BERRY9 IT Services, home +91 86868 92922

Insecure Data Storage in Mobile Apps

Insecure data storage is a common finding in mobile apps because there are so many places to store data and most of them are wrong by default. Here is the inventory to walk through.

Request a scoping call Call +91 86868 92922

Mobile apps · By Thimmagurudu Bathini · Published · 5 min read · Last reviewed

Android storage locations

  • SharedPreferences — XML files in /data/data/com.app/shared_prefs/. Plaintext by default; use EncryptedSharedPreferences for sensitive values.
  • SQLite databases — accessible to the app and to root. Use SQLCipher for sensitive data.
  • Internal storage files — accessible only to the app's UID; safe for non-sensitive use, encrypt anything sensitive.
  • External storage — historically world-readable; scoped storage on Android 11+ improves this but legacy apps still over-share.
  • Keystore — backed by hardware on most modern devices; the right place for keys.

iOS storage locations

  • Keychain — hardware-backed, the right place for credentials. Verify the kSecAttrAccessible level — many apps use kSecAttrAccessibleAlways when kSecAttrAccessibleWhenUnlockedThisDeviceOnly is appropriate.
  • NSUserDefaults — plist file in the app sandbox, plaintext. Not for secrets.
  • Core Data and SQLite — encrypt with file protection or SQLCipher.
  • Files in Documents/Library — file protection class matters. NSFileProtectionComplete for sensitive files.

The forgotten places

WebView caches, logs (writing PII via Log.d or NSLog), screenshots taken automatically by iOS on app switch (cover sensitive screens with a privacy overlay), clipboard, autofill data, crash reporting payloads.

A mobile application penetration test audits all of them.

Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp