M9:2024: Insecure Data Storage
Sensitive data written to local storage, shared preferences, logs, caches, or backups without encryption, retrievable from a lost, stolen, or rooted device.
How it's found
Identified through device-level inspection for sensitive data written to local storage, logs, or backups without encryption.
Vulnerable vs. safe
SharedPreferences.edit().putString("auth_token", token).apply() // plaintextEncryptedSharedPreferences.create(context, ...).edit().putString("auth_token", token).apply()Standards mapping
How TurboPentest tests for this (white-box)
This weakness (Cleartext Storage of Sensitive Information) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 10 rules for it, flagging the issue directly in your source code as part of the pentest.
Frequently asked questions
What is M9:2024 Insecure Data Storage?
Sensitive data written to local storage, shared preferences, logs, caches, or backups without encryption, retrievable from a lost, stolen, or rooted device.
How do you find Insecure Data Storage?
Identified through device-level inspection for sensitive data written to local storage, logs, or backups without encryption.
Which CWEs map to M9:2024?
M9:2024 maps to CWE-312, CWE-922.
Does TurboPentest test for Insecure Data Storage?
This weakness (Cleartext Storage of Sensitive Information) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 10 rules for it, flagging the issue directly in your source code as part of the pentest.
Related OWASP categories
- OWASP Mobile Top 10M1:2024: Improper Credential Usage
- OWASP Mobile Top 10M2:2024: Inadequate Supply Chain Security
- OWASP Mobile Top 10M3:2024: Insecure Authentication/Authorization
- OWASP Mobile Top 10M4:2024: Insufficient Input/Output Validation
- OWASP Mobile Top 10M5:2024: Insecure Communication
- OWASP Mobile Top 10M6:2024: Inadequate Privacy Controls
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest