Look Who it Was Random video

Resurrecting The Read_Logs Permission on Samsung Devices

894 views · Published 29 August 2016 · 28:11 · Indexed 20 September 2026

Channel: Black Hat · 2016 · People & Blogs

Watch on YouTube

by Ryan Johnson &  Angelos Stavrou

We have discovered an attack that allows a non-privileged application to continually force the generation and logging of sensitive process information in a readable log file using the /system/bin/dumpstate binary on Samsung devices. The log output of the dumpstate binary includes the Android logs, kernel log, and other process-dependent log data. However, starting with Android 4.1, reading the Android logs is no longer permitted to user applications because the READ_LOGS permission was removed, but we were able to circumvent this limitation. To achieve this, we crafted an exploit that requires an application with the seemingly innocuous android.permission.RECEIVE_BOOT_COMPLETED permission. Reading the Android logs empowers a non-privileged user application to obtain private data circumventing all permission checks. The approach to obtain the Android log data has worked on all Samsung devices we have examined ranging from the Samsung Galaxy S1 up to and including the Samsung Galaxy S5 and the Samsung Note 4. The Android log generally contains private data written by the Android Operating System (OS), Google applications, and user applications. Moreover, we have identified 12 Samsung builds for Android where the Android OS writes the text of notifications by default to the Android log. Using our attacks on these 12 builds, we are able to get access to Facebook Messenger messages, text messages (including password resets), Google Chat messages, WhatsApp messages, missed calls, turn-by-turn directions from Google Maps, the sender and subject of emails, and any other notification. Our proof-of-concept application can obtain the text from all notifications that the Android OS receives for these builds. This enables a user application to obtain immensely private data from the user of these vulnerable Samsung devices. These builds are for the previous generation of Samsung devices that are still currently being sold in retail stores (e.g., Samsung Galaxy S4, Samsung Note 3, Samsung Note Pro 12.2, etc.).

More from this channel