312-50 Question 395
Single answer▪ Mobile Platform Attack VectorsDuring a mobile application security assessment, you are testing an Android banking app used by field employees. The app is configured with android:allowBackup="true", and the target device has USB debugging enabled but is not rooted. The organization wants to understand which attack vector is most likely to expose locally stored sensitive data without exploiting a kernel flaw or unlocking the bootloader. Which action should you identify as the most realistic risk in this scenario?
- A
Use Android Debug Bridge (ADB) backup to extract the app's data and inspect it for tokens, cached credentials, or other sensitive files
- B
Perform a SIM swap attack to retrieve the app's sandboxed private storage directly from the device
- C
Use NFC tag emulation to bypass Android application sandboxing and dump the app's internal database
- D
Exploit the device's GPS service to gain filesystem-level access to the application's private directory
Show answer and explanation
Correct answer: A
Explanation
The most realistic risk here is abuse of Android's backup mechanism through ADB when the app permits backup and the device allows debugging access. In secure mobile app development, sensitive data should not be stored in plaintext in app-private storage, and backup exposure should be considered during threat modeling. Historically, Android's backup behavior and the android:allowBackup attribute have been significant security considerations. Best practices include disabling backup for sensitive apps when appropriate, minimizing local storage of secrets, encrypting sensitive data, and using platform-supported protections such as the Android Keystore. This aligns with common mobile security guidance from Android developer documentation and OWASP Mobile Application Security recommendations, especially around insecure data storage and platform misuse.
- A. Correct.
Correct. If an Android app allows backup via android:allowBackup="true", and the tester has physical or authorized USB access with ADB debugging enabled, ADB backup has historically been a practical attack vector for extracting application data on supported Android versions and app configurations. This can expose sensitive locally stored data such as tokens, cached files, preferences, or databases if the app does not properly protect them. In a CEH context, this is a realistic mobile platform attack vector because it abuses insecure platform/application configuration rather than requiring root, bootloader compromise, or kernel exploitation.
- B. Incorrect.
Incorrect. A SIM swap attack targets phone-number-based authentication and SMS/voice interception, not direct extraction of an app's private sandboxed storage from a device. While SIM swapping is a real mobile-related threat, it does not provide filesystem access to the app's local data in this scenario.
- C. Incorrect.
Incorrect. NFC tag emulation can be relevant to contactless payment, access control, or data exchange scenarios, but it does not bypass Android's application sandbox to dump an internal database. This option reflects a misconception that short-range wireless features inherently grant privileged local access.
- D. Incorrect.
Incorrect. GPS services provide location functionality and do not grant filesystem-level access to private application directories. Exploiting GPS would not be a realistic path to extracting app storage. This distractor targets the misconception that any device service can be pivoted into arbitrary local privilege or data access.