Lab Automated static analysis: Allow Backup Check

[blawrencensdemo]

Summary

Platform: android
Package: bscorp.appbase

Checks to determine whether the allowBackup flag within the Android Manifest is set to False. If this flag is enabled, it could allow easier access to the application files stored on the device.

Risk and Regulatory information

Severity: medium
CVSS: 4.6

CWE: 538, 359
OWASP: Mobile Top 10: M10-Extraneous Functionality
NIAP: FPT_AEX_EXT.1.3

Details

Your application is declaring the allowBackup flag as true in the Android Manifest (or using the Android default value, which is true as well). This can allow an attacker to backup your application folder and recover private data from it.

Recommendation

Unless required by your app to run, it is recommended to explicitly set the allowBackup flag to false in the Android Manifest.

View more details in Lab Automated: https://lab.nowsecure.com/app/android/bscorp.appbase/assessment/1521666897889