CyberCertPrepMobile Security FundamentalsMobile Data StorageEASYFree question
Scenario
A penetration tester is assessing a React Native banking app. On a rooted Android test device they navigate to /data/data/com.bankapp/databases/ and find RCTAsyncLocalStorage_V1.db containing authentication tokens in plaintext. The developer argues the file is protected by Linux DAC (app UID isolation) and therefore secure.
A React Native app uses AsyncStorage to persist user authentication tokens. A security tester on Android extracts the app's data directory and finds the tokens in a plaintext SQLite file. What is the correct remediation?
- A.A) Migrate token storage to react-native-encrypted-storage, which uses the Android Keystore (EncryptedSharedPreferences) on Android and iOS Keychain on iOS
- B.B) Set AsyncStorage's encryption flag to true in the package configuration
- C.C) Store tokens in the app's assets folder, which is read-only and not accessible to other apps
- D.D) Enable ProGuard obfuscation so that the SQLite column names are renamed, preventing token identification
Why A is correct