the user’s online accounts can become data residues after the app is uninstalled. An email app(xyz) uses AccountManager to store the credentials for all the email accounts it manages, including Microsoft Exchange, Gmail, and Yahoo Mail. After this app is uninstalled, any malicious app can take over all its credentials stored inside AccountManager, and can successfully log into the user’s Yahoo Mail, Gmail, and Microsoft Exchange accounts.
Nature of Application Cache: may be and may not be sensitive,both. Location: If a newly installed app with the same UID can gain the access to the files downloaded by their previous owner. For that the default location is
/data/data/- com.android.providers.downloads/cache/
You can collect all available system services using the dumpsys utility provided by the Android Debug Bridge (adb) if you want what kind of files are left behind by an individual app after uninstallation.
