Android Application Backup Allowed

ID

kotlin.android_application_backup_allowed

Severity

low

Resource

Information Leak

Language

Kotlin

Tags

CWE:312, NIST.SP.800-53, android

Description

Allowing application backup can inadvertently expose sensitive user data, posing a security risk.

Rationale

When android:allowBackup is set to true, it lets the Android system backup app data. While this feature is useful for restoring data, it can also lead to exposure of sensitive information if not properly managed. Unauthorized users with device access could potentially exploit this to extract sensitive data.

To mitigate this risk, it’s essential to carefully assess the necessity of enabling backups in your application, especially when dealing with sensitive information.

<application
    android:allowBackup="true"
    ... >
    ...
</application>

Remediation

To enhance security, explicitly set android:allowBackup to false in your application’s manifest file. This prevents the system from backing up your app’s data, reducing the risk of data leaks.

<application
    android:allowBackup="false"
    ... >
    ...
</application>

References