Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook scans system libraries on Android and uploads them to their server

twitter.com

Post reply on HN
Print view View original

181–188 of 188 posts

Re: Facebook scans system libraries on Android and uploads them to their server

#181

Post by evilDagmar »

wrs wrote: post #31
ErikAugust wrote: post #8

Earlier quoted context omitted.

It doesn't just send a list of libraries, it actually uploads the libraries [1]. You seriously think that's a good use of bandwidth? [1] https://twitter.com/wongmjane/status/1167463077748436993?s=2...

Given the Wild West nature of Android, there may be no other possible way to get that version of that system library to debug something.

You don't need "that version of the system library" to debug anything. If you write decent code that adheres to the published APIs, it works or it's Android's fault. Should it be Android's fault and you deploy a workaround, there's a pretty good chance your workaround will start breaking the moment Android fixes their bug. But this has nothing to do with that.

Let's face it. This is the freakin' Facebook app. It's not doing anything so incredibly revolutionary in the field of computing that requires it to be intimately involved in system libraries. It needs to display cat pictures and take in and emit text and make HTTP and HTTPs calls over the network, oh and monitor the user's every move, even while they sleep.

Re: Facebook scans system libraries on Android and uploads them to their server

#182

Post by evilDagmar »

w3rhn2j34oh5o wrote: post #26
fareesh wrote: post #24

Aside from fingerprinting, what other nefarious uses could this have in theory?

Grabbing rootkit artifacts that could be on the device? Its just that its not Facebooks place to do this. I wouldn't expect a app linux binary to upload the contents of /usr/lib, or a windows app to start sending system32 dll's off system. FB can try to sell this as a 'lite-AntiVirus' type service, but that is not its place. There is no indication the app is doing this. Its FB being creepy as usual. If Google did it,…

Google already does what people are spewing apologetics about as justification for Facebook's behaviour, but they do it the right way.

Google's SafetyNet scans the system files, but it looks for _specific_ files that should not be there and ensures that certain files that must remain unaltered actually remained unaltered to ensure that the security model is still intact, so it doesn't need to violate copyright laws by stealing copies of files off the user's phone without permission or user awareness.

...and funny that you mention Windows Defender because it repeatedly advises the user that it might upload files to Microsoft and asks for their approval for doing so at multiple points. Microsoft is being perfectly transparent about what they're doing and giving users the ability to opt-out. They're also the people who make the entire operating system so they've got an obligation to try real hard to prevent another Blaster incident. Facebook just makes a social media app.

Re: Facebook scans system libraries on Android and uploads them to their server

#183

Post by evilDagmar »

anticensor wrote: post #112
rolph wrote: post #59

Earlier quoted context omitted.

im thinking about how we get to non traditional sandboxing

Fully homomorphic public key encryption is the solution. We need such a crypto that hides the instructions and operands but does not alter the visible arity of instructions, and allow arithmetic operations on operands.

Kiss your battery life goodbye then, because HE requires a massive amount of CPU power. So much that it's outright prohibitive for use on a cell phone for at least the next 5-6 years, minimum (Moore's Law)

Re: Facebook scans system libraries on Android and uploads them to their server

#184

Post by fareesh »

scarface74 wrote: post #175
fareesh wrote: post #174

Earlier quoted context omitted.

I meant if they gave away all of this data about your device then someone on a different app could identify you by comparing.

That’s one misconception (or misnomer) about Facebook and Google. They don’t “sell or give away your data”. They sell access to you based on your data. The distinction is important if we want to pass laws limiting what they can do with your data. If there was a law passed saying they couldn’t “share your data” they would just shrug.

Correct which is why I said "in theory"

Re: Facebook scans system libraries on Android and uploads them to their server

#185

Post by gnfurlong »

djsumdog wrote: post #16
mirimir wrote: post #10

How the bloody hell is it permitted for apps to be uploading system files? This wouldn't be possible in Linux, right? Basically, this is malware. Edit: Thanks, all. So OK, I get that it's possible, because apps have read and execute permissions for all libraries that they use. But it's not common for apps to upload system files, right?

Well Android does have a Linux kernel. The permissions happen at different layers within Android, as apps are run on their VM (Dalvik byte code). The /system partition is read-only on Android, but I don't /think/ you'd need any special permissions to read most of the system partition. The data partition is what's protected. I mean, an application has to be able to read standard libraries to function, right? Same with…

Regarding apparmor/selinux, who creates/audits those profiles to make sure each application only has access to exactly the libraries it needs? It probably defeats the purpose if it's the app authors. Similarly, who validates that these profiles don't break functionality for any device/os version? I could see this being an option for power users who are willing to collaborate on creating the profiles and deal with fixing the occasional incomplete profile. I'm not sure how feasible it'd be as a solution for your typical user though.

Re: Facebook scans system libraries on Android and uploads them to their server

#186

Post by tripzilch »

prongletown wrote: post #11
mirimir wrote: post #10

How the bloody hell is it permitted for apps to be uploading system files? This wouldn't be possible in Linux, right? Basically, this is malware. Edit: Thanks, all. So OK, I get that it's possible, because apps have read and execute permissions for all libraries that they use. But it's not common for apps to upload system files, right?

>This wouldn't be possible in Linux, right? If you have read access, then yes. Conventional desktop and server linux distributions would allow this behavior. As does android. Good luck using dylibs without it, anyways. Since the android market is so fragmented and customized, this probably saves them from having to buy lots of phones when diagnosing crashes. The knee-jerk reaction is to feel uncomfortable but these a…

> This saves FB the trouble of spending $200 every time a new OS update comes out.

So it is piracy.

Re: Facebook scans system libraries on Android and uploads them to their server

#187

Post by Splognosticus »

javagram wrote: post #135
Splognosticus wrote: post #97

Earlier quoted context omitted.

I seem to remember a case where files were being uploaded to a server where they were only retained in memory and that qualified as a copyright violation, but I'm having trouble actually finding it.

There’s a good discussion of the legality of RAM copies here http://digital-law-online.info/lpdi1.0/treatise20.html Note that there is an exception for such a copy when it’s necessary to run the program, I believe this exemption was added because otherwise running an executable on a personal computer would have been a copyright violation. https://www.copyright.gov/title17/92chap1.html > a) Making of Additional Copy o…

That must be what I was thinking of, thanks!

Re: Facebook scans system libraries on Android and uploads them to their server

#188

Post by bound008 »

godelski wrote: post #138
bound008 wrote: post #129

Earlier quoted context omitted.

Which episode? I can’t manage to find it.

I'm sorry I can't find it either. Maybe it was a different podcast. I'm trying to think of other podcasts. I don't think it was RadioLab. Could have been another NPR show but I can't think which one would address this issue. HB seems like the best fit. I can bound the date of when I listened to it. Was definitely between 2018 and 2015. My intuition says 2017, because that was the height of my podcast listening. The t…

Thanks for the reply!
Post reply on HN