Google Advises Android Developers to Encrypt App Data On Device

Moreover, considering that there are not many reference
frameworks available for the same, Google also advised using an
easy-to-implement security
library^[1] available as part of its
Jetpack software suite.

The open-sourced Jetpack
Security^[2] (aka JetSec) library
lets Android app developers easily read and write encrypted files
by following best security
practices^[3], including storing
cryptographic keys and protecting files that may contain sensitive
data, API keys, OAuth tokens.

To give a bit of context, Android offers developers two different ways
to save app data. The first one is app-specific storage, also known
as internal storage, where the files are stored in a sandboxed
folder meant for a specific app’s use and inaccessible to other
apps on the same device.
^[4]

The other is shared storage, also known as external storage, which
sits outside the sandbox protection and is often used to store
media and document files.

However, it has been found that the majority of the apps use
external storage to store sensitive and private data on users and
don’t take adequate measures to protect it from other apps,
allowing attackers to steal photos and
videos^[5], and tamper
files^[6] (called “Media File
Jacking”).

The consequences of the same were demonstrated two years back
with the “man-in-the-disk^[7]” attacks that make it
possible for attackers to compromise an app by manipulating certain
data being exchanged between it and the external storage.

Another research demonstrated a side-channel
attack^[8] using which attackers
can secretly take pictures and record videos — even when they don’t
have specific device permissions to do so, but only by leveraging
access to the device’s external storage.

To prevent such attacks, Android 10 ships with a feature called
‘Scoped Storage‘ that sandboxes each app’s data in the
external storage as well, thereby limiting apps from accessing data
saved by other apps on your device. But JetSec library takes it one
step further by offering an easy-to-use solution to encrypt data
for an extra level of protection.

“If your app uses shared storage, you should encrypt the data,” the
company
outlined. “In the app home directory, your app should encrypt
data if your app handles sensitive information including but not
limited to personally identifiable information (PII), health
records, financial details, or enterprise data.”

What’s more, Google is also recommending that app developers
should combine encryption with biometric
information^[10] for added security and
privacy.

The Jetpack Security library was originally previewed last May
at its annual developer conference. It comes as part of an
expansion of Android Jetpack^[11], a collection of
Android software components that helps developers follow best
practices and design high-quality apps.

^[9]