if it some Cipher information and usage, which means it hasn't unpacked successfully. In this case you can give a try with more arguments: abe [-debug] [-useenv=yourenv] unpack <backup.ab> <backup.tar> [password] [password]: is the password when your android device asked you earlier. For example here is: 123 java -jar abe.jar unpack backup.ab backup.tar 123 Extract the tar file to your working directory. $ tar xvf mybackup.tar Finding Sensitive Information in Auto-Generated Screenshots Overview Manufacturers want to provide device users with an aesthetically pleasing experience at application startup and exit, so they introduced the screenshot-saving feature for use when the application is backgrounded. This feature may pose a security risk. Sensitive data may be exposed if the user deliberately screenshots the application while sensitive data is displayed. A malicious application that is running on the device and able to continuously capture the screen may also expose data. Screenshots are written to local storage, from which they may be recovered by a rogue application (if the device is rooted) or someone who has stolen the device. For example, capturing a screenshot of a banking application may reveal information about the user's account, credit, transactions, and so on. Static Analysis A screenshot of the current activity is taken when an Android app goes into background and displayed for aesthetic purposes when the app returns to the foreground. However, this may leak sensitive information. To determine whether the application may expose sensitive information via the app switcher, find out whether the option has been set. You should find something similar to the following code snippet: getWindow().setFlags(WindowManager.LayoutParams.FLAG_SECURE, WindowManager.LayoutParams.FLAG_SECURE); setContentView(R.layout.activity_main); If the option has not been set, the application is vulnerable to screen capturing. Dynamic Analysis While black-box testing the app, navigate to any screen that contains sensitive information and click the home button to send the app to the background, then press the app switcher button to see the snapshot. As shown below, if FLAG_SECURE is set (right image), the snapshot will be empty; if the flag has not been set (left image), activity information will be shown:
if it some Cipher information and usage, which means it hasn't unpacked successfully. In this case you can give a try with more arguments: abe [-debug] [-useenv=yourenv] unpack <backup.ab> <backup.tar> [password] [password]: is the password when your android device asked you earlier. For example here is: 123 java -jar abe.jar unpack backup.ab backup.tar 123 Extract the tar file to your working directory. $ tar xvf mybackup.tar Finding Sensitive Information in Auto-Generated Screenshots Overview Manufacturers want to provide device users with an aesthetically pleasing experience at application startup and exit, so they introduced the screenshot-saving feature for use when the application is backgrounded. This feature may pose a security risk. Sensitive data may be exposed if the user deliberately screenshots the application while sensitive data is displayed. A malicious application that is running on the device and able to continuously capture the screen may also expose data. Screenshots are written to local storage, from which they may be recovered by a rogue application (if the device is rooted) or someone who has stolen the device. For example, capturing a screenshot of a banking application may reveal information about the user's account, credit, transactions, and so on. Static Analysis A screenshot of the current activity is taken when an Android app goes into background and displayed for aesthetic purposes when the app returns to the foreground. However, this may leak sensitive information. To determine whether the application may expose sensitive information via the app switcher, find out whether the option has been set. You should find something similar to the following code snippet: getWindow().setFlags(WindowManager.LayoutParams.FLAG_SECURE, WindowManager.LayoutParams.FLAG_SECURE); setContentView(R.layout.activity_main); If the option has not been set, the application is vulnerable to screen capturing. Dynamic Analysis While black-box testing the app, navigate to any screen that contains sensitive information and click the home button to send the app to the background, then press the app switcher button to see the snapshot. As shown below, if FLAG_SECURE is set (right image), the snapshot will be empty; if the flag has not been set (left image), activity information will be shown:
MSTG-EN.docx