Read take a look at the idea of insecure logging when
we're actually working with applications on
Android devices were able to log things
into the log catalogs of our device. Know
it would be a lot of things to these laws. You have to
be careful of what sort of information to writing to them because we could
potentially expose information. At. Is sensitive. So
we're going to take a look at what this would usually
look like inside of an application and how we can stir to find
his vulnerabilities and determine if they exist. So for
someone to explain a little bit about
what does vulnerability is, and why it's important. So there
exists, a general logging area
on Android devices, that is typically referred
to as a log cat here.
So you could see shared that information is being
logged into this log and the sluggish shared by
which, we all the applications on the
actual device itself. And you can write things to the log fairly
easily. You think some built-in functions inside of
the Android, the Android development modules,
right? So you'll be able to, actually right information
to these debugging logs. Not only, can you write to
them, but you can also read them to see if a specific error has occurred.
The reason why we don't want to login, any sensitive
information to this is Sir to fold for one. As you can
see here. I can easily access the log cat likes, just
by having the device plugged into my computer or by
having the device running through an emulator on my computer, but
more. So that was important to
this is that somebody can actually create an app that can
read this log catalog. That means in terms, they can
read any messages that are logged here. So, if you,
for instance, are logging information about a user's password, or
something like that, if I have an application that sleep
Sniffing the log file on. This person's device. I'll be
able to see that information as well. Since you some context behind
dump. What does vulnerability really
is, and why it's important. So it's not really, just a matter of
like logging information that is sensitive such as I can epit or
something like that. That someone might see from, you know, we can
get the logs. It's also a matter of someone, you
know, what, third-party sort of like sniffing the log of
a random device to grab information about the user. So
they give you an example of this. Let's go ahead and
open up our Diva application.
I'm going to insecure logging and I'm
going to demonstrate to you. What exactly this could look like.
So you see here and here we want to enter credit card information
going to put in my credit card information and price.
When I do this, you're going
to see right here that there's an error message
that gets processed. It says error, while processing transaction
with credit card and then it prints out. The credit card
number to this is something that we want to avoid. This
would be an example of insecure logging. And the
reason being again is because if we have a third-party application, that's
a sniffing this log, if they see this error message,
it exposes the credit card information of the user. So
this is extremely bad because obviously, then
people can potentially have an information disclosure. They
could end up showing information to someone else. That
shouldn't your information will be able to compromise the message, right?
So we can take a look at the source code of this. That we've decompile
to get a bit of an idea of what this is
actually looking like in the code, just give you an idea
of what three things. You can look out for for this.
So we have this log activity. This this method
here log. He is what
happens when were trying to login error message. So there's like a
log. E4 error. I think log. D is debug and
there's probably a few other ones. They're very common. And as
you can see here, it gives the actual error message, and you
can see it actually writes in whatever is inside of the text box of the,
of the credit card filled. So you can see this
is what the actual log message looks like. So if we're looking
for these sort of instances, we can look for like a log. He
or log daddy, and he will show us where
the logs are being written to the actual to the
device lock itself. And then, from there, you can
try triggering. These are looking at what is actually being logged
to determine if that information is a sensitive data
or not. So common sense it, if they don't include things like
passwords and usernames that credit card
details, obviously personal details related to
that. The application would be a common
one on even be debate.
People named said, databases in general.
This sort of information leakage is the kind of stuff
that we want to make sure isn't happening in your application. So this
would be an example of insecure logging. So it
gives you an idea of what this vulnerability looks like and how to actually detect
it in an application.