Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook scans system libraries on Android and uploads them to their server

twitter.com

Post reply on HN
Print view View original

21–30 of 188 posts

Re: Facebook scans system libraries on Android and uploads them to their server

#21

Post by saagarjha »

sharpneli wrote: post #14
mirimir wrote: post #10

How the bloody hell is it permitted for apps to be uploading system files? This wouldn't be possible in Linux, right? Basically, this is malware. Edit: Thanks, all. So OK, I get that it's possible, because apps have read and execute permissions for all libraries that they use. But it's not common for apps to upload system files, right?

You need read access to actually use them. Even if some file system trickery would be made to prevent it so that you couldn't fopen it, the actual binary code will be in memory accessible for your app, because it has to be there in order to run.

Stupid idea: --X the pages for the library.

Re: Facebook scans system libraries on Android and uploads them to their server

#22

Post by austinheap »

prongletown wrote: post #20
djsumdog wrote: post #17

Earlier quoted context omitted.

They could download the stock roms from the major manufacturers, only ship the hashes, and match up library versions that way.

I'm not making a moral judgement (FB is a big yikes), just technical. They'd have to: - build lists of every phone, including carrier variant and internal revisions (pretty common!), to make sure they could be sure they had a complete library - rely on the manufacturer to publicly post the ROM (cheaper mfg wont do this) (or somehow retrieve the URL from the update mechanism, said URL not easily accessible from usersp…

But...what about my pitchfork? The knee-jerk reaction to every Facebook blog spam entirely diminishes the harm they've done to nations around the world.

Re: Facebook scans system libraries on Android and uploads them to their server

#23

Post by gruez »

saagarjha wrote: post #21
sharpneli wrote: post #14

Earlier quoted context omitted.

You need read access to actually use them. Even if some file system trickery would be made to prevent it so that you couldn't fopen it, the actual binary code will be in memory accessible for your app, because it has to be there in order to run.

Stupid idea: --X the pages for the library.

That would only work for the .text section. Other sections like .data, .rodata, and .bss need read access because they contain data required for the library to function (global variables, vtables, constants, etc.).

Re: Facebook scans system libraries on Android and uploads them to their server

#25

Post by saagarjha »

gruez wrote: post #23
saagarjha wrote: post #21

Earlier quoted context omitted.

Stupid idea: --X the pages for the library.

That would only work for the .text section. Other sections like .data, .rodata, and .bss need read access because they contain data required for the library to function (global variables, vtables, constants, etc.).

I'm not sure if Android allows for multiple mappings of the same page, but I could see something where global variables that are internal to the library are accessible only through a mapping that is known only to the binary itself (possibly by hardcoding it into instructions inside .text?) API needs to be exposed, of course, but ideally that would be the same across different implementations of a library.

Re: Facebook scans system libraries on Android and uploads them to their server

#26

Post by w3rhn2j34oh5o »

fareesh wrote: post #24

Aside from fingerprinting, what other nefarious uses could this have in theory?

Grabbing rootkit artifacts that could be on the device?

Its just that its not Facebooks place to do this. I wouldn't expect a app linux binary to upload the contents of /usr/lib, or a windows app to start sending system32 dll's off system.

FB can try to sell this as a 'lite-AntiVirus' type service, but that is not its place. There is no indication the app is doing this. Its FB being creepy as usual.

If Google did it, it would be less creepy, just like how Microsoft can grab malicious files detected by Defender -- but they write, support and protect the OS! FB is just an app. It shouldn't be harvesting its users operating system files!

Re: Facebook scans system libraries on Android and uploads them to their server

#27

Post by mpalczewski »

saagarjha wrote: post #6
mpalczewski wrote: post #4

Earlier quoted context omitted.

They don't upload the library just their filename and hash. Probably for bug troubleshooting, device fingerprinting and feature availability data. It's a bit much, device fingerprinting like this should get you banned from the play store. However there are legitimate uses for this.

They're uploading the actual binary as well: https://twitter.com/wongmjane/status/1167463077748436993

I read that wrong. you're right.
Post reply on HN