Lesson 3.43: Logs, screenshots and the clipboard
Data can leave an app without a network: through the system log, which debugging tools and sometimes other components read; through screenshots and the recent-apps preview; through the clipboard, which the keyboard and other apps can see. In the lab you find a password and a token in the device log, trace the password to one line of code, see that the payment screen can be captured because it doesn't set FLAG_SECURE, find card numbers copied to the clipboard, and add a build rule that strips debug logging from releases.
16 min
You will learn to
- Find sensitive data in logcat
- Trace a log line to its source
- Explain FLAG_SECURE
- Recognise clipboard leaks
- Strip debug logging from release builds
Key terms
- logcat
- Android's system log; apps write to it with android.util.Log.
- FLAG_SECURE
- Window flag that blocks screenshots, recording and the recent-apps thumbnail.
- Clipboard
- Shared copy-paste buffer; the keyboard and the foreground app can read it.
- R8 / ProGuard
- The release build's code shrinker; -assumenosideeffects removes calls such as Log.d.
- Bug report
- A device dump (adb bugreport) with logs, often shared with support or vendors.
← Writing YARA rules · All lessons · Ports and sockets: which program gets the data →