<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-mobile-data-storage
description: >-
  Inspect and audit mobile application local data storage mechanisms for insecure
  practices including plaintext credentials in SharedPreferences/NSUserDefaults,
  unencrypted databases, world-readable files, clipboard exposure, backup
  extraction, and keychain/keystore misuse.
domain: cybersecurity
subdomain: mobile-security
tags:
  - data-storage
  - shared-preferences
  - sqlite
  - keychain
  - keystore
  - backup
  - nsuserdefaults
  - insecure-storage
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1409", "T1414"]
  owasp-mobile: ["M2", "M9"]
  tools: ["frida", "objection", "adb", "sqlite3", "idevicebackup2"]
---

# Analyzing Mobile Data Storage

## Overview

Mobile data storage analysis identifies sensitive information stored insecurely
on the device filesystem, including plaintext credentials, unencrypted databases,
world-readable files, excessive logging, insecure backups, and improper use of
platform-provided secure storage (Keystore/Keychain).

## Prerequisites

```bash
pip install frida-tools objection
# adb for Android device access
# sqlite3 for database inspection
# Rooted/jailbroken device for full filesystem access
```

## Workflow

### Step 1: Android Data Storage Inspection

```bash
# App sandbox directory (requires root/adb backup)
adb shell run-as com.target.app ls -la /data/data/com.target.app/

# SharedPreferences (XML files)
adb shell run-as com.target.app cat /data/data/com.target.app/shared_prefs/*.xml
# Check for: plaintext tokens, passwords, API keys, session IDs

# SQLite databases
adb shell run-as com.target.app ls /data/data/com.target.app/databases/
adb pull /data/data/com.target.app/databases/app.db ./
sqlite3 app.db ".tables"
sqlite3 app.db ".schema"
sqlite3 app.db "SELECT * FROM users;"
# Check for: unencrypted credentials, PII, tokens

# Internal storage files
adb shell run-as com.target.app find /data/data/com.target.app/files/ -type f
adb shell run-as com.target.app cat /data/data/com.target.app/files/config.json

# External storage (world-readable before Android 10)
adb shell ls /sdcard/Android/data/com.target.app/
adb shell find /sdcard/ -name "*.db" -o -name "*.json" -o -name "*.xml" 2>/dev/null

# Log inspection
adb logcat -d | grep -i "com.target.app" | grep -iE 'token|password|key|secret'
```

### Step 2: iOS Data Storage Inspection

```bash
# Using objection
objection -g com.target.app explore -s "env"
# Note the Documents, Library, tmp paths

# NSUserDefaults
objection -g com.target.app explore -s "ios nsuserdefaults get"

# Keychain dump
objection -g com.target.app explore -s "ios keychain dump"
objection -g com.target.app explore -s "ios keychain dump --json"

# Plist files
objection -g com.target.app explore -s "ios plist cat Info.plist"

# SQLite databases
objection -g com.target.app explore -s "sqlite connect Library/data.db"

# Cookie storage
objection -g com.target.app explore -s "ios cookies get"

# File browser
objection -g com.target.app explore -s "ls Documents/"
objection -g com.target.app explore -s "ls Library/Caches/"
```

### Step 3: Frida Runtime Storage Monitoring

```javascript
// Monitor SharedPreferences writes (Android)
Java.perform(function() {
    var editor = Java.use('android.content.SharedPreferences$Editor');
    editor.putString.implementation = function(key, value) {
        console.log('[PREFS] PUT ' + key + ' = ' + value);
        return this.putString(key, value);
    };
    editor.commit.implementation = function() {
        console.log('[PREFS] COMMIT');
        return this.commit();
    };
});

// Monitor SQLite operations
Java.perform(function() {
    var db = Java.use('android.database.sqlite.SQLiteDatabase');
    db.insert.implementation = function(table, nullCol, values) {
        console.log('[SQL] INSERT ' + table + ': ' + values.toString());
        return this.insert(table, nullCol, values);
    };
    db.rawQuery.overload('java.lang.String', '[Ljava.lang.String;')
        .implementation = function(sql, args) {
        console.log('[SQL] QUERY: ' + sql);
        return this.rawQuery(sql, args);
    };
});

// Monitor file writes
Java.perform(function() {
    var FileOutputStream = Java.use('java.io.FileOutputStream');
    FileOutputStream.$init.overload('java.io.File').implementation = function(file) {
        console.log('[FILE] Write: ' + file.getAbsolutePath());
        return this.$init(file);
    };
});
```

### Step 4: Backup Extraction and Analysis

```bash
# Android ADB backup
adb backup -apk -shared com.target.app -f backup.ab
# Convert to tar
java -jar abe.jar unpack backup.ab backup.tar
tar xvf backup.tar
# Inspect: apps/com.target.app/

# Android: check if backup is allowed
grep 'allowBackup' apktool_out/AndroidManifest.xml

# iOS: iTunes/Finder backup extraction
idevicebackup2 backup --full ./ios_backup/
# Use iBackup Viewer or manual plist/sqlite inspection

# iOS: check for data protection classes
objection -g com.target.app explore -s "ios keychain dump" | grep -i 'accessible'
# kSecAttrAccessibleAlways = INSECURE
# kSecAttrAccessibleWhenUnlockedThisDeviceOnly = SECURE
```

### Step 5: Clipboard and Screenshot Exposure

```bash
# Monitor clipboard for sensitive data
objection -g com.target.app explore -s "ios pasteboard monitor"

# Android: check clipboard
adb shell service call clipboard 2 s16 com.target.app

# Check for screenshot prevention
grep -rn 'FLAG_SECURE\|setSecure' jadx_out/
# Missing FLAG_SECURE = sensitive screens can be screenshotted
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Plaintext credentials | SharedPrefs/Defaults | Unencrypted secrets |
| Unencrypted DB | SQLite files | Sensitive data without encryption |
| World-readable files | File permissions | Accessible by other apps |
| Sensitive logs | Logcat | Credentials in log output |
| Insecure backup | Manifest | allowBackup=true with secrets |

```yaml
title: Mobile Data Storage Detection
id: 8a2d677e-008b-4b07-87b4-fa76981cb686
status: experimental
description: Detects suspicious activity related to analyzing mobile data storage techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1409
  - attack.t1414
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] SharedPreferences/NSUserDefaults checked for secrets
- [ ] SQLite databases inspected for unencrypted data
- [ ] File permissions verified (no world-readable sensitive files)
- [ ] Keychain/Keystore usage validated with proper access controls
- [ ] Backup extraction tested for data leakage
- [ ] Clipboard exposure assessed
- [ ] Log output reviewed for sensitive data

## References

- [OWASP MASTG — Data Storage Testing](https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0001/)
- [Android Data Storage](https://developer.android.com/training/data-storage)
- [iOS Keychain Services](https://developer.apple.com/documentation/security/keychain_services)
- [MITRE T1409](https://attack.mitre.org/techniques/T1409/)
