...
Consequent to the lack of restrictions described above, files written to external storage can be modified or read by other apps installed on the device (for the Android versions which allow read/write) and by anyone with access to the files if stored on an off-device external storage device such as a PC (or if the in-device external storage media is removed and mounted elsewhere).
The Android API Guides [Android Guides 2013] Storage Options states:
Caution: External storage can become unavailable if the user mounts the external storage on a computer or removes the media, and there’s no security enforced upon files you save to the external storage. All applications can read and write files placed on the external storage and the use can remove them.
...
| Code Block | ||
|---|---|---|
| ||
private String filename = "myfile"
private String string = "sensitive data such as credit card number"
FileOutputStream fos = null;
try {
fileFile file = new File(getExternalFilesDir(TARGET_TYPE), filename);
fos = new FileOutputStream(file, false);
fos.write(string.getBytes());
} catch (FileNotFoundException e) {
// handle FileNotFoundException
} catch (IOException e) {
// handle IOException
} finally {
if (fos != null) {
try {
fos.close();
} catch (IOException e) {
// handle error
}
}
}
|
Proof of Concept
Typically, an application stores files in the directory as follows:
...
| Code Block | ||
|---|---|---|
| ||
private String filename = "myfile"
private String string = "sensitive data such as credit card number"
FileOutputStream fos = null;
try {
fos = openFileOutput(filename, Context.MODE_PRIVATE);
fos.write(string.getBytes());
fos.close();
} catch (FileNotFoundException e) {
// handle FileNotFoundException
} catch (IOException e) {
// handle IOException
} finally {
if (fos != null) {
try {
fos.close();
} catch (IOException e) {
// handle error
}
}
}
|
Compliant Solution #2
Securely Securely encrypt the data first, prior to storing it on external storage such as an SD card. A note of caution: many default and non-default behaviors in Android and other cryptographic libraries have been found to use non-secure encryption methods. See DRD17-J, DRD18-J, and [Egele 2013] for more information.
Risk Assessment
Storing sensitive information on external storage can leak sensitive information to malicious apps.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
DRD00-J | medium | probable | medium | P12 | L1 |
Automated Detection
It is possible to automatically detect whether an application writes to external storage. It is not feasible to automatically determine whether such output could be stored internally. At least one automated analysis exists which checks if an Android app follows particular rules for secure encryption [Egele 2013], but those rules are not comprehensive and thus passing the automated checker does not guarantee sound encryption.
...
Android Secure Coding Guidebook by JSSEC | 4.6 Secure File Handling |
| [The CERT Oracle Secure Coding Standard for Java] | DRD17-J. Do not use the Android cryptographic security provider encryption default for AES |
| [The CERT Oracle Secure Coding Standard for Java] | DRD18-J. Do not use the default behavior in a cryptographic library if it does not use recommended practices |
Bibliography
| [Android API 2013] | Class Environment |
| [JSSEC 2014] | 4.6 Secure File Handling |
| [Source.android.com] | External Storage Technical Information |
| [Egele 2013] | An Empirical Study of Cryptographic Misuse in Android Applications |
...