I am looking for the best way to protect sensitive data in Android devices, e.g. secret or private keys, and found Android Keystore System. Based on the documentation, key material may be bound to secure hardware (e.g., Trusted Execution Environment (TEE), Secure Element (SE)) of Android device. It implies that not all of the Android devices support this. Some articles named this method as hardware-backed storage. If the device does not support secure hardware, it is stored in internal storage, some articles named this as software-backed storage.

Based on this article, software-backed store is placed in /data/misc/keystore/user_0 which means it is exposed in rooted devices. Is there any PoC that this is not secure for rooted device? Specifically, how to extract secrets in these software-backed secure storage?

  • 3
    Any software based solution is going to be vulnerable to a rooted device - by definition, the root user can read anything on the main storage area. Hardware based storage avoids this by only allowing access to data in it through specific methods - the root user can't make a request to get the raw data for offline decryption since there isn't a method to do that. If the key to access this area is stored in main storage, the root user could access that, then use the specific methods provided by the hardware store though - one reason hardware store is sometimes blocked on rooted devices. – Matthew Jun 1 '16 at 8:45
  • 1
    What's the purpose of the above comment? – Krypton Sep 14 '17 at 4:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.