As we already studied, the iOS application interacts with local system in order to store persistent/temporary data and SQLite is the most preferred format to store persistent data.
Unless you are using encrypted variant of SQLite, the data stored in simple SQLite file is not secure. An attacker having access to the SQLite file can view its contents using any SQLite client.
Let's follow the given steps to find the insecure storage in SQLite files:
Start the Insecure Local Storage exercise from iGoat and it will look as follows:
Enter the credentials and select the Login option:
Download application files from
/var/mobile/Containers/Data/Application
and navigate to theDocuments
folder in order to see the contents of thecredentials.sqlite
file.You can see the user's credentials stored in plain text, as shown in the following screenshot:
So the developers should never use simple SQLite files to store sensitive data. You can make use of SQLCipher to encrypt the...