5

When building a mobile app, it is expected (OWASP etc) that any sensitive data that the app stores be properly encrypted. That would include for example any passwords, session cookies, OAuth tokens.

On Android the apps normally use SharedPreferences to store such data. These can only be read by the app itself, unless someone has root access to the phone, in which case he/she can read the SharedPreferences of all apps.

Although I fully agree to the encryption of such data, it is not quite clear to me which threat are we mitigating by doing so, because:

  • On a non-rooted phone, only the app itself can read the data, encrypted or not.
  • On a rooted phone all bets are off, since root can brute-force the master keys and then extract the app-keys to decrypt the data.

One point I see is that if the whole content of the phone were to be backed-up to an external service/filesystem, then the OS-protections would not apply anymore, so anyone with access to the backup could read all files. Is there any other threat we are mitigating by using encryption?

  • 1
    "since root can brute-force the master keys" -- then they were poorly encrypted. – CommonsWare Dec 19 '16 at 12:44
4

Answer is partially in your question:

On a non-rooted phone, only the app itself can read the data, encrypted or not.

This is an assumption of phone's OS providing security guarantees properly. Practical evidence shows that frequently it's not the case, so that's precisely why it's recommended to encrypt sensitive data: if normal access control fails.

So people come up with two countermeasures: - encrypting everything with external secret (user's password) - encrypting everything with a secret, which is stored in secure compartmented storage (trustzone / secure enclave).

Even the latter is not good enough (when OS-side implementation is bad, trustzone is subject to attacks, see https://www.blackhat.com/docs/us-15/materials/us-15-Shen-Attacking-Your-Trusted-Core-Exploiting-Trustzone-On-Android-wp.pdf).

On a rooted phone all bets are off, since root can brute-force the master keys and then extract the app-keys to decrypt the data.

The goal for good encryption is to make brute-forcing pointless in the first place.

4

This is about defence in depth.

Whilst only the correct app should be the only one with access on a non-rooted phone, there are many examples indeed (especially on Android) of applications capable of breaking out of the standard security model.

  • Exactly, it's the same reason why you would encrypt sensitive data on a database server. When for some reason your server is compromised and the data is leaked, all the attacker gets is the encrypted information and not the clear-text data. Basically the same applies when someone steals your phone. – knipp Dec 19 '16 at 14:45
0

Many apps, including chat apps, do not encrypt the contents of their sensitive files, for the exact reasons you mention. When you make a backup to local storage for example the sdcard, or to a remote location you should encrypt the files.

  • 3
    Not sure this actually answers the question? Unless you mean to say that there is no benefit, but then I think you should do so explicitly. – Anders Dec 19 '16 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.