We're going to take a look at the idea of insecure logging when we're actually working with applications
on Android devices we're able to log things into the log catalogs of our device.
Now when we log things to these logs we have to be careful of what sort of information or writing to
them because they could potentially expose information that is sensitive.
So we're going to take a look at what this would usually look like instead of an application and how
we can sort of find these vulnerabilities and determine if they exist.
So first I want to explain a little bit about what this vulnerability is and why it's important.
So there exists a general logging area on Android devices that is typically referred to as a logging
cat.
Now if I open up Android Studio here you can actually see the log here.
So you could see here that consistently information is being logged to this log and this blog is shared
by basically all of the applications on the actual device itself.
And you can write things to the log fairly easily using some built in functions inside of the the android.
The Android development module is right.
So you'll be able to actually write information to these debugging logs.
Not only can you write to them but you can also read them to see if a specific error has occurred.
The reason why we don't want to log any sensitive information to this is sort of twofold through one
as you can see here.
I can easily access the log cut logs just by having the device plugged into my computer or by having
the device running through an emulator on my computer.
But more so that what's important to this is that somebody can actually created app that can read this
log catalog.
That means in terms they can read any messages that are logged to here.
So if you for instance are logging information about a user's password or something like that if I have
an application that's like sniffing the log file on this person's device I'll be able to see that information
as well.
So this gives you some context behind what this vulnerability really is and why it's important.
So it's not really just a matter of logging information that is sensitive such as like an API key or
something like that that somebody might see from you know looking at the logs.
It's also a matter of someone you know a third party sort of like sniffing the logs of a random device
to grab information about the user.
So to give you an example of this let's go ahead and open up our diva application and we'll go into
insecure logging and I'm going to demonstrate to you what exactly this could look like.
So you see here and here we want to enter into credit card information so gonna put it on my credit
card information and press checkout when I do this.
You're going to see right here that there's an error message that gets processed.
It says error while processing transaction with credit card and then it prints out the credit card number.
So this is something that we want to avoid.
This would be an example of insecure logging.
And the reason being again is because if we have a third party application that say sniffing this log
if they see this error message it exposes the credit card information of the user.
So this is extremely bad because obviously then people can potential have an information disclosure
they could end up showing information to someone else that shouldn't see that information.
They'll be able to compromise them with it.
Right.
So we can take a look at the source code of this that we've compiled to get a bit of an idea of what
this is actually looking like in the code.
Just to give you an idea of what sort of things you can look out for for this so we have this log activity.
This this method here log dot e is what happens when we're trying to log an error message.
So there's like log dye E for error I think log dot D is debug and there's probably a few other ones
that are very common.
And as you can see here it gives the actual error message and you can see it actually writes in whatever
is inside of a text box of the of the credit card field so you can see this is what the actual log message
looks like.
So if we're looking for these sort of instances we can look for like log dot e or log dot D and these
will show us where logs are being read into the actual device like itself and then from there you can
try triggering these are looking at what is actually being log to determine if that information is sensitive
data or not.
So common sensitive data would include things like passwords even usernames credit card details obviously
personal details any anything sort of related to that API keys of the application would be a common
one even database table names databases in general this sort of information leakage is the kind of stuff
that we want to make sure isn't happening in our application.
So this would be an example of insecure logging.
So this gives you an idea of what this vulnerability looks like and how to actually detect it in an
application.