Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook scans system libraries on Android and uploads them to their server

twitter.com

Post reply on HN
Print view View original

11–20 of 188 posts

Re: Facebook scans system libraries on Android and uploads them to their server

#11

Post by prongletown »

mirimir wrote: post #10

How the bloody hell is it permitted for apps to be uploading system files? This wouldn't be possible in Linux, right? Basically, this is malware. Edit: Thanks, all. So OK, I get that it's possible, because apps have read and execute permissions for all libraries that they use. But it's not common for apps to upload system files, right?

>This wouldn't be possible in Linux, right?

If you have read access, then yes. Conventional desktop and server linux distributions would allow this behavior. As does android. Good luck using dylibs without it, anyways.

Since the android market is so fragmented and customized, this probably saves them from having to buy lots of phones when diagnosing crashes.

The knee-jerk reaction is to feel uncomfortable but these are system files, shipped with the phone, that are accessible to anyone who purchases the phone. This saves FB the trouble of spending $200 every time a new OS update comes out. Personally, with that knowledge, I don't have a problem with this - however, I have a ton of problems with other stuff FB does so I'm happy to keep not using their service.

Re: Facebook scans system libraries on Android and uploads them to their server

#13

Post by criddell »

wrs wrote: post #7

Why is this bad? Don’t most error reporting libraries send this sort of metadata with exception stacktraces? I would think this falls under the usual “improving the quality of the app” language in nearly everybody’s EULA.

I think if the data collection happened after a crash, that would be less outrageous. It looks like they scan and upload periodically.

I hope they at least wait for the user to connect to WiFi before pushing all that data.

Re: Facebook scans system libraries on Android and uploads them to their server

#14

Post by sharpneli »

mirimir wrote: post #10

How the bloody hell is it permitted for apps to be uploading system files? This wouldn't be possible in Linux, right? Basically, this is malware. Edit: Thanks, all. So OK, I get that it's possible, because apps have read and execute permissions for all libraries that they use. But it's not common for apps to upload system files, right?

You need read access to actually use them. Even if some file system trickery would be made to prevent it so that you couldn't fopen it, the actual binary code will be in memory accessible for your app, because it has to be there in order to run.

Re: Facebook scans system libraries on Android and uploads them to their server

#15

Post by CaptainZapp »

saagarjha wrote: post #5

I'd expect that they're doing this because they'd like to diagnose crashes or bugs on systems that they don't have the hardware for. It's still somewhat creepy and possibly a fingerprinting mechanism.

Your assessment would be reasonable whth just about any company.

But Facebook? Not so much.

Re: Facebook scans system libraries on Android and uploads them to their server

#16

Post by djsumdog »

mirimir wrote: post #10

How the bloody hell is it permitted for apps to be uploading system files? This wouldn't be possible in Linux, right? Basically, this is malware. Edit: Thanks, all. So OK, I get that it's possible, because apps have read and execute permissions for all libraries that they use. But it's not common for apps to upload system files, right?

Well Android does have a Linux kernel. The permissions happen at different layers within Android, as apps are run on their VM (Dalvik byte code). The /system partition is read-only on Android, but I don't /think/ you'd need any special permissions to read most of the system partition. The data partition is what's protected.

I mean, an application has to be able to read standard libraries to function, right? Same with any traditional Linux distro and /lib, /usr/lib. Really tight Apparmor or SELinux profiles can lock this down a bit.

Re: Facebook scans system libraries on Android and uploads them to their server

#17

Post by djsumdog »

prongletown wrote: post #11
mirimir wrote: post #10

How the bloody hell is it permitted for apps to be uploading system files? This wouldn't be possible in Linux, right? Basically, this is malware. Edit: Thanks, all. So OK, I get that it's possible, because apps have read and execute permissions for all libraries that they use. But it's not common for apps to upload system files, right?

>This wouldn't be possible in Linux, right? If you have read access, then yes. Conventional desktop and server linux distributions would allow this behavior. As does android. Good luck using dylibs without it, anyways. Since the android market is so fragmented and customized, this probably saves them from having to buy lots of phones when diagnosing crashes. The knee-jerk reaction is to feel uncomfortable but these a…

They could download the stock roms from the major manufacturers, only ship the hashes, and match up library versions that way.

Re: Facebook scans system libraries on Android and uploads them to their server

#20

Post by prongletown »

djsumdog wrote: post #17
prongletown wrote: post #11

Earlier quoted context omitted.

>This wouldn't be possible in Linux, right? If you have read access, then yes. Conventional desktop and server linux distributions would allow this behavior. As does android. Good luck using dylibs without it, anyways. Since the android market is so fragmented and customized, this probably saves them from having to buy lots of phones when diagnosing crashes. The knee-jerk reaction is to feel uncomfortable but these a…

They could download the stock roms from the major manufacturers, only ship the hashes, and match up library versions that way.

I'm not making a moral judgement (FB is a big yikes), just technical. They'd have to:

- build lists of every phone, including carrier variant and internal revisions (pretty common!), to make sure they could be sure they had a complete library

- rely on the manufacturer to publicly post the ROM (cheaper mfg wont do this) (or somehow retrieve the URL from the update mechanism, said URL not easily accessible from userspace)

- handle the multiple different packaging mechanisms that android phones, especially older versions use (Google has gone a long way in remediating this but FB has to support billions of devices that don't adhere to best practices).

- For ROM packages that are encrypted, they'd need to acquire the keys from real devices.

- and they still would not have visibility into non-posted firmware, such as factory versions with day 1 upgrades (aka many many devices)

OR

- grab the files and send 'em

Post reply on HN