Android Storage Security

Android applications may store information using SharedPreferences,
SQLite databases, internal files, and external storage. Sensitive
information stored insecurely may be exposed to attackers or other
applications depending on the storage mechanism and device state.

SharedPreferences:
SharedPreferences are commonly used for storing application settings
and small amounts of persistent data.

Sensitive data should not be stored in plaintext SharedPreferences
without appropriate protection. Authentication tokens, passwords,
cryptographic keys, and other sensitive information may be exposed if
they are stored insecurely.

SQLite:
SQLite databases may contain application data, user information,
authentication information, or other sensitive records.

Sensitive SQLite data should be protected appropriately. Database
contents should be reviewed when they contain credentials, tokens,
personal information, or other security-sensitive data.

Internal File Storage:
Application internal storage is normally protected by Android's
application sandbox. However, sensitive information stored in plaintext
may still become exposed if the application is compromised, backed up,
or otherwise accessed through a security weakness.

External Storage:
External storage may provide weaker isolation than application-private
storage. Sensitive information should generally not be stored there
without appropriate protection.

Plaintext Sensitive Data:
Sensitive information such as passwords, authentication tokens, API
credentials, personal information, and cryptographic keys should not
be stored in plaintext when stronger protection is required.

Sensitive Storage Evidence:
Static analysis may indicate that an application uses SharedPreferences,
SQLite, or file storage, but usage alone does not establish a
vulnerability.

Dynamic Evidence:
Runtime storage inspection provides stronger evidence when it shows
that sensitive data was actually written to or retrieved from storage.

Sensitive Data Indicators:
Fields such as has_sensitive_data can indicate that extracted storage
contents contain information considered sensitive.

Runtime Hooks:
Runtime hooks can reveal keys, values, file paths, database operations,
or other storage activity. Such evidence should be correlated with the
actual data being handled.

Storage Security Assessment:
The security impact depends on what data is stored, whether it is
encrypted or otherwise protected, who can access it, and how the
application handles the data.

Important:
The use of SharedPreferences, SQLite, internal files, or external files
does not automatically indicate a vulnerability.