Add Risk and Test - Sensitive Data Stored Unencrypted in Private Storage Locations [data-unencrypted-private-storage] #2566

thomascannon · 2024-02-21T20:16:16Z

Closes #2544

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-internal/risk.md

cpholguera · 2024-02-22T18:14:59Z

Thanks a lot @thomascannon, I'll give it a proper review as soon as I can.

@serek8 thanks for starting a first review. You and Thomas made very good points there. We need to think about it.

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-internal/risk.md

...GE/1-store-sensitive-data-securely/data-unencrypted-internal/android-data-in-sandbox/test.md

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-internal/risk.md

ZabGo · 2024-02-26T21:26:57Z

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-internal/risk.md

+## Mitigations
+
+- Avoid storing sensitive data locally at all.
+- Use the platform's hardware-backed keystore solution to store the key used for encryption.


Should we offer more options to the users as it's detailed here?

Which ones would you recommend? The main ones aside from keystore it mentions storing it server side which I probably wouldn't recommend in most cases and key derived from user input which could be good if the UX is acceptable (e.g. for a password manager).

We could just reference this whole section which raises another question about this process....should we just be duplicating (and updating) the current published mitigation advice but inside these risks? Or should we reference out to existing advice?

Flagged this to be discussed next week in the call. I think these are supposed to be moved to mitigations documents per the guide but the existing examples don't do that (yet). Also whether we should absorb the info from that link to the MASTG, reference it, or supersede it.

Per the call, for more specific and detailed recommended mitigations we should put them in their own mitigation files and link to them, and keep the high level / generic mitigations here. I'll work on splitting those out and creating mitigation documents based on the additional options @ZabGo linked above.

Thanks @thomascannon and @ZabGo. The mitigations dir is here: https://github.com/OWASP/owasp-mastg/tree/master/mitigations

Keep in mind that ideally we'd like to make these mitigations as generic as possible so that they can be reused. Also note that the mitigations may also be platform-specific.

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-internal/risk.md

cpholguera · 2024-03-15T09:49:37Z

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-internal/risk.md

+## Mitigations
+
+- Avoid storing sensitive data locally at all.
+- Use the platform's hardware-backed keystore solution to store the key used for encryption.


Thanks @thomascannon and @ZabGo. The mitigations dir is here: https://github.com/OWASP/owasp-mastg/tree/master/mitigations

Keep in mind that ideally we'd like to make these mitigations as generic as possible so that they can be reused. Also note that the mitigations may also be platform-specific.

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-internal/risk.md

...GE/1-store-sensitive-data-securely/data-unencrypted-internal/android-data-in-sandbox/test.md

…rypted-internal/risk.md Co-authored-by: Carlos Holguera <[email protected]>

…rypted-internal/risk.md Add refs Co-authored-by: Carlos Holguera <[email protected]>

Co-authored-by: Carlos Holguera <[email protected]>

…he refs section

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-internal/risk.md

cpholguera · 2024-05-01T08:38:08Z

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-internal/risk.md

please also change the directory name to data-unencrypted-private-storage

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-internal/risk.md

cpholguera · 2024-05-01T09:10:37Z

...GE/1-store-sensitive-data-securely/data-unencrypted-internal/android-data-in-sandbox/test.md

@@ -0,0 +1,30 @@
+---
+platform: android
+title: Sensitive Data Written to Private Data Directory (Sandbox) Unencrypted


Suggested change

title: Sensitive Data Written to Private Data Directory (Sandbox) Unencrypted

title: Data Stored in the App Sandbox at Runtime

...GE/1-store-sensitive-data-securely/data-unencrypted-internal/android-data-in-sandbox/test.md

cpholguera · 2024-05-01T09:28:12Z

...GE/1-store-sensitive-data-securely/data-unencrypted-internal/android-data-in-sandbox/test.md

Could you please create an demo directory demo-1/ with an demo.md and the rest of the required files? (see here, and the guidelines)

Co-authored-by: Carlos Holguera <[email protected]>

…a before-snapshot Co-authored-by: Carlos Holguera <[email protected]>

…rypted-internal/risk.md Co-authored-by: Carlos Holguera <[email protected]>

Add Risk and Test for: Data Unencrypted Internal

06a2a0e

thomascannon mentioned this pull request Feb 21, 2024

New Test - data-unencrypted-internal/android-data-in-sandbox/test.md #2567

Open

thomascannon changed the title ~~Add Risk and Test for: Data Unencrypted Internal~~ Add Risk and Test - Sensitive Data Stored Unencrypted in Internal Locations [data-unencrypted-internal] Feb 21, 2024

serek8 reviewed Feb 22, 2024

View reviewed changes

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-internal/risk.md Outdated Show resolved Hide resolved

ZabGo reviewed Feb 26, 2024

View reviewed changes

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-internal/risk.md Outdated Show resolved Hide resolved

ZabGo reviewed Feb 26, 2024

View reviewed changes

...GE/1-store-sensitive-data-securely/data-unencrypted-internal/android-data-in-sandbox/test.md Outdated Show resolved Hide resolved

ZabGo reviewed Feb 26, 2024

View reviewed changes

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-internal/risk.md Outdated Show resolved Hide resolved

ZabGo reviewed Feb 26, 2024

View reviewed changes

thomascannon and others added 3 commits February 27, 2024 18:55

Update to clarify 'not storing data' as a mitigation

acdce08

Merge branch 'OWASP:master' into thomascannon/issue2544

c469c44

Update risk.md to make mitigation generic

21df242

cpholguera requested changes Mar 15, 2024

View reviewed changes

thomascannon and others added 6 commits April 2, 2024 12:02

Update risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unenc…

a29fb63

…rypted-internal/risk.md Co-authored-by: Carlos Holguera <[email protected]>

Update risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unenc…

c4ebaf2

…rypted-internal/risk.md Add refs Co-authored-by: Carlos Holguera <[email protected]>

Fix typo in title

ed8f910

Co-authored-by: Carlos Holguera <[email protected]>

Adding link to a technique from test.md

df64230

Update observation and evaluation in test.md

c398e90

Update risk.md to remove "further documentation" as they are now in t…

bb794de

…he refs section

cpholguera assigned thomascannon Apr 27, 2024

cpholguera requested changes May 1, 2024

View reviewed changes

cpholguera changed the title ~~Add Risk and Test - Sensitive Data Stored Unencrypted in Internal Locations [data-unencrypted-internal]~~ Add Risk and Test - Sensitive Data Stored Unencrypted in Private Storage Locations [data-unencrypted-private-storage] May 1, 2024

cpholguera added the changes-requested label May 2, 2024

thomascannon and others added 7 commits May 7, 2024 13:37

Updating test.md with Carlos' suggestions

ea50af4

Co-authored-by: Carlos Holguera <[email protected]>

Update Internal -> Private Storage

8585fc9

Co-authored-by: Carlos Holguera <[email protected]>

Update Internal -> Private Storage

9782a76

Co-authored-by: Carlos Holguera <[email protected]>

Update with new term Private Storage

cb57040

Co-authored-by: Carlos Holguera <[email protected]>

Update to relative directory path

0a76eb1

Co-authored-by: Carlos Holguera <[email protected]>

Update test.md Overview with Carlos' suggestion

f1a713c

Co-authored-by: Carlos Holguera <[email protected]>

Update test.md links with relative paths and add a test step to take …

22d79f5

…a before-snapshot Co-authored-by: Carlos Holguera <[email protected]>

thomascannon and others added 3 commits May 7, 2024 13:44

Update risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unenc…

1aef397

…rypted-internal/risk.md Co-authored-by: Carlos Holguera <[email protected]>

Correct numbering in test.md

f1f9c27

Merge branch 'OWASP:master' into thomascannon/issue2544

09f2530

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Risk and Test - Sensitive Data Stored Unencrypted in Private Storage Locations [data-unencrypted-private-storage] #2566

Add Risk and Test - Sensitive Data Stored Unencrypted in Private Storage Locations [data-unencrypted-private-storage] #2566

thomascannon commented Feb 21, 2024

cpholguera commented Feb 22, 2024

ZabGo Feb 26, 2024

thomascannon Feb 26, 2024

thomascannon Feb 27, 2024

thomascannon Mar 5, 2024

cpholguera Mar 15, 2024

cpholguera Mar 15, 2024

cpholguera May 1, 2024

cpholguera May 1, 2024 •

edited

cpholguera May 1, 2024 •

edited

	title: Sensitive Data Written to Private Data Directory (Sandbox) Unencrypted
	title: Data Stored in the App Sandbox at Runtime

Add Risk and Test - Sensitive Data Stored Unencrypted in Private Storage Locations [data-unencrypted-private-storage] #2566

Are you sure you want to change the base?

Add Risk and Test - Sensitive Data Stored Unencrypted in Private Storage Locations [data-unencrypted-private-storage] #2566

Conversation

thomascannon commented Feb 21, 2024

cpholguera commented Feb 22, 2024

ZabGo Feb 26, 2024

Choose a reason for hiding this comment

thomascannon Feb 26, 2024

Choose a reason for hiding this comment

thomascannon Feb 27, 2024

Choose a reason for hiding this comment

thomascannon Mar 5, 2024

Choose a reason for hiding this comment

cpholguera Mar 15, 2024

Choose a reason for hiding this comment

cpholguera Mar 15, 2024

Choose a reason for hiding this comment

cpholguera May 1, 2024

Choose a reason for hiding this comment

cpholguera May 1, 2024 • edited

Choose a reason for hiding this comment

cpholguera May 1, 2024 • edited

Choose a reason for hiding this comment

cpholguera May 1, 2024 •

edited

cpholguera May 1, 2024 •

edited