My bank's android app is logging session ids, account numbers, money transfers and current balance of my account. Is this normal? Do all banks do that? Can a malicious app read my logs and get my account number? And finally if this is a security problem what do i do?
5
-
You're certain that's your bank account number and not just a login id? – Robert Mennell Nov 13 '15 at 19:30
-
Yes I am certain. The app also logs my name and the bills i paid too. – mk_ Nov 13 '15 at 22:08
9
My bank's android app is logging session ids, account numbers, money transfers and current balance of my account.
If true, what bank? Shame them. It's also possible you have a piece of malware that's doing this.
Is this normal?
No way.
Do all banks do that?
I doubt it.
Can a malicious app read my logs and get my account number?
Yes, they can. They can get session ids, account numbers, money transfers, and the current balance of your account. This can help malicious attackers do things with your account.
If I were a malware author, I'd be very interested in using the session ids and account numbers in particular. To a lesser extent, current balance. If I have your bank account number... the things I can do with that are quite nearly endless, especially if I know who you are.
And finally if this is a security problem what do i do?
Uninstall it. Nobody's data should be hanging around like that. In fact, maybe if you point this out to the bank, they might reward you? You should point out that this is a terrible security practice.
If the bank doesn't do anything, as in they don't acknowledge that this is a security concern, or they don't even have the courtesy to call you, then by all means, go cause a big stink somewhere. Go to the media, and let it spread like wildfire.
-
3"Yes, they can" -- assuming that the OP is referring to LogCat, apps cannot readily access that content, on Android 4.1+, as they improved security on LogCat a while back. The bank app's behavior is still unacceptable, but lots of apps were doing this sort of stupid stuff back in the day, which is why they tightened down LogCat access at runtime. – CommonsWare Nov 13 '15 at 19:55
-
@CommonsWare Good point and, as you say, it's still unacceptable. Question, though... what happens when you root the device? – Mark Buffalo Nov 13 '15 at 20:06
-
2System apps can hold
READ_LOGS, IIRC. So, if you root the device and move an app to be a system app, it can definitely get to LogCat content. There probably is a way to get at it throughsuas well. If you root your device, you are intentionally compromising security in exchange for... well, whatever you decided to root the device for. – CommonsWare Nov 13 '15 at 20:09 -
Somebody else can root my device without my concent, using some (mybe 0-day exployt), or steal such concent by social engineering. While bank apps often refuse to run on rooted devices, malware can use some techniques to hide the fact that the device is compromised. – Alex Cohn Nov 28 '15 at 17:39
-
