14 ms·
Facebook scans system libraries on Android and uploads them to their server
- sharpneli 7y agoIsn’t this potentially a copyright violation? Especially on Qualcomm devices (such as the Jolla phone) Qualcomm explicitly forbids you from distributing their OpenGL drivers. So if facebook copies libGLESv2.so off from the device they are potentially performing straight piracy at that point. If I recall the damages demanded by RIAA it was several hundred k per infringement.
- mandeepj 7y ago> If I recall the damages demanded by RIAA it was several hundred k per infringement. I don't think they care for it. They already paid a $5B fine
- mpalczewski 7y agoThey don't upload the library just their filename and hash. Probably for bug troubleshooting, device fingerprinting and feature availability data. It's a bit much, device fingerprinting like this should get you banned from the play store. However there are legitimate uses for this.
- saagarjha 7y agoThey're uploading the actual binary as well: https://twitter.com/wongmjane/status/1167463077748436993 https://twitter.com/wongmjane/status/1167463077748436993
- mpalczewski 7y agoI read that wrong. you're right.
- dmitrygr 7y agoQualcomm v Facebook. If there was ever a fight where neither party deserves to win (or survive), this is it!
- deleted 7y ago[deleted]
- m0zg 7y agoEven if it is, Qualcomm won't do anything about it. It's in their interest that FB app works well on Snapdragon.
- cooljacob204 7y agoWhy would it be? They are not redistributing the library.
- JaRail 7y agoThe exact details would depend on what they do with the uploads and the specific countries they're uploaded to/from. I'd presume they do this for security and debugging purposes, not to 'steal' the libraries. Like a virus company uploading samples of 'suspicious' .dlls for analysis, this looks like a fair use exception.
- sharpneli 7y agoThis is a good point. And in EU interoperability is explicit reason for not just this but full fledged reverse-engineering.
- evilDagmar 7y agoIt's not a fair use exception because Facebook is not the party involved in the copyright agreement. They're a completely separate third party so they don't have any rights at all to those files.
- saagarjha 7y agoI'd expect that they're doing this because they'd like to diagnose crashes or bugs on systems that they don't have the hardware for. It's still somewhat creepy and possibly a fingerprinting mechanism.
- CaptainZapp 7y agoYour assessment would be reasonable whth just about any company. But Facebook? Not so much.
- coding123 7y agoAgreed. This is about how the phone number thing went "for security". I think a lot of people believed FB was using it just for security but in reality they were trying to find more connections, possible friends, tie you to an identity. A real citizen of a country - which is one of their products. I would suspect this is like browser fingerprinting.
- swalsh 7y agoWould it be less creepy if facebook had a list of libraries they use, and uploaded a list of missing libraries instead of the total collection?
- ASalazarMX 7y agoIt would be less creepy if they actually asked the user if they want to upload those system files before uploading them.
- saagarjha 7y agoI wonder how many users would understand what these files are, why Facebook might want them, and what the risks are associated with sending these.
- ASalazarMX 7y ago
- wrs 7y agoWhy is this bad? Don’t most error reporting libraries send this sort of metadata with exception stacktraces? I would think this falls under the usual “improving the quality of the app” language in nearly everybody’s EULA.
- ErikAugust 7y agoIt doesn't just send a list of libraries, it actually uploads the libraries [1]. You seriously think that's a good use of bandwidth? [1] https://twitter.com/wongmjane/status/1167463077748436993?s=20 https://twitter.com/wongmjane/status/1167463077748436993?s=2...
- wrs 7y agoGiven the Wild West nature of Android, there may be no other possible way to get that version of that system library to debug something.
- ErikAugust 7y agoI would have to hope that uploads are only triggered if the hash in the metadata wasn't found in their massive store of libraries.
- lightedman 7y agoAnd what if that library that is uploaded is one that I wrote with no designed intent of public distribution? It is wholesale going after every library on the system, AFAICT.
- evilDagmar 7y agoYou don't need "that version of the system library" to debug anything. If you write decent code that adheres to the published APIs, it works or it's Android's fault. Should it be Android's fault and you deploy a workaround, there's a pretty good chance your workaround will start breaking the moment Android fixes their bug. But this has nothing to do with that. Let's face it. This is the freakin' Facebook app. It's not doing anything so incredibly revolutionary in the field of computing that requires it to be intimately involved in system libraries. It needs to display cat pictures and take in and emit text and make HTTP and HTTPs calls over the network, oh and monitor the user's every move, even while they sleep.
- ProAm 7y agoWhich android permission does this fall under I wonder?
- deleted 7y ago[deleted]
- lkhhj 7y agoNone, libraries are readable by any process, as they should.
- ProAm 7y agoReading yes, executing yes, reading for the sole purpose to upload to a remote server?.... barf and egregious
- longcommonname 7y agoHow would you enforce your ideal scenario?
- djsumdog 7y agoNone. These seem to be libraries off the /system partition.
- mirimir 7y agoHow the bloody hell is it permitted for apps to be uploading system files? This wouldn't be possible in Linux, right? Basically, this is malware. Edit: Thanks, all. So OK, I get that it's possible, because apps have read and execute permissions for all libraries that they use. But it's not common for apps to upload system files, right?
- prongletown 7y ago>This wouldn't be possible in Linux, right? If you have read access, then yes. Conventional desktop and server linux distributions would allow this behavior. As does android. Good luck using dylibs without it, anyways. Since the android market is so fragmented and customized, this probably saves them from having to buy lots of phones when diagnosing crashes. The knee-jerk reaction is to feel uncomfortable but these are system files, shipped with the phone, that are accessible to anyone who purchases the phone. This saves FB the trouble of spending $200 every time a new OS update comes out. Personally, with that knowledge, I don't have a problem with this - however, I have a ton of problems with other stuff FB does so I'm happy to keep not using their service.
- djsumdog 7y agoThey could download the stock roms from the major manufacturers, only ship the hashes, and match up library versions that way.
- prongletown 7y agoI'm not making a moral judgement (FB is a big yikes), just technical. They'd have to: - build lists of every phone, including carrier variant and internal revisions (pretty common!), to make sure they could be sure they had a complete library - rely on the manufacturer to publicly post the ROM (cheaper mfg wont do this) (or somehow retrieve the URL from the update mechanism, said URL not easily accessible from userspace) - handle the multiple different packaging mechanisms that android phones, especially older versions use (Google has gone a long way in remediating this but FB has to support billions of devices that don't adhere to best practices). - For ROM packages that are encrypted, they'd need to acquire the keys from real devices. - and they still would not have visibility into non-posted firmware, such as factory versions with day 1 upgrades (aka many many devices) OR - grab the files and send 'em
- fareesh 7y agoAside from fingerprinting, what other nefarious uses could this have in theory?
- w3rhn2j34oh5o 7y agoGrabbing rootkit artifacts that could be on the device? Its just that its not Facebooks place to do this. I wouldn't expect a app linux binary to upload the contents of /usr/lib, or a windows app to start sending system32 dll's off system. FB can try to sell this as a 'lite-AntiVirus' type service, but that is not its place. There is no indication the app is doing this. Its FB being creepy as usual. If Google did it, it would be less creepy, just like how Microsoft can grab malicious files detected by Defender -- but they write, support and protect the OS! FB is just an app. It shouldn't be harvesting its users operating system files!
- evilDagmar 7y agoGoogle already does what people are spewing apologetics about as justification for Facebook's behaviour, but they do it the right way. Google's SafetyNet scans the system files, but it looks for _specific_ files that should not be there and ensures that certain files that must remain unaltered actually remained unaltered to ensure that the security model is still intact, so it doesn't need to violate copyright laws by stealing copies of files off the user's phone without permission or user awareness. ...and funny that you mention Windows Defender because it repeatedly advises the user that it might upload files to Microsoft and asks for their approval for doing so at multiple points. Microsoft is being perfectly transparent about what they're doing and giving users the ability to opt-out. They're also the people who make the entire operating system so they've got an obligation to try real hard to prevent another Blaster incident. Facebook just makes a social media app.
- mcraiha 7y agoYou can identify devices with vulnerable libraries and do targeted attacks.
- ORioN63 7y ago
- rolph 7y agoi was looking around to find lore regarding sandboxing android apps, so far i found this interesting: https://www.reddit.com/r/androidapps/comments/5n7ak9/any_app_to_sandbox_another_android_apps_for/ https://www.reddit.com/r/androidapps/comments/5n7ak9/any_app... And this too: https://www.gtricks.com/android/how-to-sandbox-android-apps-for-privacy/ https://www.gtricks.com/android/how-to-sandbox-android-apps-...
- saagarjha 7y agoAs other commenters have mentioned, traditional sandboxing mechanisms would do little here. Applications are always given read access to system libraries because they need them to function.
- rolph 7y agoim thinking about how we get to non traditional sandboxing
- saagarjha 7y agoHere's a stupid idea I had elsewhere in the comments: https://news.ycombinator.com/item?id=20840466 https://news.ycombinator.com/item?id=20840466
- rolph 7y agoi think one of the biggest nuts to crack is that end user is in app space and cant black list apps [such as FB] from system procs and resources. If we could sniff and/or hook for requests to read the entire library all at once, or for such a request from a particular app, and ~pihole it or give it a honeypot to suck on for data.
- anticensor 7y agoFully homomorphic public key encryption is the solution. We need such a crypto that hides the instructions and operands but does not alter the visible arity of instructions, and allow arithmetic operations on operands.
- annadane 7y agoHow does the internal culture at FB come to grips with the world's vision of them as creepy and amoral and still do stuff like this anyway?
- ecf 7y ago$$$
- JustSomeNobody 7y agoThat culture has been built up over years. And probably most of the people they hire don't have the life experiences that would give them pause and allow them to consider or even recognize if what they're tasked to do is creepy or not.
- nerdponx 7y agoThat, or they don't care. Or they don't care enough.
- cjarrett 7y agoIf you do care, you get filtered out.
- avgDev 7y agoTheranos is the prime example of this. Whoever, was negative about the product in a way was removed. If one questioned a promise of the product because it was IMPOSSIBLE they got fired.
- aledalgrande 7y agoThe "not a team player" case.
- funkymike 7y agoNot at FB but just doing enterprise software development I've had to explain to other developers that capturing and storing user info just because we can is in the "not okay" category. There are plenty of people who don't even consider ethics at work. They get a feature request, so they deliver it, with no second thoughts. These aren't bad people per se, it just doesn't occur to them to question the reasons for a request or what the end result is within a larger context.
- javagram 7y agoI was going to say this isn’t a big deal but copying and uploading the libraries is actually illegal (copyright violation) and users likely can’t even consent to this even if it is in the Facebook ToS as many android phones contain proprietary libraries not licensed for redistribution. The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. I doubt any users are being harmed by this but it’s a violation of the software creator’s rights.
- deleted 7y ago[deleted]
- dmitrygr 7y agoSome older android devices running newer lineage/AICP/etc builds include a few libraries I wrote (in their entirety) for compatibility of old vendor prebuilts with new android versions - libdgv1 & libdmitry. Maybe I should C&D FB for laughs?
- number6 7y agoYes please!
- B_Throwaway 7y agoAbsolutely!
- gpm 7y agoAre they closed source? I.e. does facebook not have a license to make copies of them?
- kamyarg 7y agoJust deleted Facebook, this one is too much.
- _bxg1 7y agoAndroid is the Windows of mobile: anything goes, in terms of both user tweaking and sketchy apps.
- thsealienbstrds 7y agoThat's what I expected when I installed the app. Just kidding, I would never install the app.
- 19ylram49 7y agoYikes. Does Facebook even try to not be creepy?!?
- fnord77 7y agohow was she able to capture / sniff those HTTP posts? Any kind of sniffer would just get encrypted SSL data...
- camgunz 7y agoExfiling a file off my device w/o my consent is... hopefully against Android's ToS? Looking to see if FB gets banned from Google Play....
- bt848 7y agoTo the extent that Facebook has any utility at all, it works fine on a mobile web browser and when you close the tab it's gone. Why does anyone install the app?
- beatgammit 7y agoI don't use Facebook, but mobile apps tend to add features compared to the web app, such as notifications, integration with other apps (e.g. contacts), and a cleaner UX. That being said, even if I used Facebook, there's no way I'd install their app because I don't trust them.
- ppseafield 7y agoIndeed mbasic.facebook.com works, but it doesn't look as good and doesn't support message notifications. It's a trade-off I'll take for now, but not everyone will.
- calhoun137 7y agoOne reason to do this would be to discover what other apps the user has on their device which may not be detectable by other methods. That is valuable business intelligence that could be used in various ways for maintaining a competitive advantage. I got this idea from this reply: https://twitter.com/nial_26/status/1167464788667928576 https://twitter.com/nial_26/status/1167464788667928576
- tgsovlerkhgsel 7y agoDoubt it - if it's system libraries, I'd expect them to be immutable outside system updates. I would expect them to potentially grab the list of apps separately from that though (Some Ad SDKs do that, not sure if Facebook also does it - https://www.androidauthority.com/sdk-invasion-a-privacy-threat-803262/ https://www.androidauthority.com/sdk-invasion-a-privacy-thre...)
- vvG94KbDUtRa 7y agoAndroid trivially gives you all the apps on a phone just by asking
- KorematsuFred 7y agoMISLEADING HEADLINE : Facebook is only copying meta data about the libraries. THIS is a good thing.
- aloknnikhil 7y agoNo it's not. They're compressing the libraries and sending them all upstream. They're also eating into data caps (probably they're doing this only over Wi-Fi) let alone flouting all kinds of copyright laws
- schwede 7y agoFacebook is validating my decision to not install their apps.
- a3n 7y agoData charges?
- bubble_talk 7y agoWe should create a "privacy hall of shame" (I was tempted to call it the "privacy offender registry") and list the names of all the employees who work on these features, along with an easy-to-read blurb which explains how the feature could be misused. Bonus points for linking to their social profile. If you cannot find the actual person, go up the org chart and list the person closest on the hierarchy. Not that it is going to matter, any more than you can dissuade members of a cult by telling them they should forego their membership. It just seems to bring the cult closer together.
- wilg 7y agoThis is called "Doxing"[1] and it's a form of harassment and a violation of privacy. [1] https://en.wikipedia.org/wiki/Doxing https://en.wikipedia.org/wiki/Doxing
- jammygit 7y agoI find it unsettling in general that some app has the ability to do this. What are our other apps up to? How good is the sand boxing on iOS?
- saagarjha 7y agoSandboxing on iOS would not stop this sort of thing. Not that this would be useful on iOS, some all the libraries are combined into one file, mapped into every process, and easy to grab from a firmware image. (I guess this could be useful if you’re trying to debug something on an internal install?)
- aledalgrande 7y agoWonder if they're also doing creepy stuff with the other apps they bought (Instagram, Whatsapp)
- riyakhanna1983 7y agoIf the company leaders and employees have any integrity left, they should quit their jobs and do something that's actually worth doing for humanity and mankind.
- sova 7y agoYou reckon this facespace thing will ever catch on?
- ahachete 7y agoIt's not my business, as I don't use the FB app --and I won't. But even if the original intent was to help the debugging process, this is not acceptable. This is, to put it plainly, copying files from a user's device, without the user's consent. FB has the means (resources) to route around this and find the ways to properly debug apps. I hope this would find its way to Google Play blocking the app and a class action lawsuit. It's the only fair outcome.
- eurasiantiger 7y agoThis cannot be for feature detection. Are they looking for exploits?
- js2 7y agoAs someone who’s built my company’s mobile crash reporting solution, I have a guess why they might do this. It’s is extremely difficult to diagnose Android native code crashes. Unlike iOS where it is both straightforward to unwind on the phone, and where Apple makes the iOS system symbols available for symbolizing system frames in a stack trace, neither of these things are true on Android. My first approach for my company’s Android crash manager SDK was to use Google Breakpad. This works by capturing a snapshot of stack memory at the time of the crash. Unwinding then occurs on a backend server. But to unwind successfully, absent a frame pointer register, you need unwind info to provide to the unwinder. This simply isn’t available except for Nexus devices for which you can download the system images from Google. And even on devices where the code was compiled with a frame pointer, you still need symbols so you know what each frame’s function was. Another approach is to unwind on the device. In my experience, using libunwind, this is successful about 50% of the time. It also risks hanging the app, which looks even worse to the user than just crashing. Years ago, I briefly considered having our crash SDK, optionally and with user consent, extract the symbols and unwind data from the libraries on the device and upload them to our backend. I dismissed it as too expensive to do on a user’s phone. Instead, we crowd source as much as we can from our employee phones. Android native code crashes remain a bear to diagnose. Especially annoying since Android itself collects a ton of diagnostic data about your app when it crashes - it just doesn’t make it easily, or in some cases at all, accessible to the app itself.