Practical 2
Aim: Insecure login
Requirements: Tools- Genymotion
Diva-Application
SDK platform-tools
Theory:
Insecure logging involves storing sensitive information like passwords or credit card details in log
files without encryption or obfuscation. This practice risks exposing this data to unauthorized access,
violates compliance standards, and increases the likelihood of data breaches or misuse. Implementing
secure logging practices, such as encryption and access controls, is crucial to mitigate these risks and
protect sensitive information.
Steps:
Step 1: Run Genymotion.
Step 2: Run terminal and navigate to platfom-tools directory.
Step 3: Run command for activate adb-shell.
Step 4: Run android virtual device.
Step 5: Open app drawer in android virtual device.
Step 6: Find Diva application and run application.
Step 7: Now click on first option “1. INSECURE LOGGING”.
Step 8: Open your most recent terminal session and enter the `logcat` command to monitor and debug
application logs, aiding in diagnosing issues or analyzing runtime behavior.
Step 9: Activate command.
Step 10: Enter any card number for testing purpose.
Step 11: Attempt to locate card information within the log data for the purpose of identifying instances
of insecure logging and addressing potential security risks.
Conclusion
In conclusion, our analysis of the log data has identified instances of insecure logging practices. This
finding underscores the critical need to implement robust logging mechanisms that prioritize data
security. By addressing these vulnerabilities promptly and adopting secure logging protocols, we can
enhance the overall integrity and confidentiality of sensitive information, thereby reducing potential
risks and ensuring compliance with security best practices.
