Page History

Android provides several options to save persistent application data, one of which is External Storage (/sdcard, /mnt/sdcard).

Files saved to the external storage are world-readable. Consequently, they can be modified by other apps installed on the device or by the user (by enabling USB mass storage and manipulating files from a PC).

...

The following code creates a file on the external storage and saves sensitive information to the file:

private String filename = "myfile"

private String string = "sensitive data such as credit card number"
FileOutputStream fos = null;

try {
  file file = new File(getExternalFilesDir(TARGET_TYPE), filename);
  fos = new FileOutputStream(file, false);
  fos.write(string.getBytes());
} catch (FileNotFoundException e) {
  // handle FileNotFoundException
} catch (IOException e) {
  // handle IOException
} finally {
  if (fos != null) {
    try {
  fos.close();
    } catch (IOException e) {
    }
  }
}

...

The following code uses the openFileOutput() method to create "myfile" in an application data directory with permission set to MODE_PRIVATE so that other apps cannot access the file:

private String filename = "myfile"
private String string = "sensitive data such as credit card number"
FileOutputStream fos = null;

try {
   fos = openFileOutput(filename, Context.MODE_PRIVATE);
   fos.write(string.getBytes());
   fos.close();
} catch (FileNotFoundException e) {
  // handle FileNotFoundException
} catch (IOException e) {
  // handle IOException
} finally {
  if (fos != null) {
    try {
      fos.close();
    } catch (IOException e) {
    }
  }
}

Related Vulnerabilities

• JVN#92038939
  TITLE: mixi for Android information management vulnerability URL: http://jvn.jp/en/jp/JVN92038939/index.html
• JVN#05102851
  TITLE: Yome Collection for Android issue in management of IMEI
  URL: http://jvn.jp/en/jp/JVN05102851/index.html

Related Guidelines

Bibliography