{"action":"opened","issue":{"url":"https://api.github.com/repos/blawrencenstest/AnydoDemo/issues/206","repository_url":"https://api.github.com/repos/blawrencenstest/AnydoDemo","labels_url":"https://api.github.com/repos/blawrencenstest/AnydoDemo/issues/206/labels{/name}","comments_url":"https://api.github.com/repos/blawrencenstest/AnydoDemo/issues/206/comments","events_url":"https://api.github.com/repos/blawrencenstest/AnydoDemo/issues/206/events","html_url":"https://github.com/blawrencenstest/AnydoDemo/issues/206","id":309493317,"number":206,"title":"Lab Automated dynamic analysis: Sensitive Data: Email Address (System Logs)","user":{"login":"blawrencensdemo","id":29762235,"avatar_url":"https://avatars3.githubusercontent.com/u/29762235?v=4","gravatar_id":"","url":"https://api.github.com/users/blawrencensdemo","html_url":"https://github.com/blawrencensdemo","followers_url":"https://api.github.com/users/blawrencensdemo/followers","following_url":"https://api.github.com/users/blawrencensdemo/following{/other_user}","gists_url":"https://api.github.com/users/blawrencensdemo/gists{/gist_id}","starred_url":"https://api.github.com/users/blawrencensdemo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blawrencensdemo/subscriptions","organizations_url":"https://api.github.com/users/blawrencensdemo/orgs","repos_url":"https://api.github.com/users/blawrencensdemo/repos","events_url":"https://api.github.com/users/blawrencensdemo/events{/privacy}","received_events_url":"https://api.github.com/users/blawrencensdemo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-03-28T19:08:44Z","updated_at":"2018-03-28T19:08:44Z","closed_at":null,"author_association":"NONE","body":"### Summary\nPlatform: android\nPackage: com.anydo\n\nDebug logs are generally designed to be used to detect and correct flaws in an application. These logs can leak sensitive information that may help an attacker create a more powerful attack. Additionally, any application on that device with the \"READ_LOGS\" permission can interrogate the logs, and in more recent versions of Android, the log files have been more carefully isolated and do not require system level permissions to be requested. In this test, the system log files are analyzed for existence of sensitive user or application data.\n\n### Risk and Regulatory information\nSeverity: medium\nCVSS: 4.3\n\n\nOWASP: [Mobile Top 10: M2-Insecure Data Storage](https://www.owasp.org/index.php/Mobile_Top_10_2016-M2-Insecure_Data_Storage)\n\n\n### Details\nEmail Address was recovered from the system log files on the device. The table below displays each data type, the actual value that was recovered, whether this value was recovered in plain text form or a specific encoding, and some output directly from the log file to show contextual information around how this search term was logged.\n\n### Recommendation\nTo prevent this sensitive information from being compromised (such as by another application or process running on the same device), it is recommended that debug logs be disabled in a production environment. One method involves leveraging ProGuard or DexGuard (or an alternative) to completely remove the method calls to the Log class, thus stripping all calls to Log.d, Log.i, Log.v, Log.e methods. One example is use add the following snippet to `proguard.cfg`: ``` -assumenosideeffects class android.util.Log { public static *** d(...); public static *** v(...); public static *** i(...); public static *** e(...); } ```\n\nView more details in Lab Automated: [https://lab.nowsecure.com/app/android/com.anydo/assessment/1522263278871](https://lab.nowsecure.com/app/android/com.anydo/assessment/1522263278871)"}}
{"actor":{"display_login":"blawrencensdemo"}}