CyberCertPrepMobile Security FundamentalsMobile Data StorageEASYFree question
Scenario
A security assessor uses ADB shell with root access on a rooted Android test device to browse the app's data directory. They find /data/data/com.example.bankapp/shared_prefs/session_prefs.xml containing: <string name="auth_token">eyJhbGciOiJIUzI1NiJ9...</string>. The developer argues that since the device must be rooted to access this location, the finding is only valid in a threat model that assumes root.
During a mobile app security assessment, a tester navigates to /data/data/com.example.bankapp/shared_prefs/ on a rooted Android test device and finds session_prefs.xml containing a Base64-encoded string for the key 'auth_token'. What does this finding demonstrate, and what MASVS control does it violate?
- A.Base64 encoding provides no security - it is trivially reversible; this violates MASVS MSTG-STORAGE-1 which requires sensitive data such as session tokens to be stored in secure storage (Android Keystore / EncryptedSharedPreferences)
- B.This is the expected storage pattern for a session artifact; Base64 wrapping satisfies MASVS MSTG-STORAGE-1 because the control asks for encoding of tokens at rest (the Keystore requirement applies to cryptographic keys) so a preferences file holding an encoded bearer token passes review