CyberCertPrepMobile Security FundamentalsMobile Data StorageEASYFree question
Scenario
A security researcher audits a social Android app and captures network traffic during photo uploads. They observe that JPEG images contain GPS latitude/longitude EXIF tags with precise coordinates matching the user's home address. The server logs show these coordinates are stored in the backend database alongside the photo record.
A photo-sharing feature in a social Android app lets users upload photos taken with the device camera. A security researcher reports that when users share photos from their gallery to the app, GPS coordinates embedded in EXIF metadata can be read by the server. What is the recommended mitigation at the app layer?
- A.A) Request ACCESS_FINE_LOCATION permission and use it to strip GPS EXIF before upload
- B.B) Use the ExifInterface API to remove or nullify GPS-related EXIF tags from the photo before uploading it to the server
- C.C) Convert the image to WebP format, which does not support EXIF metadata
- D.D) Enable android:allowBackup="false" to prevent EXIF data from leaking through backups
Why B is correct