Case UC-03 · OWASP M9 Insecure Data Storage

Clear-text authentication token stored on the device

After login the app stored a long-lived authentication token in clear text in app storage, with no keystore protection and no backup exclusion - a portable account key for anyone who could read the device.

This article documents a representative, anonymised mobile application security case. It describes the weakness, why it matters to a business, how Mobexa detects it, and how to remediate it. No specific application, company or individual is identified.

Contents

  1. Context
  2. What the research team found
  3. Why it matters
  4. How Mobexa surfaces it
  5. Remediation
  6. Standards mapped

1 Context

After login, the app persisted a long-lived authentication token in a local preferences and file store in clear text, with no platform keystore protection and no flag to exclude it from device backups. The token remained valid until it expired server-side.

2 What the research team found

Static and storage analysis recovered the token from on-device state. Anything able to read app storage - a malicious app on a rooted device, a forensic extraction, or a cloud device backup - obtains a credential that grants access to the account without the password or a second factor.

3 Why it matters

A token at rest is a portable account key. Combined with a long lifetime and inclusion in backups, one device compromise yields durable access, and the user has no signal that it occurred. Storage flaws of this kind remain among the most frequently observed mobile issues.

4 How Mobexa surfaces it

Mobexa inspects on-device storage written during a dynamic run, flags secrets and tokens stored without keystore-backed encryption, and checks backup-eligibility flags, reporting each under M9 with the storage path involved.

5 Remediation

Store tokens only in the platform keystore or keychain, keep lifetimes short with server-side rotation, exclude sensitive files from backups, and bind sessions to device signals so that a copied token alone is insufficient to take over an account.

6 Standards mapped

Table 1. Frameworks and references for this case
FrameworkReference
OWASP Mobile Top 10 (2024) M9 Insecure Data Storage
CWE CWE-312 Cleartext Storage of Sensitive Information
OWASP MASVS MASVS-STORAGE
storagetokenssession

See also

Documented by the Mobexa research team. This case is anonymised and provided for educational use; the mapping references the OWASP Mobile Top 10 (2024).