I was playing around with the microsoft lync client for android today when I discovered just how insecure the data from your chats are on your phone. I can't understand how it could be allowed in a very controlled corporate environment like you would find in banking, healthcare, etc.
Microsoft admits freely that the conversation history is stored on the device.
What they don't say is that basically, the client stores all of the chats you have a in sqlite database that is pretty much plain text accessible.
Using the android development toolkit and grep (basic free tools) I was able to locate the lync data store on the phone at /data/data/com.microsoft.office.lync/
You can easily pull it off you adb connected device with this. It will grab the data and put in a directory on your local computer called lync.
adb pull /data/data/com.microsoft.office.lync lync
Say you send someone a message with secure data e.g. "the secret pin for my bank account is 1234"
Then someone steals your phone, adb shell into the phone copy the data over the computer or an sd card for safe keeping.
then they can extract whatever they want.
grep -r -a secret com.microsoft.office.lync/databases/DataStore.sqlite
and two minutes later they find
"the secret pin for my bank account is 1234"
So what that it might have a little binary content on either side.
Not only that but lets say you are the investigative, computer type - the app lets you send off any conversation as an email. So any app that accepts email intent (gmail, mail, text messaging, etc) accepts the content and passes it from that app to the world at large. If you have any special controls over your corporate exchange, like outgoing filters to look for sensitive data, they get bypassed going out through something pretty insecure like plain text email or text messaging.
I can see how they wanted to side with convenience. At the same time I can't understand how this can appeal to the customers they tend to appeal to most (government and big business). Why would they not encrypt this data on the phone at least.
I have no idea wonder who catches the bugs and if they just really get the candy all in them so they taste like the candy? Also if the scorpion one is real one would think it could be dangerous as they have venom?