Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook scans system libraries on Android and uploads them to their server

twitter.com

Post reply on HN
Print view View original

61–70 of 188 posts

Re: Facebook scans system libraries on Android and uploads them to their server

#61

Post by B_Throwaway »

dmitrygr wrote: post #47
javagram wrote: post #43

I was going to say this isn’t a big deal but copying and uploading the libraries is actually illegal (copyright violation) and users likely can’t even consent to this even if it is in the Facebook ToS as many android phones contain proprietary libraries not licensed for redistribution. The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. I doubt an…

Some older android devices running newer lineage/AICP/etc builds include a few libraries I wrote (in their entirety) for compatibility of old vendor prebuilts with new android versions - libdgv1 & libdmitry. Maybe I should C&D FB for laughs?

Absolutely!

Re: Facebook scans system libraries on Android and uploads them to their server

#62

Post by pjc50 »

saagarjha wrote: post #5

I'd expect that they're doing this because they'd like to diagnose crashes or bugs on systems that they don't have the hardware for. It's still somewhat creepy and possibly a fingerprinting mechanism.

Or alternatively feed them to a cracking team to look for vulnerabilities. Now, what they do with the vulnerabilities ...

Re: Facebook scans system libraries on Android and uploads them to their server

#63

Post by saagarjha »

Wowfunhappy wrote: post #50
saagarjha wrote: post #5

I'd expect that they're doing this because they'd like to diagnose crashes or bugs on systems that they don't have the hardware for. It's still somewhat creepy and possibly a fingerprinting mechanism.

If this was being done for fingerprinting, wouldn't it make more sense to use a hash of the libraries?

Taking the hash of the library doesn't help you when a user updates their device, though.

Re: Facebook scans system libraries on Android and uploads them to their server

#64

Post by saagarjha »

badfrog wrote: post #55
saagarjha wrote: post #41

Earlier quoted context omitted.

I wonder how many users would understand what these files are, why Facebook might want them, and what the risks are associated with sending these.

> what the risks are associated with sending these. What are the risks?

It enables very precise fingerprinting based on device and OS version, down to hardware revision and security patch level.

Re: Facebook scans system libraries on Android and uploads them to their server

#65

Post by saagarjha »

rolph wrote: post #59
saagarjha wrote: post #44

Earlier quoted context omitted.

As other commenters have mentioned, traditional sandboxing mechanisms would do little here. Applications are always given read access to system libraries because they need them to function.

im thinking about how we get to non traditional sandboxing

Here's a stupid idea I had elsewhere in the comments: https://news.ycombinator.com/item?id=20840466

Re: Facebook scans system libraries on Android and uploads them to their server

#66

Post by Silhouette »

Wowfunhappy wrote: post #48
javagram wrote: post #43

I was going to say this isn’t a big deal but copying and uploading the libraries is actually illegal (copyright violation) and users likely can’t even consent to this even if it is in the Facebook ToS as many android phones contain proprietary libraries not licensed for redistribution. The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. I doubt an…

> The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. Perhaps, but sadly, I don't actually foresee vendors wanting to exercise that right. From a business perspective, why bother?

From a business perspective, why bother?

Maybe in jurisdictions like the US, where the copyright lobby has been very effective in getting aggressive anti-piracy legislation with huge penalties enacted, the statutory damages alone could be astronomical? Since Facebook could still afford to pay them, it might also offer to settle for a very worthwhile sum without even the risk of going to court.

I'm generally not a fan of hugely disproportionate penalties for copyright infringement, but this isn't some normal person falling victim to opportunist lawyers engaging in a form of barratry, this is a huge company with its own legal team who should know better than to wilfully infringe copyright.

Re: Facebook scans system libraries on Android and uploads them to their server

#67

Post by Wowfunhappy »

saagarjha wrote: post #63
Wowfunhappy wrote: post #50

Earlier quoted context omitted.

If this was being done for fingerprinting, wouldn't it make more sense to use a hash of the libraries?

Taking the hash of the library doesn't help you when a user updates their device, though.

How would uploading the library help with that?

Re: Facebook scans system libraries on Android and uploads them to their server

#68

Post by not2b »

saagarjha wrote: post #63
Wowfunhappy wrote: post #50

Earlier quoted context omitted.

If this was being done for fingerprinting, wouldn't it make more sense to use a hash of the libraries?

Taking the hash of the library doesn't help you when a user updates their device, though.

Even ignoring the ethical questions it is a massive waste of bandwidth. They could hash the libraries, and if they get a cache miss, upload that one from one person (or perhaps a few people, since everything is in parallel). They then know what system libraries their users have installed without wasting a ton of bandwidth.

Next step to reduce creepiness is to only upload info on system libraries that actually affect the app (so if some users experience crashes and others don't, they can trace it to differences in system libraries).

Re: Facebook scans system libraries on Android and uploads them to their server

#70

Post by not2b »

ORioN63 wrote: post #52
mcraiha wrote: post #28

Earlier quoted context omitted.

You can identify devices with vulnerable libraries and do targeted attacks.

This. This is the biggest one for me. Anyone who has that data is capable of playing back the 0-days that affect android. How many android phones are kept out of date? As other user mentioned, the Android ecosystem is like the Wild West. Given there's a report for 2.5B active devices, how many can be affected by such an attack? 1% would affect 25M devices, around the population of Australia. 10% - 250 million devices…

Perhaps their motivation is to launch a campaign saying "Facebook keeps you safe!" by scanning your phone, and use it to justify people signing up for more surveillance. Perhaps this is a stealth beta test.
Post reply on HN