4- Insecure Data Storage - Part 2

InsecureDataStorage2Activity.java

package jakhar.aseem.diva;

import android.content.Context;
import android.database.sqlite.SQLiteDatabase;
import android.os.Environment;
import android.support.v7.app.AppCompatActivity;
import android.os.Bundle;
import android.util.Log;
import android.view.View;
import android.widget.EditText;
import android.widget.Toast;

import java.io.File;

public class InsecureDataStorage2Activity extends AppCompatActivity {

    private SQLiteDatabase mDB;
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        try {
            mDB = openOrCreateDatabase("ids2", MODE_PRIVATE, null);
            mDB.execSQL("CREATE TABLE IF NOT EXISTS myuser(user VARCHAR, password VARCHAR);");
        }
        catch(Exception e) {
            Log.d("Diva", "Error occurred while creating database: " + e.getMessage());
        }

        setContentView(R.layout.activity_insecure_data_storage2);
    }

    public void saveCredentials(View view) {
        EditText usr = (EditText) findViewById(R.id.ids2Usr);
        EditText pwd = (EditText) findViewById(R.id.ids2Pwd);
        try {
            mDB.execSQL("INSERT INTO myuser VALUES ('"+ usr.getText().toString() +"', '"+ pwd.getText().toString() +"');");
            mDB.close();
        }
        catch(Exception e) {
            Log.d("Diva", "Error occurred while inserting into database: " + e.getMessage());
        }
        Toast.makeText(this, "3rd party credentials saved successfully!", Toast.LENGTH_SHORT).show();


    }
}

Si observamos el código se crea una db con openOrCreateDatabase("ids2")

Por defecto estas dbs se guardan en

/data/data/jakhar.aseem.diva/databases/

adb shell
su

cd /data/data/jakhar.aseem.diva/databases/

cp ids2 /sdcard/ids2

adb pull /sdcard/ids2

Mismo problema que el reto anterior: posible acceso root o con debug, por forense físico, backups ...