2

I have found that when an app is in use and correct information is provided to it from a user, the information doesn't allow a successful login. However, by clearing app cache, the login is successful without restart.

Hence, it looks like it's possible for the data to get into cache, and hence affect the working of application.

My initial thought is that this could be a possible attack vector.

I have searched on google and this site, but could not find much information on Security of App Caches on the Android OS.

I have found the following thus far: https://www.owasp.org/index.php/OWASP_Mobile_Security_Project_-_Android

Questions:

  1. How does the App Cache of Apps work on android?

  2. What security features (if any) are present on Android, that would mitigate data from getting into the app cache from either local or remote sources? How do the security features work?

  • Which app did show this behavior? Also, since the cache is prone to being overwritten at any moment, I (as an attacker) would scarcely benefit from it, as I would need to dump the cache in the very moment you input some data. Better to fetch you a modified APK, or hijack your session to sniff your credentials in plaintext, instead. – Death Mask Salesman Jul 10 '17 at 12:03
  • @deathmasksalesman the app was PartyPoker. Version: 4.4.0. – unseen_rider Jul 10 '17 at 17:22
  • @deathmasksalesman how could one dump the cache of an apk remotely? – unseen_rider Jul 10 '17 at 17:24
3
+25

The "cache" of an app is just a directory inside that app's data directory in /data/data, so there are no special security implications compared with the app's general data. The cache directory has the same permissions as the data directory enclosing it: no other apps can access it, and the user can't access it directly (via adb or a PC), unless the phone is rooted (or the app itself exposes access).

From an OS point of view, the only difference between an app's "data" and its "cache" is that there's an extra button to clear the cache, with the expectation that no user data will be lost that way. They're both treated the same way by the OS, and it's entirely up to the app what data to store in each.

  • Ok. Are there any wireless attacks that could mess with the cache of an android app / directory? – unseen_rider Jul 21 '17 at 18:25
  • Only if the attack can somehow privilege-escalate to get root; then it can do whatever it likes. There are no end of malicious programs that trick the user into letting them root the phone. – Dan Hulme Jul 22 '17 at 9:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.