...
Device: Android 10 Pixel 3A
...
Scope
MSTG-STORAGE-1: "System credential storage facilities need to be used to store sensitive data, such as PII, user credentials or cryptographic keys."
MSTG-STORAGE-2: "No sensitive data should be stored outside of the app container or system credential storage facilities."
MSTG-STORAGE-3: "No sensitive data is written to application logs."
MSTG-STORAGE-4: "No sensitive data is shared with third parties unless it is a necessary part of the architecture."
MSTG-STORAGE-5: "The keyboard cache is disabled on text inputs that process sensitive data."
MSTG-STORAGE-6: "No sensitive data is exposed via IPC mechanisms."
MSTG-STORAGE-7: "No sensitive data, such as passwords or pins, is exposed through the user interface."
MSTG-STORAGE-8: "No sensitive data is included in backups generated by the mobile operating system."
MSTG-STORAGE-9: "The app removes sensitive data from views when moved to the background."
MSTG-STORAGE-10: "The app does not hold sensitive data in memory longer than necessary, and memory is cleared explicitly after use."
MSTG-STORAGE-11: "The app enforces a minimum device-access-security policy, such as requiring the user to set a device passcode."
MSTG-PLATFORM-2: "All inputs from external sources and the user are validated and if necessary sanitized. This includes data received via the UI, IPC mechanisms such as intents, custom URLs, and network sources."
Issue Summary
Testing Local Storage for Sensitive Data (MSTG-STORAGE-1 and MSTG-STORAGE-2)
Static Review
All of the OWASP principles and checks that were static, e.g code review, were conducted. The only finding was that the AndroidManifest.xml allows logging to external (insecure) storage, but it is not used.
...
Potential issue: CROSSED_PATHS still seems to containd contained data not migrated to the secure databsasedatabase
Testing Logs for Sensitive Data (MSTG-STORAGE-3)
ISSUE: Intersection related calcs are logged
Determining Whether Sensitive Data is Sent to Third Parties (MSTG-STORAGE-4)
No issues detected.
Determining Whether the Keyboard Cache Is Disabled for Text Input Fields (MSTG-STORAGE-5)
No such fields
Determining Whether Sensitive Stored Data Has Been Exposed via IPC Mechanisms (MSTG-STORAGE-6)
No providers
Checking for Sensitive Data Disclosure Through the User Interface (MSTG-STORAGE-7)
No issues found.
Testing Backups for Sensitive Data (MSTG-STORAGE-8)
Backup not permitted.
Finding Sensitive Information in Auto-Generated Screenshots (MSTG-STORAGE-9)
In my view, there is no need to prevent people from screenshotting their own exposure history
Checking Memory for Sensitive Data (MSTG-STORAGE-10)
Todo
Testing the Device-Access-Security Policy (MSTG-STORAGE-11)
Todo