8

I'm looking for a way to be able to encrypt all data written to the WebView cache. Since it has been deprecated, I am attempting to avoid using the CacheManager. My current strategy would be to catch all attempts to write to cache and encrypt the data just prior to writing it and to catch all requests for data from the cache so that I can decrypt the data before returning the data requested.

Sartavius
  • 93
  • 2
  • 6

2 Answers2

6

I guess it is possible to encrypt all your data. But it is probably better practice and security to just clear the data it after use. You are correct that you should not use CacheManager because it is deprecated.

Android Security designs recommends clearing the cache:

If your application accesses sensitive data with a WebView, you may want to use the clearCache() method to delete any files stored locally. Server side headers like no-cache can also be used to indicate that an application should not cache particular content.

from here: http://developer.android.com/guide/practices/security.html

But if you want to encrypt the data you will have to do it manually. So you would need to go to the directory where Android stores its cache and encrypt it yourself. There are different ways to do this depending on what you are trying to accomplish. How and when you do that will be up to you.

Off the top of my head, if you are trying to make a web browser application. the best way to do this is to create a wrapper class for the CookieStore or CookieManager class which could be found here:

http://developer.android.com/reference/java/net/package-summary.html

I hope this helps

wseme
  • 805
  • 6
  • 14
  • 3
    Thanks for the reply. The issue is that we absolutely want to be able to benefit from the use of the cache, but we want to secure it by encrypting any data that is cached so that if the device were stolen there would not be a way to retrieve the WebView's cached data. What I would really like to do is override the WebView's writes to and reads from the cache since all I need to do is encrypt/decrypt the data. The rest of the cache can work as is. – Sartavius Oct 03 '12 at 12:57
1

Currently I'm working on a solution that shall able to encrypt the WebView cache. I'm brainstorming some possible solutions, according to you're thoughts...

Some possible (or not possible) Solutions I faced for now:

1. GoT hook read and write of libchromeXX.so

Pro

  • Deterministic encrypt and decrypt the cache. There won't be any unencrypted data on disk.

Cons

  • Very risky (possible architecture / device specific issues in field, possible android version specific issues, possible webview implementation specific issues)

2. Listen with inotify for fs changes and encrypt jit (just in time). Decrypt on next app launch

Pro

  • Only "public" API

Cons

  • Some android devices might not support "inotify"
  • At runtime the data can be manipulated (sure only with root / system uid and if attacker this permission he might hook stuffs in our process anyway)

3. Create hash over all data or last modified / size combination and store seperately

Pro

  • Only "public" API
  • Maybe faster than encryption

Cons

  • Only verifies if data was manipulated
  • The digest must be stored somewhere?

4. Somehow use ETag mechanism to validate the data

This I researched not that deep right now, but potentially the ETag might represent the hash of a particular resource and we might verifies if the hash matches to server provided digest. We would have to iterate through the cache and search for ETag and resource pairs or is there a browser feature out of the box? I guess not :(

Pro

  • Validation might be out of the box if browser supports it

Cons

  • Potentially not working or not the intended usage of ETag

Isn't there any mechanism that verifies integrity of cached resources?

SarotecK
  • 186
  • 1
  • 6