Secure Folder 1.2 Unencrypted File Storage Vulnerability

Executive Summary

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree, specifically under the Documents directory. This allows any local application or file manager with access to shared storage to enumerate, copy, and open these files without authenticating to Secure Folder, bypassing the PIN gate.

Useful 0 Not Useful 0

Detection Guidance

Check the Documents directory in Android's shared storage for files with unusual names or extensions. Use a file manager to inspect the .SecureFolder or similar hidden directory. Look for files that should be encrypted but are stored unencrypted.

Useful 0 Not Useful 0

Impact Analysis

An attacker with file manager access or sufficient shared-storage permissions can read and copy vaulted files without the PIN. This defeats the confidentiality claims of the app, exposing sensitive data like photos, documents, contacts, notes, bank card details, and passwords to unauthorized access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance with GDPR and HIPAA due to unauthorized access to unencrypted sensitive data stored in a public directory. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. The exposure of unencrypted files in shared storage undermines these requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Stop using Secure Folder 1.2 immediately. Avoid storing sensitive files in the app until a patch is released. Use alternative encrypted storage solutions. Revoke unnecessary permissions for file managers or apps with shared storage access.

Useful 0 Not Useful 0