<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-mobile-device-encryption-audit
description: >-
  Audit mobile device encryption implementations including full-disk encryption,
  file-based encryption, KeyStore/Keychain usage, data-at-rest protection, and
  cryptographic API correctness on Android and iOS using ADB, Frida, objection,
  and static analysis of encryption code paths.
domain: cybersecurity
subdomain: mobile-security
tags:
  - encryption
  - fbe
  - fde
  - keystore
  - keychain
  - data-at-rest
  - cryptography
  - frida
  - adb
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1532", "T1521"]
  owasp-mobile: ["M2", "M5"]
  tools: ["adb", "frida", "objection", "jadx", "apktool"]
---

# Implementing Mobile Device Encryption Audit

## Overview

Encryption audits verify that mobile devices and applications properly protect
data at rest. Android uses file-based encryption (FBE) with CE/DE storage classes
since Android 10, while iOS employs Data Protection classes tied to the Secure
Enclave. App-level audits check KeyStore/Keychain usage, cryptographic algorithm
selection, key derivation, and IV/nonce management.

## Prerequisites

```bash
pip install frida-tools objection androguard
apt install apktool adb
# jadx: https://github.com/skylot/jadx/releases
```

## Workflow

### Step 1: Device-Level Encryption Verification

```bash
# Android — check encryption status
adb shell getprop ro.crypto.state           # should be "encrypted"
adb shell getprop ro.crypto.type            # "file" (FBE) or "block" (FDE)
adb shell getprop ro.crypto.fbe.enabled     # FBE status

# Verify encryption details
adb shell dumpsys mount | grep -i encrypt
adb shell ls -la /data/misc/vold/

# iOS — verify data protection
# Data protection is always-on for devices with Secure Enclave
# Check via MDM profile or device info
ideviceinfo -q com.apple.mobile.lockdown | grep -i 'HardwareEncryptionCaps'
```

### Step 2: App Cryptographic API Analysis

```bash
# Decompile and analyze crypto usage
jadx -d jadx_out/ target.apk --deobf

# Check for weak algorithms
grep -rn 'DES\b\|3DES\|DESede\|RC4\|RC2\|MD5\|SHA1\b' jadx_out/
grep -rn 'Cipher.getInstance.*ECB' jadx_out/   # ECB mode
grep -rn 'Cipher.getInstance.*DES' jadx_out/

# Check for proper key derivation
grep -rn 'PBEKeySpec\|PBKDF2\|Argon2\|scrypt' jadx_out/
grep -rn 'SecretKeySpec.*getBytes' jadx_out/  # raw bytes as key = bad

# Check IV/nonce handling
grep -rn 'IvParameterSpec\|GCMParameterSpec' jadx_out/
grep -rn 'new byte\[.*\].*=.*0' jadx_out/  # static IV

# Check for hardcoded keys
grep -rn 'SecretKeySpec.*"[A-Za-z0-9]\{16,\}"' jadx_out/
```

### Step 3: KeyStore/Keychain Usage Audit

```bash
# Android KeyStore analysis
objection -g com.target.app explore -c "android keystore list"

# Frida — hook KeyStore operations
frida -U -f com.target.app -l hook_keystore.js --no-pause

# Check KeyStore key properties in source
grep -rn 'KeyGenParameterSpec\|setEncryptionRequired\|setUserAuthenticationRequired' jadx_out/
grep -rn 'AndroidKeyStore\|KeyStore.getInstance' jadx_out/

# iOS Keychain audit
objection -g com.target.app explore -c "ios keychain dump"
objection -g com.target.app explore -c "ios keychain dump --json"

# Check Keychain access control flags
grep -rn 'kSecAttrAccessible\|kSecAccessControl' jadx_out/ 2>/dev/null
# Weak: kSecAttrAccessibleAlways
# Good: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
```

### Step 4: Data-at-Rest Storage Audit

```bash
# Android — inspect app data directories
adb shell run-as com.target.app ls -la shared_prefs/
adb shell run-as com.target.app ls -la databases/
adb shell run-as com.target.app ls -la files/

# Check SharedPreferences for sensitive data
adb shell run-as com.target.app cat shared_prefs/*.xml

# Check SQLite databases for encryption
adb shell run-as com.target.app sqlite3 databases/app.db "PRAGMA cipher_version;"
# If no result → database is not encrypted (no SQLCipher)

# Check for EncryptedSharedPreferences usage
grep -rn 'EncryptedSharedPreferences\|MasterKey' jadx_out/

# iOS — check Data Protection class on files
objection -g com.target.app explore -c "ios info binary"
```

### Step 5: Runtime Crypto Interception

```bash
# Frida — hook Cipher.doFinal to see plaintext and ciphertext
frida -U -f com.target.app -l hook_cipher.js --no-pause

# Frida — hook SecretKeySpec to extract encryption keys
frida -U -f com.target.app -l hook_secretkey.js --no-pause

# Monitor key generation
frida -U -f com.target.app -l hook_keygen.js --no-pause

# objection — dump class instances with keys
objection -g com.target.app explore -c "android heap search instances javax.crypto.SecretKey"
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Weak algorithm | Static analysis | DES, RC4, MD5, ECB mode |
| Hardcoded key | Static analysis | Key material in source code |
| Static IV | Static analysis | Constant or zero IV/nonce |
| No KeyStore | Code review | Keys not in hardware-backed store |
| Unencrypted DB | Runtime check | SQLite without SQLCipher |
| Weak Data Protection | iOS Keychain | kSecAttrAccessibleAlways |

```yaml
title: Mobile Device Encryption Audit Detection
id: 53fce9ad-6de6-40be-8a54-20660cf1da61
status: experimental
description: Detects suspicious activity related to implementing mobile device encryption audit techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1532
  - attack.t1521
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] Device encryption enabled and verified
- [ ] Cryptographic algorithms audited (no weak ciphers)
- [ ] Key derivation and management assessed
- [ ] KeyStore/Keychain usage verified
- [ ] Data-at-rest storage encryption confirmed
- [ ] Runtime crypto operations intercepted and validated

## References

- [Android Encryption](https://source.android.com/docs/security/features/encryption)
- [iOS Data Protection](https://support.apple.com/guide/security/data-protection-overview-secf6276da8a/web)
- [OWASP MASTG — Cryptography](https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0014/)
- [MITRE T1532 — Archive Collected Data](https://attack.mitre.org/techniques/T1532/)
