IBM Cognos Analytics Mobile 1.1 for Android could allow a user with physical access to the device, to obtain sensitive information from debugging code log messages.

IBM Cognos Analytics Mobile 1.1 for Android could allow a user with physical access to the device, to obtain sensitive information from debugging code log messages.

Some devise will login information that can be exploited by attackers to further their attack against the device or the system in which the device resides. This data can vary, but in general if a device logs any secrets that would break it’s safety, confidentiality, integrity, or availability, a threat actor may be able to use that information to further their goals. For example, if a private key is printed in a debug or event log after generation, threat actors may be able to take the key and use it to decrypt network communications. Another instance is a threat actor being able to take information associated with a core-dump log of a failed process and turn it into an exploit.