Description

Detects when Android applications have data backups enabled either explicitly or by default in the AndroidManifest.xml file. When backups are enabled, sensitive application data could be exposed through the backup system, potentially allowing unauthorized access to private information.

Detection Strategy

• Scans AndroidManifest.xml files for the <application> tag configuration

• Reports a vulnerability if android:allowBackup attribute is missing since this defaults to enabled backups

• Reports a vulnerability if android:allowBackup is explicitly set to 'true'

• The check applies to both full manifest files and partial application configurations

Vulnerable code example

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.example.app">
    
    <application
        android:allowBackup="true">  <!-- Vulnerable: Allows unauthorized backup/restore of app data -->
    </application>
...

✅ Secure code example

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.example.app">
    
    <application
        android:allowBackup="false">  <!-- Secure: Prevents unauthorized backup/restore of app data -->
    </application>
...