7 ms·

How the bloody hell is it permitted for apps to be uploading system files? This wouldn't be possible in Linux, right? Basically, this is malware. Edit: Thank

How the bloody hell is it permitted for apps to be uploading system files? This wouldn't be possible in Linux, right? Basically, this is malware. Edit: Thanks, all. So OK, I get that it's possible, because apps have read and execute permissions for all libraries that they use. But it's not common for apps to upload system files, right?

prongletown 7y ago
>This wouldn't be possible in Linux, right? If you have read access, then yes. Conventional desktop and server linux distributions would allow this behavior. As does android. Good luck using dylibs without it, anyways. Since the android market is so fragmented and customized, this probably saves them from having to buy lots of phones when diagnosing crashes. The knee-jerk reaction is to feel uncomfortable but these are system files, shipped with the phone, that are accessible to anyone who purchases the phone. This saves FB the trouble of spending $200 every time a new OS update comes out. Personally, with that knowledge, I don't have a problem with this - however, I have a ton of problems with other stuff FB does so I'm happy to keep not using their service.
- djsumdog 7y ago
  They could download the stock roms from the major manufacturers, only ship the hashes, and match up library versions that way.
  - prongletown 7y ago
    I'm not making a moral judgement (FB is a big yikes), just technical. They'd have to: - build lists of every phone, including carrier variant and internal revisions (pretty common!), to make sure they could be sure they had a complete library - rely on the manufacturer to publicly post the ROM (cheaper mfg wont do this) (or somehow retrieve the URL from the update mechanism, said URL not easily accessible from userspace) - handle the multiple different packaging mechanisms that android phones, especially older versions use (Google has gone a long way in remediating this but FB has to support billions of devices that don't adhere to best practices). - For ROM packages that are encrypted, they'd need to acquire the keys from real devices. - and they still would not have visibility into non-posted firmware, such as factory versions with day 1 upgrades (aka many many devices) OR - grab the files and send 'em
    - austinheap 7y ago
      But...what about my pitchfork? The knee-jerk reaction to every Facebook blog spam entirely diminishes the harm they've done to nations around the world.
      - vvanders 7y ago
        Yeah sorry, they could send ro.build.fingerprint instead if they really wanted to know what version of builds and devices out there are causing issues. I can see this as an opt-in but not as a silent, default behavior.
    - shuckles 7y ago
      At the very least, the privacy-respecting solution would be to upload hashes and only upload libraries once some critical mass of users had reported the hash along with a bug. Even then, you would only upload the files themselves from some capped number of users.
      - janekm 7y ago
        That makes no difference from a privacy point of view but would be more respectful of people’s bandwidth limits.
        shuckles 7y ago
        Yes it does. At the very least, people running custom libraries that nobody else does would never upload data.
    - MauranKilom 7y ago
      1. Uploading files from the user phone to their servers is straight up copyright violation in plenty of cases. 2. I have doubts that you need copies of all kinds of system libraries to debug that crash. They won't help you debug a crash dump (assuming they don't have debug symbols left in for some reason). They generally won't help you reproduce the crash unless you actually know reproduction steps - it wouldn't surprise me if they tracked every user action, but I doubt they do - so it takes many of those crashes to even start debugging. At that point you probably know precisely which library you need and can obtain it legally. That said, I agree that uploading the files themselves is not necessary to fingerprint users (the hashes would totally suffice). Unless they do the uploading as a cover-up story, which doesn't make much sense either.
- _bxg1 7y ago
  > If you have read access, then yes. Conventional desktop and server linux distributions would allow this behavior. The difference is in people's expectations of mobile vs. desktop apps. You'd never install untrusted software on your desktop, but mobile OSes provide the sense that software is isolated. In Android, that's mostly an illusion.
  - feanaro 7y ago
    I feel like users install untrusted software on the desktop all the time and it's called closed source software. It's not like Facebook is some small, unknown malware peddler so that its software should be considered "untrusted". If anything, it's untrusted because it's coming from a scummy company and opaque (due to being closed source).
    - _bxg1 7y ago
      You're right that it being from Facebook makes things a little different. At the same time, I've never needed to install a native desktop app from Facebook and I'd have some suspicion about doing so if such a thing existed, for exactly this reason.
  - usr1106 7y ago
    > The difference is in people's expectations of mobile vs. desktop apps. You'd never install untrusted software on your desktop I knew many Linux desktop users who had installed the Slack client back in the days we used Slack at work. Myself I have installed Skype. Not that I find Skype particularly good, but sometimes I need to communicate with people who have no clue about software freedom. So, yes the number of "untrusted apps" is significantly lower on a (Linux) desktop, but "you'd never install" is an incorrect characterization.
- tripzilch 7y ago
  > This saves FB the trouble of spending $200 every time a new OS update comes out. So it is piracy.
sharpneli 7y ago
You need read access to actually use them. Even if some file system trickery would be made to prevent it so that you couldn't fopen it, the actual binary code will be in memory accessible for your app, because it has to be there in order to run.
- saagarjha 7y ago
  Stupid idea: --X the pages for the library.
  - gruez 7y ago
    That would only work for the .text section. Other sections like .data, .rodata, and .bss need read access because they contain data required for the library to function (global variables, vtables, constants, etc.).
    - saagarjha 7y ago
      I'm not sure if Android allows for multiple mappings of the same page, but I could see something where global variables that are internal to the library are accessible only through a mapping that is known only to the binary itself (possibly by hardcoding it into instructions inside .text?) API needs to be exposed, of course, but ideally that would be the same across different implementations of a library.
      - AnIdiotOnTheNet 7y ago
        What problem are you actually trying to solve though? System libraries are not secrets, there really isn't any good reason we should go through these hoops to prevent reading them.
        saagarjha 7y ago
        They contain identifying information.
djsumdog 7y ago
Well Android does have a Linux kernel. The permissions happen at different layers within Android, as apps are run on their VM (Dalvik byte code). The /system partition is read-only on Android, but I don't /think/ you'd need any special permissions to read most of the system partition. The data partition is what's protected. I mean, an application has to be able to read standard libraries to function, right? Same with any traditional Linux distro and /lib, /usr/lib. Really tight Apparmor or SELinux profiles can lock this down a bit.
- gnfurlong 7y ago
  Regarding apparmor/selinux, who creates/audits those profiles to make sure each application only has access to exactly the libraries it needs? It probably defeats the purpose if it's the app authors. Similarly, who validates that these profiles don't break functionality for any device/os version? I could see this being an option for power users who are willing to collaborate on creating the profiles and deal with fixing the occasional incomplete profile. I'm not sure how feasible it'd be as a solution for your typical user though.
deleted 7y ago
[deleted]
mindslight 7y ago
System libraries are trivially readable, but "Linux" escapes this problem by not setting itself up as a playground for malicious actors alongside personal use. The Android model is basically to give a shell account to anyone for asking, while trying to protect the privacy of the sysadmin.

prongletown 7y ago

>This wouldn't be possible in Linux, right? If you have read access, then yes. Conventional desktop and server linux distributions would allow this behavior. As does android. Good luck using dylibs without it, anyways. Since the android market is so fragmented and customized, this probably saves them from having to buy lots of phones when diagnosing crashes. The knee-jerk reaction is to feel uncomfortable but these are system files, shipped with the phone, that are accessible to anyone who purchases the phone. This saves FB the trouble of spending $200 every time a new OS update comes out. Personally, with that knowledge, I don't have a problem with this - however, I have a ton of problems with other stuff FB does so I'm happy to keep not using their service.

djsumdog 7y ago
They could download the stock roms from the major manufacturers, only ship the hashes, and match up library versions that way.
- prongletown 7y ago
  I'm not making a moral judgement (FB is a big yikes), just technical. They'd have to: - build lists of every phone, including carrier variant and internal revisions (pretty common!), to make sure they could be sure they had a complete library - rely on the manufacturer to publicly post the ROM (cheaper mfg wont do this) (or somehow retrieve the URL from the update mechanism, said URL not easily accessible from userspace) - handle the multiple different packaging mechanisms that android phones, especially older versions use (Google has gone a long way in remediating this but FB has to support billions of devices that don't adhere to best practices). - For ROM packages that are encrypted, they'd need to acquire the keys from real devices. - and they still would not have visibility into non-posted firmware, such as factory versions with day 1 upgrades (aka many many devices) OR - grab the files and send 'em
  - austinheap 7y ago
    But...what about my pitchfork? The knee-jerk reaction to every Facebook blog spam entirely diminishes the harm they've done to nations around the world.
    - vvanders 7y ago
      Yeah sorry, they could send ro.build.fingerprint instead if they really wanted to know what version of builds and devices out there are causing issues. I can see this as an opt-in but not as a silent, default behavior.
  - shuckles 7y ago
    At the very least, the privacy-respecting solution would be to upload hashes and only upload libraries once some critical mass of users had reported the hash along with a bug. Even then, you would only upload the files themselves from some capped number of users.
    - janekm 7y ago
      That makes no difference from a privacy point of view but would be more respectful of people’s bandwidth limits.
      - shuckles 7y ago
        Yes it does. At the very least, people running custom libraries that nobody else does would never upload data.
  - MauranKilom 7y ago
    1. Uploading files from the user phone to their servers is straight up copyright violation in plenty of cases. 2. I have doubts that you need copies of all kinds of system libraries to debug that crash. They won't help you debug a crash dump (assuming they don't have debug symbols left in for some reason). They generally won't help you reproduce the crash unless you actually know reproduction steps - it wouldn't surprise me if they tracked every user action, but I doubt they do - so it takes many of those crashes to even start debugging. At that point you probably know precisely which library you need and can obtain it legally. That said, I agree that uploading the files themselves is not necessary to fingerprint users (the hashes would totally suffice). Unless they do the uploading as a cover-up story, which doesn't make much sense either.
_bxg1 7y ago
> If you have read access, then yes. Conventional desktop and server linux distributions would allow this behavior. The difference is in people's expectations of mobile vs. desktop apps. You'd never install untrusted software on your desktop, but mobile OSes provide the sense that software is isolated. In Android, that's mostly an illusion.
- feanaro 7y ago
  I feel like users install untrusted software on the desktop all the time and it's called closed source software. It's not like Facebook is some small, unknown malware peddler so that its software should be considered "untrusted". If anything, it's untrusted because it's coming from a scummy company and opaque (due to being closed source).
  - _bxg1 7y ago
    You're right that it being from Facebook makes things a little different. At the same time, I've never needed to install a native desktop app from Facebook and I'd have some suspicion about doing so if such a thing existed, for exactly this reason.
- usr1106 7y ago
  > The difference is in people's expectations of mobile vs. desktop apps. You'd never install untrusted software on your desktop I knew many Linux desktop users who had installed the Slack client back in the days we used Slack at work. Myself I have installed Skype. Not that I find Skype particularly good, but sometimes I need to communicate with people who have no clue about software freedom. So, yes the number of "untrusted apps" is significantly lower on a (Linux) desktop, but "you'd never install" is an incorrect characterization.
tripzilch 7y ago
> This saves FB the trouble of spending $200 every time a new OS update comes out. So it is piracy.

sharpneli 7y ago

You need read access to actually use them. Even if some file system trickery would be made to prevent it so that you couldn't fopen it, the actual binary code will be in memory accessible for your app, because it has to be there in order to run.

saagarjha 7y ago
Stupid idea: --X the pages for the library.
- gruez 7y ago
  That would only work for the .text section. Other sections like .data, .rodata, and .bss need read access because they contain data required for the library to function (global variables, vtables, constants, etc.).
  - saagarjha 7y ago
    I'm not sure if Android allows for multiple mappings of the same page, but I could see something where global variables that are internal to the library are accessible only through a mapping that is known only to the binary itself (possibly by hardcoding it into instructions inside .text?) API needs to be exposed, of course, but ideally that would be the same across different implementations of a library.
    - AnIdiotOnTheNet 7y ago
      What problem are you actually trying to solve though? System libraries are not secrets, there really isn't any good reason we should go through these hoops to prevent reading them.
      - saagarjha 7y ago
        They contain identifying information.

djsumdog 7y ago

Well Android does have a Linux kernel. The permissions happen at different layers within Android, as apps are run on their VM (Dalvik byte code). The /system partition is read-only on Android, but I don't /think/ you'd need any special permissions to read most of the system partition. The data partition is what's protected. I mean, an application has to be able to read standard libraries to function, right? Same with any traditional Linux distro and /lib, /usr/lib. Really tight Apparmor or SELinux profiles can lock this down a bit.

gnfurlong 7y ago
Regarding apparmor/selinux, who creates/audits those profiles to make sure each application only has access to exactly the libraries it needs? It probably defeats the purpose if it's the app authors. Similarly, who validates that these profiles don't break functionality for any device/os version? I could see this being an option for power users who are willing to collaborate on creating the profiles and deal with fixing the occasional incomplete profile. I'm not sure how feasible it'd be as a solution for your typical user though.

deleted 7y ago

[deleted]

mindslight 7y ago

System libraries are trivially readable, but "Linux" escapes this problem by not setting itself up as a playground for malicious actors alongside personal use. The Android model is basically to give a shell account to anyone for asking, while trying to protect the privacy of the sysadmin.