Access Sensitive Data in Device Logs

On versions of Android prior to 4.1, an adversary may use a malicious application that holds the READ_LOGS permission to obtain private keys, passwords, other credentials, or other sensitive data stored in the device's system log. On Android 4.1 and later, an adversary would need to attempt to perform an operating system privilege escalation attack to be able to access the log.

ID: T1413
Sub-techniques:  No sub-techniques
Tactic Type: Post-Adversary Device Access
Platforms: Android
MTC ID: APP-3, APP-13
Version: 1.0
Created: 25 October 2017
Last Modified: 17 October 2018
Provided by LAYER 8

Procedure Examples

ID Name Description
S0423 Ginp

Ginp can download device log data.[1]

S0544 HenBox

HenBox can monitor system logs.[2]

Mitigations

ID Mitigation Description
M1013 Application Developer Guidance

Application developers should be discouraged from writing sensitive data to the system log in production apps.

M1005 Application Vetting
M1001 Security Updates
M1006 Use Recent OS Version

Starting in Android 4.1, this technique requires privilege escalation for malicious applications to perform, as apps can no longer access the system log (other than log entries added by a particular app itself). (Additionally, with physical access to the device, the system log could be accessed via USB through the Android Debug Bridge.)[3]

References