-1

I'm an Android apps developer. I'm trying to address a security concern in one of my apps.

I need to test a scenario in which someone will try to copy the shared prefs file (or files) from one Android device to another in order to have the same state that the original user has and use the app as if he is the original user (hijack his existing sessions for instance).

I tried to copy the shared prefs file from one device to another (where I had installed a fresh copy of the app with an empty shared prefs file). Copied the file from the original device using adb , copied it to the sd card of the target device and move it to the right shared prefs directory using a file management app with root privileges. This didn't work.

When I start the app on the target device - I can see that the shred prefs file get "rolled-back" to its initial form. Maybe Android has some kin of mechanism to prevent manipulation of an app's files/data.

So my question is - how can I test this scenario in other ways? any way to transfer the shares prefs from one device to another ?

Thanks!

  • define hacker, xD – moonbutt74 Jan 10 '16 at 8:51
  • Hacker - an evil tech person who wants to steal the user's session or state from an app by accessing his device , getting his prefs file and copying it onto another device. – FunkSoulBrother Jan 10 '16 at 9:20
  • 1
    There is more data inside the prefs file and because it doesn't fit your device (different serial no. for instance) it deletes the whole file. This can have many reasons: Incompatibility, Configuration, Security even. Maybe the server even refused to accept the session and already invalidated it. It all depends on the app and the developer. – GiantTree Jan 10 '16 at 11:37
  • In this case - I am the developer responsible for this app. I've gone over the code and verified it does not reset the prefs file. I work with the server side team so I know for a fact that it is not the server that causes the file to be reset. I've disconnected the device from the network and the app behaves exactly the same. The data inside the prefs file is encrypted and it would be difficult to decrypt but the scenario i'm examining is not that of information loss but app "duplication" by copying to another device. thanks for your comment. – FunkSoulBrother Jan 10 '16 at 11:58
0

Normally you need to copy de data folder from app.

Every app cotains cache to restore you own data. If you run your app > generates a shared prefs > minimize/close app > and remove that shared prefs. When you open/resume the app, the system restore that sessiom data from the cache. Somethimes, this depends of the size and content from sharedprefs.

If you are worried about "hack" your app you can protect the saved data with some encrypt method. like base64 + salt, hash + salt, or any method what you want. Reversible or not.

Or simple you can storage your persistent data in a custom path/file and protect how you can with above methods.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.