9 ms·

How did Facebook intercept competitor's encrypted mobile app traffic? (2024)

135 points by taubek 1y ago

xrayarx 1y ago
TFA is from 2024, so the title is wrong
- tomhow 1y ago
  Updated, thanks!
xrayarx 1y ago
Quote: A technical investigation into information uncovered in a class action lawsuit that Facebook had intercepted encrypted traffic from user's devices running the Onavo Protect app in order to gain competitive insights.
- nottorp 1y ago
  If this is true, why is this a civil lawsuit? Shouldn't the government prosecutors handle this "hacking" case and demand jail time, like they do for $random_kid playing around with security vulnerabilities?
  - yubblegum 1y ago
    Because: $random_kid is not running an outsourced surveillance service for the security state.
  - gruez 1y ago
    >Shouldn't the government prosecutors handle this "hacking" case and demand jail time, like they do for $random_kid playing around with security vulnerabilities? Because there's probably some clause buried in the ToS that gives them the right to do this, so it would not count as "exceeds authorized access" under the CFAA. edit: it's not even buried. there's a screen that specifically says "facebook uses aggregated onavo data for market and business analytics"
    - salawat 1y ago
      So... Where was the negotiation step where there was the option to do VPN'ry without the surveillance? Take it or leave it license agreements in my opinion violate meeting-of-the-minds, and our legal system has just cut a pass for the last half a century to one sided take it or leave it levels of exploitative entering into contracts at scale. Not one company, in particular, tech companies, have a legal pipeline that can support redlining a contract or facilitating negotiation at scale which is the actual desired incarnation of contract law as a tool of mutual empowerment through agreements. We need to seriously hold our system to account for building only the accept as-is part of the pipeline, but not the negotiation side of the pipeline. Make no mistake either, as that was an intentional decision to chase growth in the interests of becoming TBTF. We need to clamp down and make it clear, big mofos do not get to call unilateral shots and that it is not acceptable for terms to be dictated only in one direction. Yes, this complicates the hell out of business logic, but ya know what, the ones who have TBTF'd have drank of the waters of economies of scale to get the sweet draught, it's about damn time they got the bitters too.
      - gruez 1y ago
        >Take it or leave it license agreements in my opinion violate meeting-of-the-minds, and our legal system has just cut a pass for the last half a century to one sided take it or leave it levels of exploitative entering into contracts at scale. I might be sympathetic to this if this was some essential service with strong network effects such that there's no alternative (eg. facebook or whatsapp), but that's not the case here. This is a separate "security" app, of which there's probably dozens of competitors that you can choose from if you don't like the ToS/privacy policy of this one, so the "one sided take it or leave it levels of exploitative entering into contracts at scale" aspect you're decrying really rings hollow.
        salawat 1y ago
        >This is a separate "security" app, of which there's probably dozens of competitors that you can choose from if you don't like the ToS/privacy policy of this one, so the "one sided take it or leave it levels of exploitative entering into contracts at scale" aspect you're decrying really rings hollow. You mean like a loud ass bell rings? Point out to me a single piece of software utilizing a EULA that supports individual redlining and renegotiation on a user by user basis, with a feedback loop tight enough to be reasonable. I'll wait. The point is there might be the illusion of user choice there, but when the overarching legal framework operates in unity in a take it or leave it fashion, with no escape hatch, every business model behaves the same. No one builds the business willing to charge for contractual dumb pipe, because everyone is just dumping anyone else who won't take the default terms. The entire architecture of our networked world has turned into building machines through which everyone gives up every right and civil protection through a goddamn click, nevermind the fact Third Party Doctrine in this age has completely dismantled the 4th Amendment by extension.
  - DrillShopper 1y ago
    Because Facebook is key to their online surveillance, so Facebook making itself better is making itself more effective to the state surveillance apparatus
  - benmmurphy 1y ago
    I assume because there was no actual hacking. I'm guessing users consented to this. As a user I should be able to view all traffic from my device and also give other third parties permission to view all traffic on my device. If I can't do this, is it really my device? It's not too much different from what Nielsen was doing when they installed boxes in people's homes to record what TV shows they were watching.
  - Arnt 1y ago
    You can file a civil lawsuit. You may or may not be able to persuade the prosecutor to file a criminal case. The video near the middle of the page shows fairly clearly what they did, with accurate and understandable descriptions of shady behaviour. I think a capable prosecutor might regard it as difficult to prove that behaviour illegal. Shady, sure, but in dubio pro so why even prosecute. So that leaves a civil lawsuit. There's no need to persuade a prosecutor for a civil lawsuit, and the balance of evidence counts, there's no in dubio pro.
    - qingcharles 1y ago
      I think there are still some small pockets of the USA where a person can file a private prosecution. And other countries definitely allow it.
      - Arnt 1y ago
        Right, so a third option is to try to establish jurisdiction in a location where private prosecution of criminal issues is permitted.
  - pjc50 1y ago
    Just like AI companies are allowed to do the piracy that Aaron Schwartz was going to be jailed for, Facebook are too big to prosecute for hacking.
xrayarx 1y ago
Previously: https://news.ycombinator.com/item?id=41090304 https://news.ycombinator.com/item?id=41090304
hopelite 1y ago
On a side, but related note; all our societies need to reevaluate the corporate protections from personal liability when the activities breach the articles of incorporation, the so called veil; barring demonstrated accident or mistake. This "corporate veil" and protection is really the same basis as the legal fiction called "qualified immunity"... in the case of police officers, they can even quite literally murder you with impunity in far too many cases that is acceptable. Isn't it odd how a "citizen" who is supposed to actually be in control of the government through self-determination, has approaching zero power, bu the putrid agents of the despotic power of illegitimate government have literal immunity to commit murder. This kind of activity is not just a corporate whoopsie, it's active, deliberate, criminal activity, and organized criminal activity at that; making in this case (but there are many other examples) Meta an organized criminal outfit. Are you personally immune from prosecution if a "corporation" tells you to murder someone? Why would you then not be personally criminally liable for perpetrating other crimes because the "corporation" told you to do it; regardless of whether that is committing cybercrimes, committing financial fraud, or even just something as simple as breach of the peace if a manager is accosting an employee?
- Zak 1y ago
  I'm for more personal liability, but corporate higher-ups are pretty good at communicating their illegal desires to subordinates without saying the illegal part out loud. I think the corporate death penalty is underused. Being in leadership when a corporation is dissolved for committing crimes is probably bad for one's future employment prospects.
  - saubeidl 1y ago
    I wonder if the RICO act could be applied...
    - gruez 1y ago
      It's never rico. https://law.stackexchange.com/questions/60509/what-is-the-thing-called-rico https://law.stackexchange.com/questions/60509/what-is-the-th...
encom 1y ago
I don't see what the big deal is. SSL MITM is CloudFlare's whole business model.
- devmor 1y ago
  Is CloudFlare datamining that traffic to build intelligence profiles on its users and for anti-competitive business practices? Is CloudFlare hiding that they are a terminating proxy and pretending to be a VPN for the purposes of spying on users? The big deal isn't the technical aspect, it's what it was used for and how it was used.
- vaylian 1y ago
  Care to elaborate? How do they make money?
  - tom1337 1y ago
    While OP is a bit hyperbolic here CloudFlare essentially is a Man In The Mittle. They serve your content via a CDN and cache it around the globe. If you use cloudflare, the SSL terminates at their servers, meaning that (theoretically) they could read al contents send via their network. While yes, you can put on you tinfoil hat and say that this is an central intelligences dream to have such a global man in the middle proxy there are no fact based reports that undermine cloudflare abusing their position. They mostly make their money by selling you better services on their CDN such as image scaling etc.
    - encom 1y ago
      Hyperbole is my middle name, but I just find it repulsive that CloudFlare breaks the chain of trust, and somehow everybody is just okay with that. I'm not saying it makes HTTPS pointless, but we've moved from end-to-end encryption to trust-me-bro. Is CloudFlare malicious? Probably not - at least not right now. But I think my browser should warn me that my connection is not E2E secure, because it's not.
      - benlivengood 1y ago
SoftTalker 1y ago
Don't run a VPN from a company whose entire business model is knowing everything about you and what you do online.
drraah 1y ago
How is it not a criminal offence to impersonate a different company to decrypt customer data?
- dboreham 1y ago
  What is criminal depends on how much money you have.
  - dabbz 1y ago
    It's more about only exploiting people who have less money than you do.
- kiawe 1y ago
  It is, but they bribe the people who police this
- theshrike79 1y ago
  It was a criminal offencefor Aaron Swartz to download books. But when Zuckerberg did it at an industrial scale, he was just "training his AI model", which made it just fine. Same thing here.
dehrmann 1y ago
> Onavo Protect Android app, which had over 10 million Android installations, contained code to prompt the user to install a CA (certificate authority) certificate issued by "Facebook Research" in the user trust store of the device. This certificate was required for Facebook to decrypt TLS traffic. I mostly can't think of a legitimate reason to install your own root certificate for a VPN, so I'm inclined to buy that this is Facebook being Facebook. I would also run as fast as I can if I installed an app and it started prompting me to install a certificate, but 99% of people have absolutely zero idea how TLS and PKI work, so maybe this is taking advantage of their ignorance.
geoffbp 1y ago
I saw this story linked from a twitter post, really interesting. It makes a lot of sense, make purchases based upon data / metrics
qwertox 1y ago
Just keep in mind that Meta has not changed a bit since then. This is from two months ago, when it was found that their Android app listens on a localhost port in order to send identifiers from webpages to their app via WebRTC so that they can still track users. Covert web-to-app tracking via localhost on Android - https://news.ycombinator.com/item?id=44169115 https://news.ycombinator.com/item?id=44169115 Meta pauses mobile port tracking tech on Android after researchers cry foul - https://news.ycombinator.com/item?id=44175940 https://news.ycombinator.com/item?id=44175940 > This web-to-app ID sharing method bypasses typical privacy protections such as clearing cookies, Incognito Mode and Android's permission controls. Worse, it opens the door for potentially malicious apps eavesdropping on users’ web activity.
- 9dev 1y ago
  I wonder how it feels to be an engineer at Meta. Do you leave your conscience at the door when you start the workday? Make no mistake, if this company pays your salary, you are an accomplice no matter if you personally did take part in it. How do you look yourself in the eyes?
  - owebmaster 1y ago
    The ones I've met thought they were doing the world a favor
    - reptilian 1y ago
      Until you realise the whole operation is a Mossad and US intelligence front.
  - theshrike79 1y ago
    With enough money it's possible to turn off your conscience. That combined with people whoa are more into the technical challenge of it and won't be thinking about the moral implications.
reptilian 1y ago
The stories I could tell you about Onavo. Ask anyone from the Facebook Growth Org. There's so much undisclosed dirt here it's insane...
- BizarroLand 1y ago
  I bet you could make some decent money by reaching out to the plaintiffs lawyers. Expert Witnesses can easily make $600+ / hr
  - reptilian 1y ago
    That's a really cool idea. It's been traumatic carrying this bullshit, tbh. So many nasty secrets.

135 points by taubek 1y ago

xrayarx 1y ago

TFA is from 2024, so the title is wrong

tomhow 1y ago
Updated, thanks!

xrayarx 1y ago

Quote: A technical investigation into information uncovered in a class action lawsuit that Facebook had intercepted encrypted traffic from user's devices running the Onavo Protect app in order to gain competitive insights.

nottorp 1y ago
If this is true, why is this a civil lawsuit? Shouldn't the government prosecutors handle this "hacking" case and demand jail time, like they do for $random_kid playing around with security vulnerabilities?
- yubblegum 1y ago
  Because: $random_kid is not running an outsourced surveillance service for the security state.
- gruez 1y ago
  >Shouldn't the government prosecutors handle this "hacking" case and demand jail time, like they do for $random_kid playing around with security vulnerabilities? Because there's probably some clause buried in the ToS that gives them the right to do this, so it would not count as "exceeds authorized access" under the CFAA. edit: it's not even buried. there's a screen that specifically says "facebook uses aggregated onavo data for market and business analytics"
  - salawat 1y ago
    So... Where was the negotiation step where there was the option to do VPN'ry without the surveillance? Take it or leave it license agreements in my opinion violate meeting-of-the-minds, and our legal system has just cut a pass for the last half a century to one sided take it or leave it levels of exploitative entering into contracts at scale. Not one company, in particular, tech companies, have a legal pipeline that can support redlining a contract or facilitating negotiation at scale which is the actual desired incarnation of contract law as a tool of mutual empowerment through agreements. We need to seriously hold our system to account for building only the accept as-is part of the pipeline, but not the negotiation side of the pipeline. Make no mistake either, as that was an intentional decision to chase growth in the interests of becoming TBTF. We need to clamp down and make it clear, big mofos do not get to call unilateral shots and that it is not acceptable for terms to be dictated only in one direction. Yes, this complicates the hell out of business logic, but ya know what, the ones who have TBTF'd have drank of the waters of economies of scale to get the sweet draught, it's about damn time they got the bitters too.
    - gruez 1y ago
      >Take it or leave it license agreements in my opinion violate meeting-of-the-minds, and our legal system has just cut a pass for the last half a century to one sided take it or leave it levels of exploitative entering into contracts at scale. I might be sympathetic to this if this was some essential service with strong network effects such that there's no alternative (eg. facebook or whatsapp), but that's not the case here. This is a separate "security" app, of which there's probably dozens of competitors that you can choose from if you don't like the ToS/privacy policy of this one, so the "one sided take it or leave it levels of exploitative entering into contracts at scale" aspect you're decrying really rings hollow.
      - salawat 1y ago
        >This is a separate "security" app, of which there's probably dozens of competitors that you can choose from if you don't like the ToS/privacy policy of this one, so the "one sided take it or leave it levels of exploitative entering into contracts at scale" aspect you're decrying really rings hollow. You mean like a loud ass bell rings? Point out to me a single piece of software utilizing a EULA that supports individual redlining and renegotiation on a user by user basis, with a feedback loop tight enough to be reasonable. I'll wait. The point is there might be the illusion of user choice there, but when the overarching legal framework operates in unity in a take it or leave it fashion, with no escape hatch, every business model behaves the same. No one builds the business willing to charge for contractual dumb pipe, because everyone is just dumping anyone else who won't take the default terms. The entire architecture of our networked world has turned into building machines through which everyone gives up every right and civil protection through a goddamn click, nevermind the fact Third Party Doctrine in this age has completely dismantled the 4th Amendment by extension.
- DrillShopper 1y ago
  Because Facebook is key to their online surveillance, so Facebook making itself better is making itself more effective to the state surveillance apparatus
- benmmurphy 1y ago
  I assume because there was no actual hacking. I'm guessing users consented to this. As a user I should be able to view all traffic from my device and also give other third parties permission to view all traffic on my device. If I can't do this, is it really my device? It's not too much different from what Nielsen was doing when they installed boxes in people's homes to record what TV shows they were watching.
- Arnt 1y ago
  You can file a civil lawsuit. You may or may not be able to persuade the prosecutor to file a criminal case. The video near the middle of the page shows fairly clearly what they did, with accurate and understandable descriptions of shady behaviour. I think a capable prosecutor might regard it as difficult to prove that behaviour illegal. Shady, sure, but in dubio pro so why even prosecute. So that leaves a civil lawsuit. There's no need to persuade a prosecutor for a civil lawsuit, and the balance of evidence counts, there's no in dubio pro.
  - qingcharles 1y ago
    I think there are still some small pockets of the USA where a person can file a private prosecution. And other countries definitely allow it.
    - Arnt 1y ago
      Right, so a third option is to try to establish jurisdiction in a location where private prosecution of criminal issues is permitted.
- pjc50 1y ago
  Just like AI companies are allowed to do the piracy that Aaron Schwartz was going to be jailed for, Facebook are too big to prosecute for hacking.

xrayarx 1y ago

Previously: https://news.ycombinator.com/item?id=41090304 https://news.ycombinator.com/item?id=41090304

hopelite 1y ago

On a side, but related note; all our societies need to reevaluate the corporate protections from personal liability when the activities breach the articles of incorporation, the so called veil; barring demonstrated accident or mistake. This "corporate veil" and protection is really the same basis as the legal fiction called "qualified immunity"... in the case of police officers, they can even quite literally murder you with impunity in far too many cases that is acceptable. Isn't it odd how a "citizen" who is supposed to actually be in control of the government through self-determination, has approaching zero power, bu the putrid agents of the despotic power of illegitimate government have literal immunity to commit murder. This kind of activity is not just a corporate whoopsie, it's active, deliberate, criminal activity, and organized criminal activity at that; making in this case (but there are many other examples) Meta an organized criminal outfit. Are you personally immune from prosecution if a "corporation" tells you to murder someone? Why would you then not be personally criminally liable for perpetrating other crimes because the "corporation" told you to do it; regardless of whether that is committing cybercrimes, committing financial fraud, or even just something as simple as breach of the peace if a manager is accosting an employee?

Zak 1y ago
I'm for more personal liability, but corporate higher-ups are pretty good at communicating their illegal desires to subordinates without saying the illegal part out loud. I think the corporate death penalty is underused. Being in leadership when a corporation is dissolved for committing crimes is probably bad for one's future employment prospects.
- saubeidl 1y ago
  I wonder if the RICO act could be applied...
  - gruez 1y ago
    It's never rico. https://law.stackexchange.com/questions/60509/what-is-the-thing-called-rico https://law.stackexchange.com/questions/60509/what-is-the-th...

encom 1y ago

I don't see what the big deal is. SSL MITM is CloudFlare's whole business model.

devmor 1y ago
Is CloudFlare datamining that traffic to build intelligence profiles on its users and for anti-competitive business practices? Is CloudFlare hiding that they are a terminating proxy and pretending to be a VPN for the purposes of spying on users? The big deal isn't the technical aspect, it's what it was used for and how it was used.
vaylian 1y ago
Care to elaborate? How do they make money?
- tom1337 1y ago
  While OP is a bit hyperbolic here CloudFlare essentially is a Man In The Mittle. They serve your content via a CDN and cache it around the globe. If you use cloudflare, the SSL terminates at their servers, meaning that (theoretically) they could read al contents send via their network. While yes, you can put on you tinfoil hat and say that this is an central intelligences dream to have such a global man in the middle proxy there are no fact based reports that undermine cloudflare abusing their position. They mostly make their money by selling you better services on their CDN such as image scaling etc.
  - encom 1y ago
    Hyperbole is my middle name, but I just find it repulsive that CloudFlare breaks the chain of trust, and somehow everybody is just okay with that. I'm not saying it makes HTTPS pointless, but we've moved from end-to-end encryption to trust-me-bro. Is CloudFlare malicious? Probably not - at least not right now. But I think my browser should warn me that my connection is not E2E secure, because it's not.
    - benlivengood 1y ago

SoftTalker 1y ago

Don't run a VPN from a company whose entire business model is knowing everything about you and what you do online.

drraah 1y ago

How is it not a criminal offence to impersonate a different company to decrypt customer data?

dboreham 1y ago
What is criminal depends on how much money you have.
- dabbz 1y ago
  It's more about only exploiting people who have less money than you do.
kiawe 1y ago
It is, but they bribe the people who police this
theshrike79 1y ago
It was a criminal offencefor Aaron Swartz to download books. But when Zuckerberg did it at an industrial scale, he was just "training his AI model", which made it just fine. Same thing here.

dehrmann 1y ago

> Onavo Protect Android app, which had over 10 million Android installations, contained code to prompt the user to install a CA (certificate authority) certificate issued by "Facebook Research" in the user trust store of the device. This certificate was required for Facebook to decrypt TLS traffic. I mostly can't think of a legitimate reason to install your own root certificate for a VPN, so I'm inclined to buy that this is Facebook being Facebook. I would also run as fast as I can if I installed an app and it started prompting me to install a certificate, but 99% of people have absolutely zero idea how TLS and PKI work, so maybe this is taking advantage of their ignorance.

geoffbp 1y ago

I saw this story linked from a twitter post, really interesting. It makes a lot of sense, make purchases based upon data / metrics

qwertox 1y ago

Just keep in mind that Meta has not changed a bit since then. This is from two months ago, when it was found that their Android app listens on a localhost port in order to send identifiers from webpages to their app via WebRTC so that they can still track users. Covert web-to-app tracking via localhost on Android - https://news.ycombinator.com/item?id=44169115 https://news.ycombinator.com/item?id=44169115 Meta pauses mobile port tracking tech on Android after researchers cry foul - https://news.ycombinator.com/item?id=44175940 https://news.ycombinator.com/item?id=44175940 > This web-to-app ID sharing method bypasses typical privacy protections such as clearing cookies, Incognito Mode and Android's permission controls. Worse, it opens the door for potentially malicious apps eavesdropping on users’ web activity.

9dev 1y ago
I wonder how it feels to be an engineer at Meta. Do you leave your conscience at the door when you start the workday? Make no mistake, if this company pays your salary, you are an accomplice no matter if you personally did take part in it. How do you look yourself in the eyes?
- owebmaster 1y ago
  The ones I've met thought they were doing the world a favor
  - reptilian 1y ago
    Until you realise the whole operation is a Mossad and US intelligence front.
- theshrike79 1y ago
  With enough money it's possible to turn off your conscience. That combined with people whoa are more into the technical challenge of it and won't be thinking about the moral implications.

reptilian 1y ago

The stories I could tell you about Onavo. Ask anyone from the Facebook Growth Org. There's so much undisclosed dirt here it's insane...

BizarroLand 1y ago
I bet you could make some decent money by reaching out to the plaintiffs lawyers. Expert Witnesses can easily make $600+ / hr
- reptilian 1y ago
  That's a really cool idea. It's been traumatic carrying this bullshit, tbh. So many nasty secrets.