CyberCertPrepMobile Security FundamentalsMobile Data StorageEASYFree question
Scenario
A penetration tester is assessing a React Native banking app. On a rooted Android test device they navigate to /data/data/com.bankapp/databases/ and find RCTAsyncLocalStorage_V1.db containing authentication tokens in plaintext. The developer argues the file is protected by Linux DAC (app UID isolation) and therefore secure.
A React Native app uses AsyncStorage to persist user authentication tokens. A security tester on Android extracts the app's data directory and finds the tokens in a plaintext SQLite file. What is the correct remediation?
- A.Migrate token storage to react-native-encrypted-storage, which uses the Android Keystore (EncryptedSharedPreferences) on Android and iOS Keychain on iOS
- B.Move the tokens into the app's assets folder, which ships unwritable inside the APK and stays outside the writable data directory the tester enumerated (assets survive a reinstall untouched)
- C.Switch on the encryption flag in the AsyncStorage package configuration (encrypted=true in the RN config block), which routes writes through SQLCipher and leaves RCTAsyncLocalStorage_V1.db unreadable to a filesystem dump