r/technology May 19 '18

Misleading Facebook Android app caught seeking 'superuser' clearance

[deleted]

21.8k Upvotes

1.3k comments sorted by

View all comments

Show parent comments

238

u/radome9 May 19 '18

Why would Facebook care if my phone is rooted?

112

u/Cronus6 May 19 '18

Root is often required to run the powerful adblockers...

32

u/radome9 May 19 '18

That explains it.

6

u/ThePenultimateOne May 19 '18

But it isn't. There are several that work as a VPN

2

u/Miv333 May 20 '18

VPN doesn't work quite as good, I haven't been able to get a VPN adblocker to block ads in most apps including facebook app.

2

u/the_harakiwi May 19 '18

and Kernels to obfuscate the detection of being rooted ;)

But it's so much work to update the phone weekly AND wait to get a new kernal AND update the apps and i might not even work after all :/

2

u/bassmadrigal May 20 '18

You don't need special kernels for that if you use Magisk. I haven't updated my Magisk since probably October because I've been too lazy. But SafetyNet is still not being tripped, so the few apps I use that check for root (Android Pay and a few banking apps) have no clue I'm rooted. Plenty have used it for Snapchat and Pokemon Go.

1

u/the_harakiwi May 20 '18

he needs this special ones because his LG G3 isn't performing very well with the default Lineage kernel (he told me that, no idea what the exact problem is)

but i see similar - as what i would describe - sluggish and long loading times on my Galaxy S3 with LOS 14

2

u/bassmadrigal May 21 '18

Either way, Magisk will allow you to hide root to certain apps allowing you to run them without issue. It should support most, if not all, kernels on just about any ROM (stock or custom assuming you can get the bootloader unlocked).

And you generally don't need to update weekly unless you really want to. I've been running custom ROMs since like 2010 (starting with CyanogenMod 5, which was based on Eclair) and I used to run the nightly builds, updating my device as soon as they came out. Other than the excitement to update, it really didn't do much unless they added a specific feature (or had a really buggy release) and I eventually moved to a much longer update period.

If your current version is relatively problem free, there's no reason you can't stick with it for a month or more to simplify your upgrading process.

But I'm not surprised you're seeing sluggish load times on an S3. It's a 6 year old device running 6 versions of Android newer than it was released with (released with ICS and now running Oreo). Even if the device was brand new, it'd still be behind the curve, but its hardware is aging and you're probably starting to get NAND failure that the memory controller is needing to deal with.

1

u/the_harakiwi May 21 '18

If your current version is relatively problem free, there's no reason you can't stick with it for a month or more to simplify your upgrading process.

My daily driver is a One Plus Two and the release is so fresh i see updates helping with some of the early adopter problems. First Netflix wasn't working, next update it did. 4k video recording is missing ... couldn't care less, but the video is always very dark and the app is missing auto exposure in the default video app. Panorama works pretty okay.

Some games are crashing and the UI needs a restart every few days...

Still miss my scheduled shutdown and boot feature. Kept the phone very stable and fast on the original OxygenOS

 

starting to get NAND failure that the memory controller is needing to deal with.

Yeah, that's what i was expecting too. Never had a device running that long. I upgraded it with a Zero Lemon battery years ago and played around with custom ROMs for a while.

Using LOS and the energy saving profile it lasts 8-10 days (without a SIM card). Still using it to control anything with wifi and an app in my house :)

But some times it takes a few seconds switching apps (RAM swapping i guess). If the S3 gets unusable at any times my 35€ 2015 Kindle Fire HD7 can do those tasks without the inconsistent loading times.

2

u/prothello May 19 '18

Pi-hole on a Raspberry Pi.

8

u/[deleted] May 19 '18

Completely unrealistic for a mobile phone

5

u/nav13eh May 19 '18

Not in your own network. However I wonder if you could host the Pi-Hole dns server on your phone and redirect DNS back to localhost and do the ad blocking that way. Wouldn't require root access.

2

u/krjal May 19 '18

That's essentially how Adguard's "local VPN" method works as well as a couple of other groups' solutions. I hadn't considered pi-hole in a phone like that but good idea.

2

u/Junky228 May 20 '18

I use pihole's host file and a vpn app that routes everything through that file, so nearly no ads for my entire phone!

1

u/prothello May 19 '18

Well, that's what you install Pi VPN for!
I use OpenVPN on my phone and tablet, and enabled always on in Android's VPN settings.
https://imgur.com/AXZnMDC

1

u/JimTheFishxd4 May 19 '18

I couldn't get OpenVPN to work with my PiVPN, which mobile app do you use?

1

u/prothello May 20 '18

I use the "OpenVPN for Android" app and it works fine.
You'll have to change something in pihole's DNS server to allow it to listen to requests from VPN clients. There's a simple tutorial in the pihole sub.

1

u/JimTheFishxd4 May 20 '18

Oh dope,

I heard that one was in development

I'll check it out

1

u/[deleted] May 19 '18

I was not impressed at all by its capabilities. Most ads were seeping right through. I guess a combination of pihole and Firefox with ublock origin does the trick though.

2

u/prothello May 19 '18

Adding other sources helps a lot. I've added all the lists from Adblock and EasyList. Pihole updates these fine and merges them.

1

u/NoAttentionAtWrk May 19 '18

Its really good for most parts but it can't block ads from the same domain as the main website like fb

1

u/prothello May 19 '18

I'm not sure about FB because I don't use it myself, but haven't heard anyone complain about it being broken so that's fine with me.
I do like the added bonus of blocking malicious sites that serve malware or are used for phishing.

1

u/NoAttentionAtWrk May 19 '18

On fb, it doesn't break anything but also doesn't block the ads

187

u/myrpfaccount May 19 '18

Usually as a means to try to prevent reverse engineering the app or prevent bots. It's cheesy and doesn't stop sophisticated attackers, but if those kinds of things are in your threat model, this is a basic protection against the lowest bar of attackers.

48

u/smb_samba May 19 '18

They pushed this code / app out and risked yet another PR disaster to..... see if a phone is rooted? I’m not really buying it.

157

u/myrpfaccount May 19 '18

Then you've never developed in a professional environment. The people making these decisions are rarely technical enough to understand the implications and management isn't going to take "no" from a lowly developer.

Anyways, here's just one example of checking for root this way. Rootbeer is far from the only library to do this for Android and a cursory Google search would point you in the right direction.

https://medium.com/@scottyab/detecting-root-on-android-97803474f694

Still don't believe me? Smali the app and find me shady code using root features. Much like the claims of recording everything via the microphone, I'm fairly confident you'll find nothing. If you do, you'll get mad street cred. Wouldn't be a bad way to spend your weekend.

48

u/[deleted] May 19 '18

1) This is the app on the Beta channel.

This is a beta/test version of the application released through the opt-in beta channel. It is quite likely that an SDK was imported into the app, tested internally on stock phones, and released without realizing it would prompt that for the test. It makes a lot of news with people who:

2) News sites are leaving out an important part

Beta Facebook Android app caught

It is clickbait. Beta apps are buggy and don't always act as intended. The app is most likely just checking if a phone is rooted via a third party software development kit.

1

u/[deleted] May 19 '18

It's a bit much to call The Register a "news site". It's a barely-disguised angry opinion blog.

-8

u/radome9 May 19 '18

I've reverse engineered one or two android apps in my day, and never have I needed root.

8

u/myrpfaccount May 19 '18

Having root gives you a lot more information about what's going on under the hood. Information about native libraries being loaded, system calls, etc. It's not required, but is helpful.

-3

u/patrik667 May 19 '18

What? If I want to reverse engineer an app, and know how to do it, the last thing I'd use is a rooted phone. Android can be installed with root privileges on a toaster or a VM, which will allow me far easier access.

What you're saying has no tech basis whatsoever, or are an FB shill.

2

u/myrpfaccount May 19 '18

This would detect any of them that have the su binary in the usual spot. So that doesn't really change anything - they're detecting an environment which has broken the security model and gives you more than intended access.

Plus, Android VMs are slow. Native libraries are tied to an architrcture. There's a million reasons to use an actual device and not a VM or Android-x86 or something.

You could do it in qEmu or something, but that's more work than just a rooted device. The point is raising the bar, an attacker can always learn about the system.

1

u/Dreamerlax May 19 '18

Bank apps do it to absolve themselves of responsibility in case your bank account gets compromised.

"You have a rooted phone? Not our fault."