Are there any know security flaws/hacks to gain access to the private storage(file system or SQLite database) of Android and iOS applications?

What measures do Google and Apple take to "prevent" these kinds of attacks, or is it up to the developer of the application to take care of that?

Update Are these file systems/databases encrypted?

  • 1
    Do you consider the owner of the device an attacker? If yes, you're obviously doomed. Nov 24, 2013 at 12:27
  • Haven't really thought of it that way. I guess anyone who tries to gain access to the private storage of the app should be considered an attacker.
    – supercell
    Nov 24, 2013 at 12:31

2 Answers 2


The file system on an Android device is not encrypted. iOS does this by default. However note that once you are at runtime this is not really relevant anymore. They only protect against attackers who have gained access to the phone and have removed the storage for analysis.

On Android, applications are sandboxed and as long as you are not running a rooted device one application cannot access the other application.

Generally if you want to encrypt your database it should be done from the application itself. Furthermore your encryption key should be derived from a password the user needs to supply every single time. Caching the password should be done carefully as you could dump it at runtime. The password or key should not be stored on the device.

Note that there is no foolproof way to protect your data once an attacker has gained access to the phone. You can only make it a bit harder, but not impossible.

  • "The filesystem on an Android device is not encrypted" Worth noting this portion of this answer is now outdated. As of Android 6.0 Marshmallow, manufacturers must enable encryption by default on new devices (with a few limited exceptions): source.android.com/compatibility/6.0/…
    – Ajedi32
    May 1, 2017 at 19:19
  • The previous update is now outdated. Full disk encryption had significant usability problems (for instance, if your device crashed overnight none of your alarms would work). So Android 7 moved toward file-based encryption (FBE).
    – gMale
    Feb 4 at 16:23

If the data is served by your application and stored on the mobile phone, then the owner of the phone can and will have access to it one way or the other. You can try use obfuscation as aggressively as you want, the data will be accessed.

Using encryption on the filesystem/database your application accesses means that your application should have access to the cryptographic key, which means it's either served online, stored somewhere on the device, or hard-coded in the application itself. In all of the previous cases, it's completely possible to acquire it and, therefore, access the data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.