OWASP Top 10 - M9: Insecure Data Storage

Insecure Data Storage in Mobile Apps

Threat Agents: Hackers, insiders, cybercriminals, state-sponsored actors, and competitors exploit weak encryption, poor access controls, and insecure storage.

Attack Vectors (EASY): Unauthorized access, weak encryption, data interception, malware, and social engineering.

Security Weaknesses (COMMON, AVERAGE Detectability):

• Storing sensitive data in plain text.
• Weak/no encryption, poor access controls.
• Exposure through logs, caches, and misconfigured cloud storage.

Impact (SEVERE):

• Technical: Data breaches, account compromise, data tampering, unauthorized access, compliance violations.
• Business: Reputation loss, legal penalties, financial loss, competitive disadvantage.

Are You Vulnerable?

• Lack of encryption, weak access controls, exposed logs, misconfigured cloud storage.

Prevention:

• Encrypt data at rest/in transit, use secure storage (Keychain/Keystore), enforce access controls, secure transmission (HTTPS/TLS), and update dependencies.

Example Attacks:

1. Plaintext passwords stolen.
2. Unsecured local storage exploited.
3. Authentication tokens exposed via caching.
4. Sensitive data leaked in logs.
5. Misconfigured cloud storage leads to data theft.

Secure data storage is essential to prevent breaches and maintain trust.