Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[MASWE-0007] Sensitive Data Stored Unencrypted in Shared Storage Requiring No User Interaction #2594

Merged
merged 39 commits into from
Jul 3, 2024
Merged
Changes from 1 commit
Commits
Show all changes
39 commits
Select commit Hold shift + click to select a range
0bc19a7
Add Risk and Tests for: Sensitive Data Stored Unencrypted in External…
serek8 Mar 5, 2024
af50568
Update risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unenc…
serek8 May 6, 2024
dc5a465
Fix spellings
serek8 Mar 5, 2024
e0ba4e1
Update tests and examples
serek8 May 7, 2024
7d23021
Update the title of a static test
serek8 May 7, 2024
d2df0de
Update examples and fix spellings
serek8 May 7, 2024
cc126f0
Added rules from Olivier
serek8 May 7, 2024
3cb96d2
Apply suggestions from code review
serek8 Jun 3, 2024
dfb01ff
Rename Sample to Demo
serek8 Jun 3, 2024
badad99
Update demo-2 with a reversed manifest file
serek8 Jun 3, 2024
5e5c8dc
Mention iOS in Risks
serek8 Jun 4, 2024
ac00a36
Update Demos with the MASTestApp
serek8 Jun 4, 2024
44b625b
Update demo-1
serek8 Jun 4, 2024
bdcea87
Add a new demo and refactor existing demos
serek8 Jun 5, 2024
1d0dbb6
Add a demo with listing all files
serek8 Jun 5, 2024
9ad1169
Fix the spelling errors
serek8 Jun 5, 2024
e8fab33
fix md lint issues
cpholguera Jun 7, 2024
e8093a9
fix md lint issues
cpholguera Jun 7, 2024
d79b2d8
update rules to remove false positive separating manifest from apis. …
cpholguera Jun 15, 2024
e17a638
minor corrections in android-data-unencrypted-shared-storage-no-user-…
cpholguera Jun 15, 2024
e7c2902
merge demo-4 into demo-1
cpholguera Jun 21, 2024
769257c
updated kotlin samples to include a password-like and API key-like st…
cpholguera Jun 21, 2024
709bfd4
Minor update to the risk mitigations paragraph.
cpholguera Jun 21, 2024
77ddf31
Updated tests titles and consolidated content. Additional content reg…
cpholguera Jun 21, 2024
247a928
Consolidated tests sections and linked to relevant techniques.
cpholguera Jun 21, 2024
858b4bd
Consolidated demos sections and titles. Added more details to the obs…
cpholguera Jun 21, 2024
81610ae
Remove SARIF support for now
cpholguera Jun 21, 2024
665171e
Merge branch 'master' of https://github.com/OWASP/owasp-mastg into pr…
cpholguera Jun 22, 2024
252ac64
Merge branch 'master' of https://github.com/OWASP/owasp-mastg into pr…
cpholguera Jun 23, 2024
7f4809c
fix paths to snippets
cpholguera Jun 23, 2024
dff1834
added one CWE and android risk maaping, some additional clarification…
cpholguera Jun 24, 2024
f68d567
Merge branch 'master' of https://github.com/OWASP/owasp-mastg into pr…
cpholguera Jun 24, 2024
d61e867
fix links to tools and tech
cpholguera Jun 24, 2024
99d0776
Merge branch 'master' of https://github.com/OWASP/owasp-mastg into pr…
cpholguera Jun 24, 2024
e373dcc
rename risk to weakness
cpholguera Jun 24, 2024
d44da95
move all to the weaknesses folder
cpholguera Jun 24, 2024
b8ad87d
Merge branch 'master' of https://github.com/OWASP/owasp-mastg into pr…
cpholguera Jun 24, 2024
b582669
Merge branch 'master' of https://github.com/OWASP/owasp-mastg into pr…
cpholguera Jun 24, 2024
edeee04
include link to frida and remove ref to run.sh from test
cpholguera Jun 24, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Mention iOS in Risks
  • Loading branch information
serek8 committed Jun 4, 2024
commit 5e5c8dcfeb1cdebef46461f586d3419911a56300
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@ mappings:

## Overview

Apps frequently opt to store data in the external storage due to its larger capacity and the ability to share files with other apps. However, this convenience comes with a potential drawback. Data stored on external devices like SD cards can be accessed not only by other apps on the device, given the right permissions, but also if the external storage is physically removed. This means that files meant to be private might unintentionally become public. Even if the external storage is emulated by the system, the risk arises from improper file permissions or the misuse of APIs for saving files. In such cases, files become vulnerable to unauthorized modifications and deletions, posing a security threat to the application.
Apps frequently opt to store data in the external storage due to its larger capacity. However, this convenience comes with a potential security drawback. Once a malicious app is granted the relevant permissions, it can access this data without user consent or interaction at any time. Additionally, external storage like SD cards can be physically removed and read by a malicious actor. Even if the external storage is emulated by the system, the risk arises from improper file permissions or the misuse of APIs for saving files. In such cases, the files become vulnerable to unauthorized access, modifications and deletions, posing a security threat to the application.

Developers may consider switching to the internal storage if they need more privacy and security. However, if the external storage is the most suitable for the app, it's a good practise to encrypt data stored in the external storage. Below you can find potential security impacts and mitigations linked to the use of the external storage.
Developers may consider switching to Private Storage or Shared Storage Requiring User Interaction if they need more privacy and security. However, if the external storage is the most suitable for the app, it's a good practise to encrypt data stored in the external storage. Below you can find potential security impacts and mitigations linked to the use of the external storage.


## Impact
Expand All @@ -38,6 +38,7 @@ This threat is primarily a concern for Android devices since they permit the use
- **Encryption Used is Insufficient**: Sensitive data is encrypted but the encryption is not considered to be strong.
- **Reuse of encryption key**: The encryption key is shared between two devices owned by a single user, enabling the process of data cloning between these devices in the external storage.

On iOS, apps cannot directly write to or read from the arbitrary locations, as compared to desktop operating system or Android. iOS maintains strict sandboxing rules, meaning apps can only access their own sandboxed file directories.

## Mitigations

Expand Down