Log: It's Big, It's Heavy, It's Filled with Personal Data! Measuring the Logging of Sensitive Information in the Android Ecosystem

require CAP_SYSLOG and is now widely enabled. In deploying this patch, Rosenberg noted both the futility of attempting Android offers a shared system that multiplexes all logged to sanitize thousands of printk statements along with the data from all system components, including both the operating resulting loss of functional utility of these sanitized logs [53] . system and the console output of apps that run on it. A security Analogous to Linux, the Android platform also offers a mechanism ensures that user-space apps can only read the shared system log that collects all logging statements from log entries that they create, though many "privileged" apps apps, system services, and drivers [9]. Developers can write to are exempt from this restriction. This includes preloaded this log using a family of logging functions, differentiated by system apps provided by Google, the phone manufacturer, the verbosity, that provide both a log tag and message. A single cellular carrier, as well as those sharing the same signature. system log multiplexes the output of all the log statements that Consequently, Google advises developers to not log sensitive occur along with metadata, which includes thread and process information to the system log. identifers, a log level ("verbosity"), log tag, and timestamp. In this work, we examined the logging of sensitive data in On Android, access to the logs has never been part of the the Android ecosystem. Using a feld study, we show that most published Software Development Kit (SDK) [40] , but early devices log some amount of user-identifying information. We versions allowed full access based on requesting a permission show that the logging of "activity" names can inadvertently re-(i.e., READ_LOGS). Without it, apps can only access their veal information about users through their app usage. We also own log messages (but not logs from other apps or operating tested whether different smartphones log personal identifers system components); with the permission, apps have access to by default, examined preinstalled apps that access the system all log data. Android 4.1 changed the READ_LOGS permission logs, and analyzed the privacy policies of manufacturers that to become "privileged," meaning that the permission itself is report collecting system logs. only available to system apps and apps that come preinstalled (e.g., by manufacturers, carriers, etc.) [14, 40, 41] .