Now, Android has a dictionary where words entered by a user can be saved for future auto correction.
This user dictionary is available to any app without any special permissions or user can add potentially
sensitive information such as a username to the dictionary.
Well, we can get this sensitive information from out of this dictionary, and it's pretty easy.
We show you how to do it.
Users may add the sensitive information to the dictionary, but as you can see, when I select the string,
add to dictionary what's not displayed anymore.
So I guess this vulnerability was also fixed on Android 10.
But why don't we take a look inside at where this dictionary is?
And look even deeper inside of it so the dictionary can be retrieved just by using EDB.
And we'll check the devices.
OK, so we're connected.
Run EDB Shell.
Change directory to slash data, slash data, slash combat android providers, dot user dictionary slash
databases.
List of files.
OK, so here's the user dictionary file.
Exit the shell.
And let's retrieve this file.
So run, EDB, pull.
Copy the location and paste.
Finally, add the file name.
OK, so now we've pulled the file.
Of course, because its database file will open it with askew light.
So we'll install it with the Apte install, as you like, three command.
Just run ask you, like three user underscored Dick that Debbie.
All right, so now we'll need to add a query to get this information to run Select Star from Worts.
So as you can see, we couldn't get any information on Android 10, but you can follow these steps for
older versions of Android.
Well, look at the official walk through is for insecure bank and see what this vulnerability looks
like.
So we'll go to the GitHub page the app and open the walk through this folder.
Click on keyboard cache vulnerability, download the document and open it with word or whatever your
word processing program is.
And as you can see, the add to dictionary option should appear when you select the word in the older
version of Android.
So after opening the database file and running this query, you should see the keyboard dictionary stored
in plain text.
All right, good work.