111–120 of 188 posts
Earlier quoted context omitted.
You need read access to actually use them. Even if some file system trickery would be made to prevent it so that you couldn't fopen it, the actual binary code will be in memory accessible for your app, because it has to be there in order to run.
Stupid idea: --X the pages for the library.
Earlier quoted context omitted.
As other commenters have mentioned, traditional sandboxing mechanisms would do little here. Applications are always given read access to system libraries because they need them to function.
im thinking about how we get to non traditional sandboxing
Aside from fingerprinting, what other nefarious uses could this have in theory?
Earlier quoted context omitted.
That, or they don't care. Or they don't care enough.
If you do care, you get filtered out.
how was she able to capture / sniff those HTTP posts? Any kind of sniffer would just get encrypted SSL data...
Earlier quoted context omitted.
Edit: CANCEL MY KNEE-JERK REACTION TO A KNEE-JERK REACTION! A few tweets down (good [deity] twitter is a terrible way to transmit information, this is why I don't generally bother with it) she does say the full library is sent. -------------------- > copying and uploading the libraries is actually illegal (copyright violation) That isn't what is happening here - the headline is misleading. Further into the tweet (FFS…
Even further into the tweets it says: "Facebook can upload the entire files of all system libraries to their server through their Android apps" and "I found they have already collected metadata of 2233 system libraries from my phone, in which 1162 system libraries are pending to be uploaded" So they've already uploaded the metadata and are in process of uploading the whole files.
Earlier quoted context omitted.
It's almost infinitely easier to track a library update if you have the actual libraries on hand to compare, rather than two hashes.
But that presumes a human engineer is going through and looking at the libraries in order to maintain fingerprints. I suppose it's possible that's what Facebook is doing, but it strikes me as a massive waste of time, particularly in comparison to all of the other metrics at their disposal.
Edit: see for instance https://www.usenix.org/conference/usenixsecurity17/technical...
Earlier quoted context omitted.
How would uploading the library help with that?
It's almost infinitely easier to track a library update if you have the actual libraries on hand to compare, rather than two hashes.
Aside from fingerprinting, what other nefarious uses could this have in theory?
If you had some secret sauce library, e.g. developing some new revolutionary phone feature, it would now have been exfiltrated to facebook.