Skip to content

MASWE-0061: Debug Artifacts Not Removed

MAS Requirement

The app does not contain debug artifacts.

Mappings

MASVS V1: MSTG-CODE-3, MSTG-CODE-4

MASVS V2: MASVS-RESILIENCE-3

CWE: CWE-489: Active Debug Code, CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere, CWE-540: Inclusion of Sensitive Information in Source Code, CWE-912: Hidden Functionality, CWE-1295: Debug Messages Revealing Unnecessary Information

Android Risks: test-debug

Android Core Quality: Production_Build_Quality

Overview

This weakness occurs when an app ships to production containing developer debug artifacts, such as verbose logging, testing utilities, debugging symbols, or leftover debug and test code.

Such artifacts help adversaries understand the app's behavior and internals, may include sensitive implementation details, and, most critically, may include backdoors, such as hidden switches enabling debug menus or an insecure trust manager, that can disable security controls like TLS certificate validation. Note the distinction from Sensitive Data Hardcoded in the App Package: that weakness covers developer leftover artifacts that leak confidentiality (staging URLs, developer identities, source files), while this one covers debug artifacts that weaken the app's resilience.

Modes of Introduction

  • Verbose Logging and Debug Flows: Leaving verbose or debug-level logging and diagnostic code paths active in production builds.
  • Testing Utilities Enabled: Shipping with development-time utilities enabled, such as StrictMode on Android.
  • Debugging Symbols Not Stripped: Releasing binaries with debugging symbols that map the code for reverse engineers.
  • Backdoors or Hidden Switches and Debug Menus: Leaving debug or test code that can disable security controls, e.g. an insecure trust manager or a hidden configuration flag that turns off TLS verification.

Impact

  • Bypass of Protection Mechanisms: Attackers can activate leftover debug switches or code paths that disable security controls such as certificate validation, resulting in the defeat of protections the production app is supposed to enforce.
  • Compromise of Sensitive Data: Attackers can use verbose logs, symbols, and debug flows to learn implementation details and extract sensitive values, resulting in information disclosure that enables further attacks.

Mitigations

  • Strip Symbols and Debug Code: Remove debugging symbols and compile debug-only code paths out of release builds using build variants and flags.
  • Disable Verbose Logging in Production: Ensure debug and verbose logging is removed or disabled in release configurations.
  • Remove Testing Utilities: Keep development-time utilities such as StrictMode out of production builds.
  • Eliminate Backdoors: Enforce code review and release checks that reject hidden switches, test hooks, or alternative code paths capable of weakening security controls in production.

Knowledge

MASTG-KNOW-0063: Debugging Information and Debug Symbols MASTG-KNOW-0064: Non-Production Resources MASTG-KNOW-0101: Logs

Tests

MASTG-TEST-0263: Logging of StrictMode Violations MASTG-TEST-0264: Runtime Use of StrictMode APIs MASTG-TEST-0288: Debugging Symbols in Native Binaries MASTG-TEST-0265: References to StrictMode APIs MASTG-TEST-0219: Testing for Debugging Symbols MASTG-TEST-0359: Implementation Details Exposure in Logs MASTG-TEST-0358: Implementation Details Exposure Through Logging APIs

Best Practices

MASTG-BEST-0022: Disable Verbose and Debug Logging in Production Builds