x.com/arkann1985/status/2044734843678834991
1 correction found
an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file
On a properly configured non-rooted Android device, another app or attacker cannot simply edit another app’s `shared_prefs` file. Android stores app-private preferences inside the app sandbox, and bypassing that isolation requires a device compromise, root, or an explicitly enabled debugging/sharing path.
Full reasoning
On Android, SharedPreferences are normally opened with Context.MODE_PRIVATE, which makes the preferences file accessible only to that app. Android’s storage docs also state that files in an app’s internal storage are prevented from being accessed by other apps, and that other apps cannot access files stored there.
That matters here because shared_prefs files are part of an app’s private app data area. Official Android security documentation says apps run in a kernel-enforced Application Sandbox and that, by default, apps cannot read another app’s data. It further says that on a properly configured device, breaking out of that sandbox generally requires compromising the Linux kernel.
So, in the context asked by the post — a real non-compromised, non-rooted device — the statement that an attacker can simply remove values from another app’s shared_prefs file is incorrect. That would require some additional condition not stated in the claim, such as root access, a device/kernel compromise, the app explicitly exposing the data, or a documented debugging path enabled by the app/user.
3 sources
- Save simple data with SharedPreferences | Android Developers
The page shows `getSharedPreferences(..., Context.MODE_PRIVATE)` and states this opens the shared preferences file "using the private mode so the file is accessible by only your app." It also notes `MODE_WORLD_READABLE` and `MODE_WORLD_WRITEABLE` are deprecated and throw `SecurityException` on Android 7.0+.
- Access app-specific files | Android Developers
Android’s app-specific storage guide states: "The system prevents other apps from accessing these locations" for internal storage, and "Other apps cannot access files stored within internal storage."
- Application Sandbox | Android Open Source Project
AOSP states Android assigns each app a unique UID and uses it to enforce a kernel-level application sandbox. It says that by default apps cannot read another app’s data, and that on a properly configured device, breaking out of the sandbox generally requires compromising the Linux kernel.