[MASWE-0007] Sensitive Data Stored Unencrypted in Shared Storage Requiring No User Interaction

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-external/android-data-unencrypted-external-frida/example-1/example.md

@@ -0,0 +1,30 @@
+---
+platform: android
+title: File Tracing
+tools: [frida-trace]
+code: [kotlin]
+---
+
+### Sample
+
+The snippet below shows sample code that creates a file in external storage. You can put this code into your app and follow the steps to see a sample usage of `frida-trace` to identify a potential data leak.
+
+{{ snippet.kt }}
+
+### Steps
+
+Execute `frida-trace` against the sample app to trace all usage of file IO.
+
+{{ run.sh }}
+
+### Observation
+
+`frida-trace` has identified one file path in the external storage that the app opened.
+
+{{ output.txt }}
+
+### Evaluation
+
+Review each of the reported instances by manually opening a file and inspecting its content.
+
+NOTE: If you want to test more file locations than only the file locations inside the external storage, remove `grep` from the script.

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-external/android-data-unencrypted-external-frida/example-1/output.txt

@@ -0,0 +1 @@
+638 ms  open(path="/storage/emulated/0/Android/data/com.example/files/secret.json", oflag=0x241)

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-external/android-data-unencrypted-external-frida/example-1/run.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# SUMMARY: This script uses frida-trace to trace files that an app has opened since it spawned
+# The script filters the output of frida-trace to print only the paths belonging to external
+# storage but the the predefined list of external storage paths might not be complete.
+# A sample output is shown in "output.txt". If the output is empty, it indicates that no external
+# storage is used.
+
+frida-trace \
+    -U \
+    -f com.example \
+    -i "open" \
+    | grep -E "(/sdcard|/storage)"

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-external/android-data-unencrypted-external-frida/example-1/snippet.kt

@@ -0,0 +1,7 @@
+// On lower Android verions, you might need to add `WRITE_EXTERNAL_STORAGE` permission to the manifest to write to an external app-specific directory.
+
+val externalDirPath = getExternalFilesDir(null)!!.absolutePath
+val file: File = File("$externalDirPath/secret.json")
+FileOutputStream(file).use { fos ->
+    fos.write("password:123".toByteArray())
+}

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-external/android-data-unencrypted-external-frida/test.md

@@ -0,0 +1,37 @@
+---
+platform: android
+title: Storing Data in External Locations
+apis: [Environment#getExternalStorageDirectory, Environment#getExternalStorageDirectory, Environment#getExternalFilesDir, Environment#getExternalCacheDir, SharedPreferences, FileOutPutStream]
+type: [dynamic]
+---
+
+## Overview
+
+Android apps utilize a variety of APIs to obtain a file path and save a file. Collecting a comprehensive list of these APIs can be challenging, especially when an app employs a third-party framework, loads code at runtime, or incorporates native code. Therefore, dynamic testing might be the most effective approach to find writing to the external storage.
+
+## Steps
+
+1. Install the app.
+
+2. Execute a [method trace](https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-00xx/) to spawn an app and log all interactions with files.
+
+3. Navigate to the screen of the mobile app that you want to analyse. 
+
+4. Close the app to stop `frida-trace`
+
+
+## Observation
+
+The **method trace output** contains a list of file locations that your app interacts with. You may need to use [adb shell](https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0002/) to inspect these files manually.
+
+## Evaluation
+
+The test case fails if the files found above are not encrypted and leak sensitive data.
+
+For example, the following output shows sample files that should be manually inspected.
+
+```shell
+/storage/emulated/0/Android/data/com.example/keys.json
+/storage/emulated/0/Android/data/com.example/files/config.xml
+/sdcard/secret.txt"
+```

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-external/android-data-unencrypted-external-static-manifest/example-1/AndroidManifest.xml

@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
+
+    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
+    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
+
+    <application
+        android:allowBackup="true"
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        android:fullBackupContent="@xml/backup_rules"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/app_name"
+        android:roundIcon="@mipmap/ic_launcher_round"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.MyKotlin"
+        tools:targetApi="31">
+        <activity
+            android:name=".MainActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+
+</manifest>

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-external/android-data-unencrypted-external-static-manifest/example-1/example.md

@@ -0,0 +1,29 @@
+---
+platform: android
+title: Common APIs to return paths to External Storage
+tools: [semgrep]
+code: [java]
+---
+
+### Sample
+
+{{ use-of-external-store.kt }}
+
+### Steps
+
+Let's run our semgrep rule against the sample manifest file.
+
+{{ ../rules/mastg-android-data-unencrypted-external-manifest.yml }}
+
+{{ run.sh }}
+
+### Observation
+
+The rule has identified that the manifest file declares `WRITE_EXTERNAL_STORAGE` permission at line 9.
+
+{{ output.txt }}
+
+### Evaluation
+
+Review your code to make sure you don't store sensitive unencrypted data in the external storage unintentionally.
+

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-external/android-data-unencrypted-external-static-manifest/example-1/output.sarif

@@ -0,0 +1,44 @@
+{
+  "$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json",
+  "runs": [
+    {
+      "invocations": [
+        {
+          "executionSuccessful": true,
+          "toolExecutionNotifications": []
+        }
+      ],
+      "results": [],
+      "tool": {
+        "driver": {
+          "name": "Semgrep OSS",
+          "rules": [
+            {
+              "defaultConfiguration": {
+                "level": "warning"
+              },
+              "fullDescription": {
+                "text": "[MASVS-STORAGE] Make sure you encrypt files in external storage if necessary"
+              },
+              "help": {
+                "markdown": "[MASVS-STORAGE] Make sure you encrypt files in external storage if necessary",
+                "text": "[MASVS-STORAGE] Make sure you encrypt files in external storage if necessary"
+              },
+              "id": "rules.mastg-android-data-unencrypted-external",
+              "name": "rules.mastg-android-data-unencrypted-external",
+              "properties": {
+                "precision": "very-high",
+                "tags": []
+              },
+              "shortDescription": {
+                "text": "Semgrep Finding: rules.mastg-android-data-unencrypted-external"
+              }
+            }
+          ],
+          "semanticVersion": "1.63.0"
+        }
+      }
+    }
+  ],
+  "version": "2.1.0"
+}

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-external/android-data-unencrypted-external-static-manifest/example-1/output.txt

@@ -0,0 +1,11 @@
+
+
+┌────────────────┐
+│ 1 Code Finding │
+└────────────────┘
+
+    AndroidManifest.xml
+    mrules.mastg-android-data-unencrypted-external
+          [MASVS-STORAGE] Make sure you encrypt files in external storage if necessary
+
+            5┆ <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-external/android-data-unencrypted-external-static-manifest/example-1/run.sh

@@ -0,0 +1,2 @@
+NO_COLOR=true semgrep -c ../rules/mastg-android-data-unencrypted-external-manifest.yml ./AndroidManifest.xml --text -o output.txt
+NO_COLOR=true semgrep -c ../rules/mastg-android-data-unencrypted-external-manifest.yml ./AndroidManifest.xml --sarif -o output.sarif

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-external/android-data-unencrypted-external-static-manifest/rules/mastg-android-data-unencrypted-external-manifest.yml

@@ -0,0 +1,10 @@
+rules:
+  - id: mastg-android-data-unencrypted-external-manifest
+    severity: WARNING
+    languages:
+      - generic
+    metadata:
+      summary: This rule looks for permissions that allows your app to write in External Storage
+    message: "[MASVS-STORAGE] Make sure you encrypt files in external storage if necessary"
+    patterns:
+      - pattern: WRITE_EXTERNAL_STORAGE

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-external/android-data-unencrypted-external-static-manifest/test.md

@@ -0,0 +1,23 @@
+---
+platform: android
+title: Declaration of the external storage permission
+apis: []
+type: [static]
+---
+
+## Overview
+
+An app must declare an intent to write to external storage in order to save files in the public locations.
+
+## Steps
+
+1. Run a [static analysis](../../../../../techniques/android/MASTG-TECH-0014.md) tool on the app and look for a use of sensitive permissions.
+
+
+## Observation
+
+The output shows that the manifest files declares `WRITE_EXTERNAL_STORAGE` permission at line 5.
+
+## Evaluation
+
+Inspect app's source code to make sure the data stored externally is secure.

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-external/android-data-unencrypted-external-static/example-1/example.md

@@ -0,0 +1,32 @@
+---
+platform: android
+title: Find common APIs that return paths to External Storage locations
+tools: [semgrep]
+code: [java]
+---
+
+### Sample
+
+{{ use-of-external-store.kt }}
+
+### Steps
+
+Let's run our semgrep rule against the sample code.
+
+{{ ../rules/mastg-android-data-unencrypted-external.yml }}
+
+{{ run.sh }}
+
+### Observation
+
+The rule has identified 1 location in the code file where a path to external storage is retuened. Make sure you don't store unencrypted code there unintentionally.
+
+{{ output.txt }}
+
+### Evaluation
+
+Review each of the reported instances. In this case, it's only one instance. Line 9 shows the occurence of API that returns external storage location. Make sure to either:
+- encrypt this file if necessary
+- move the file to the internal storage
+- keep the file in the same location if intended and secure
+

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-external/android-data-unencrypted-external-static/example-1/output.sarif

@@ -0,0 +1,74 @@
+{
+  "$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json",
+  "runs": [
+    {
+      "invocations": [
+        {
+          "executionSuccessful": true,
+          "toolExecutionNotifications": []
+        }
+      ],
+      "results": [
+        {
+          "fingerprints": {
+            "matchBasedId/v1": "7fff0cca477ae1b0a93a5b8e265d8a7471c4144464dcbbd55d7256be707b55568882a55bbac36d334816deb905d562cb7f9c4cee168fb02f8ca6f31936c62fb7_0"
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "use-of-external-store.kt",
+                  "uriBaseId": "%SRCROOT%"
+                },
+                "region": {
+                  "endColumn": 101,
+                  "endLine": 26,
+                  "snippet": {
+                    "text": "            val externalDirPath = getExternalStoragePublicDirectory(Environment.DIRECTORY_DOWNLOADS)"
+                  },
+                  "startColumn": 35,
+                  "startLine": 26
+                }
+              }
+            }
+          ],
+          "message": {
+            "text": "[MASVS-STORAGE] Make sure you encrypt files at these locations if necessary"
+          },
+          "properties": {},
+          "ruleId": "rules.mastg-android-data-unencrypted-external"
+        }
+      ],
+      "tool": {
+        "driver": {
+          "name": "Semgrep OSS",
+          "rules": [
+            {
+              "defaultConfiguration": {
+                "level": "warning"
+              },
+              "fullDescription": {
+                "text": "[MASVS-STORAGE] Make sure you encrypt files at these locations if necessary"
+              },
+              "help": {
+                "markdown": "[MASVS-STORAGE] Make sure you encrypt files at these locations if necessary",
+                "text": "[MASVS-STORAGE] Make sure you encrypt files at these locations if necessary"
+              },
+              "id": "rules.mastg-android-data-unencrypted-external",
+              "name": "rules.mastg-android-data-unencrypted-external",
+              "properties": {
+                "precision": "very-high",
+                "tags": []
+              },
+              "shortDescription": {
+                "text": "Semgrep Finding: rules.mastg-android-data-unencrypted-external"
+              }
+            }
+          ],
+          "semanticVersion": "1.63.0"
+        }
+      }
+    }
+  ],
+  "version": "2.1.0"
+}

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-external/android-data-unencrypted-external-static/example-1/output.txt

@@ -0,0 +1,9 @@
+┌────────────────┐
+│ 1 Code Finding │
+└────────────────┘
+
+    use-of-external-store.kt
+    rules.mastg-android-data-unencrypted-external 0m
+          [MASVS-STORAGE] Make sure you encrypt files at these locations if necessary
+
+           26┆ val externalDirPath = getExternalStoragePublicDirectory(Environment.DIRECTORY_DOWNLOADS)

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-external/android-data-unencrypted-external-static/example-1/run.sh

@@ -0,0 +1,2 @@
+NO_COLOR=true semgrep -c ../rules/mastg-android-data-unencrypted-external.yml ./use-of-external-store.kt --text -o output.txt
+NO_COLOR=true semgrep -c ../rules/mastg-android-data-unencrypted-external.yml ./use-of-external-store.kt --sarif -o output.sarif