Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
---
platform: android
title: Tracing Common Logging APIs Looking for Secrets
title: Tracing Common Logging APIs Looking for Authenticators
id: MASTG-DEMO-0006
code: [kotlin]
test: MASTG-TEST-0203
---

### Sample

The snippet contains many calls to logging APIs which are used to print out secrets such as passwords or IVs.
The snippet contains many calls to logging APIs which are used to print out authenticators such as API keys.

{{ MastgTest.kt }}

Expand All @@ -30,6 +30,6 @@ As a reference, this is the corresponding logcat output obtained from Android St

### Evaluation

Review each of the reported instances by using keywords and known secrets (e.g. passwords or usernames or values you keyed into the app).
Review each of the reported instances looking for known authenticators (e.g. API keys).

Note: You could refine the test to input a known secret and then search for it in the logs.
Note: You could refine the test to input a known authenticators and then search for it in the logs.
2 changes: 1 addition & 1 deletion demos/ios/MASVS-STORAGE/MASTG-DEMO-0066/MASTG-DEMO-0066.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
platform: ios
title: Sensitive Data Logging with idevicesyslog
title: Authenticators Logged with idevicesyslog
code: [swift]
id: MASTG-DEMO-0066
test: MASTG-TEST-0296
Expand Down
6 changes: 3 additions & 3 deletions tests-beta/android/MASVS-STORAGE/MASTG-TEST-0203.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
platform: android
title: Runtime Use of Logging APIs
title: Runtime Use of Logging APIs Exposing User Sensitive Data
id: MASTG-TEST-0203
apis: [Log, Logger, System.out.print, System.err.print, java.lang.Throwable#printStackTrace]
type: [dynamic]
Expand All @@ -12,7 +12,7 @@ knowledge: [MASTG-KNOW-0049]

## Overview

On Android platforms, [logging APIs](../../../0x05d-Testing-Data-Storage.md/#logs) like `Log`, `Logger`, `System.out.print`, `System.err.print`, and `java.lang.Throwable#printStackTrace` can inadvertently lead to the leakage of sensitive information. Log messages are recorded in logcat, a shared memory buffer, accessible since Android 4.1 (API level 16) only to privileged system applications that declare the `READ_LOGS` permission. Nonetheless, the vast ecosystem of Android devices includes pre-loaded apps with the `READ_LOGS` privilege, increasing the risk of sensitive data exposure. Therefore, direct logging to logcat is generally advised against due to its susceptibility to data leaks.
On Android platforms, [logging APIs](../../../0x05d-Testing-Data-Storage.md/#logs) like `Log`, `Logger`, `System.out.print`, `System.err.print`, and `java.lang.Throwable#printStackTrace` can inadvertently lead to the leakage of sensitive information. Log messages are recorded in logcat, a shared memory buffer, accessible since Android 4.1 (API level 16) only to privileged system applications that declare the `READ_LOGS` permission. Nonetheless, the vast ecosystem of Android devices includes pre-loaded apps with the `READ_LOGS` privilege, increasing the risk of user sensitive data exposure. Therefore, direct logging to logcat is generally advised against due to its susceptibility to data leaks.

## Steps

Expand All @@ -26,4 +26,4 @@ The output should contain a list of locations where logging APIs are used in the

## Evaluation

The test case fails if you can find sensitive data being logged using those APIs.
The test case fails if you can find user sensitive data being logged using those APIs.
4 changes: 2 additions & 2 deletions tests-beta/android/MASVS-STORAGE/MASTG-TEST-0231.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
platform: android
title: References to Logging APIs
title: References to Logging APIs Exposing User Sensitive Data
id: MASTG-TEST-0231
apis: [Log, Logger, System.out.print, System.err.print, java.lang.Throwable#printStackTrace, android.util.Log]
type: [static]
Expand All @@ -24,4 +24,4 @@ The output should contain a list of locations where logging APIs are used.

## Evaluation

The test fails if an app logs sensitive information from any of the listed locations.
The test fails if an app logs user sensitive information from any of the listed locations.
6 changes: 3 additions & 3 deletions tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0296.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
platform: ios
title: Sensitive Data Exposure Through Insecure Logging
title: User Sensitive Data Exposure in Logs
id: MASTG-TEST-0296
type: [dynamic]
weakness: MASWE-0001
Expand All @@ -15,7 +15,7 @@ knowledge: [MASTG-KNOW-0101]

This test is the dynamic counterpart to @MASTG-TEST-0297.

In this test, we will monitor and capture the device logs and then analyze them for sensitive data.
In this test, we will monitor and capture the device logs and then analyze them for user sensitive data.

!!! warning Limitation
- Linking the logs back to specific locations in the app can be difficult and requires manual analysis of the code. As an alternative you can use dynamic analysis with @MASTG-TOOL-0039.
Expand All @@ -35,4 +35,4 @@ The output should contain all logged data.

## Evaluation

The test case fails if you can find sensitive data inside the output.
The test case fails if you can find user sensitive data inside the output.
Loading