CyberCertPrepMobile Security FundamentalsMobile Data StorageEASYFree question
Scenario
A security assessor uses ADB shell with root access on a rooted Android test device to browse the app's data directory. They find /data/data/com.example.bankapp/shared_prefs/session_prefs.xml containing: <string name="auth_token">eyJhbGciOiJIUzI1NiJ9...</string>. The developer argues that since the device must be rooted to access this location, the finding is only valid in a threat model that assumes root.
During a mobile app security assessment, a tester navigates to /data/data/com.example.bankapp/shared_prefs/ on a rooted Android test device and finds session_prefs.xml containing a Base64-encoded string for the key 'auth_token'. What does this finding demonstrate, and what MASVS control does it violate?
- A.A) This is expected; SharedPreferences is intended for authentication tokens and the Base64 encoding provides adequate obfuscation
- B.B) Base64 encoding provides no security - it is trivially reversible; this violates MASVS MSTG-STORAGE-1 which requires sensitive data such as session tokens to be stored in secure storage (Android Keystore / EncryptedSharedPreferences)
- C.C) This finding only applies if the device is rooted; the vulnerability has no MASVS classification because it requires root
- D.