Backup Enabled

Description

If backups are enabled by default, app data (shared preferences, databases, files) may be included in device or cloud backups, exposing sensitive information outside the device’s protection.

Examples

Detect Backup Settings (Android)

apkanalyzer manifest print app-release.apk | rg -n "allowBackup|fullBackupContent"

Extract Android Backup

adb backup -f app.ab -noapk com.example.app
java -jar abe.jar unpack app.ab app.tar
tar -tf app.tar | rg -i "shared_prefs|databases"

Remediation

1. Disable or scope backups
   • Set android:allowBackup="false" or explicitly exclude sensitive files via fullBackupContent.
2. Encrypt sensitive data
   • Use Keystore/Keychain; avoid storing secrets in backups entirely.
3. Detect and rotate
   • On restore, rotate tokens/keys and re‑establish trust.