Be Careful What You Write, Someone Might Read It: Logging Personally Identifiable Information on Android

Simple item page
dc.contributor.advisorReardon, Joel
dc.contributor.authorLyons, Allan
dc.contributor.committeememberReardon, Joel
dc.contributor.committeememberHenry, Ryan
dc.contributor.committeememberHagen, Gregory
dc.date2023-02
dc.date.accessioned2023-01-06T20:57:54Z
dc.date.available2023-01-06T20:57:54Z
dc.date.issued2023-01-03
dc.description.abstractThe Android Operating System provides a central, shared logging system that multiplexes messages from all of the various components including the operating system and all of the apps that run on it. A permission system exists that prevents these log messages from being read by processes other than the one that created them; however, there is an exception to this restriction for a privileged class of apps. This includes preinstalled system apps provided by Google, the manufacturer of the device, or the mobile network operator. As a consequence of this exception, Google admonishes developers that for privacy reasons they must refrain from logging personal or sensitive information to the system log. In this thesis, we examine the pervasive logging of Personally Identifiable Information (PII) throughout the Android ecosystem. With local lab experiments we show that freshly reset phones log PII---every phone we tested logged multiple identifiers. Then, through a field study we show that this logging is pervasive in the wild with PII being detected in the logs of 94.1% of the devices in our dataset which represented all of the observed manufacturers. We statically analyze the Android Open Source Project (AOSP) source code to identify the origin of some of the observed excessive logging and are able to attribute log entries to specific parts of the code and find that Google itself does not follow its own specific advice to not log sensitive data and more generally to remove debug logging from release software. Finally, we analyze the privacy policies of major cell-phone manufacturers and find that some report that they may collect these logs.en_US
dc.identifier.citationLyons, A. (2023). Be Careful What You Write, Someone Might Read It: Logging Personally Identifiable Information on Android (Master's thesis, University of Calgary, Calgary, Canada). Retrieved from https://prism.ucalgary.ca.en_US
dc.identifier.urihttp://hdl.handle.net/1880/115654
dc.identifier.urihttps://dx.doi.org/10.11575/PRISM/40580
dc.language.isoengen_US
dc.publisher.facultyScienceen_US
dc.publisher.institutionUniversity of Calgaryen
dc.rightsUniversity of Calgary graduate students retain copyright ownership and moral rights for their thesis. You may use this material in any way that is permitted by the Copyright Act or through licensing that has been assigned to the document. For uses that are not allowable under copyright legislation or licensing, you are required to seek permission.en_US
dc.subjectPrivacyen_US
dc.subjectMobile Privacyen_US
dc.subjectMobile Systems Securityen_US
dc.subject.classificationComputer Scienceen_US
dc.titleBe Careful What You Write, Someone Might Read It: Logging Personally Identifiable Information on Androiden_US
dc.typemaster thesisen_US
thesis.degree.disciplineComputer Scienceen_US
thesis.degree.grantorUniversity of Calgaryen_US
thesis.degree.nameMaster of Science (MSc)en_US
ucalgary.item.requestcopyfalseen_US
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
ucalgary_2023_lyons_allan.pdf
Size:
681.96 KB
Format:
Adobe Portable Document Format
Description:
Download
License bundle
Now showing 1 - 1 of 1
No Thumbnail Available
Name:
license.txt
Size:
2.62 KB
Format:
Item-specific license agreed upon to submission
Description:
Download
Collections
Open Theses and Dissertations