Facebook Releases New Tool That Finds Security and Privacy Bugs in Android Apps

Facebook on Wednesday announced it's open-sourcing Mariana Trench, an Android-focused static analysis platform the company uses to detect and prevent security and privacy bugs in applications created for the mobile operating system at scale.

"[Mariana Trench] is designed to be able to scan large mobile codebases and flag potential issues on pull requests before they make it into production," the Menlo Park-based social tech behemoth said.

In a nutshell, the utility allows developers to frame rules for different data flows to scan the codebase for in order to unearth potential issues — say, intent redirection flaws that could result in the leak of sensitive data or injection vulnerabilities that would allow adversaries to insert arbitrary code — explicitly setting boundaries as to where user-supplied data entering the app is allowed to come from (source) and flow into (sink) such as a database, file, web view, or a log.

Data flows found violating the rules are then surfaced back either to a security engineer or the software engineer who made the pull request containing the changes.

The social media giant said over 50% of vulnerabilities detected across its family of apps, including Facebook, Instagram, and WhatsApp, were found using automated tools. Mariana Trench also marks the third such service the company has open-sourced after Zoncolan and Pysa, each of which target Hack and Python programming languages, respectively.

The development also follows similar moves from Microsoft-owned GitHub, which acquired Semmle and launched a Security Lab in 2019 with an aim to secure open-source software, in addition to making semantic code analysis tools such as CodeQL freely available to spot vulnerabilities in publicly available code.

"There are differences in patching and ensuring the adoption of code updates between mobile and web applications, so they require different approaches," the company said.

"While server-side code can be updated almost instantaneously for web apps, mitigating a security bug in an Android application relies on each user updating the application on the device they own in a timely way. This makes it that much more important for any app developer to put systems in place to help prevent vulnerabilities from making it into mobile releases, whenever possible."

Mariana Trench can be accessed here via GitHub, and Facebook has also released a Python package on the PyPi repository.

Found this article interesting? Follow THN on Facebook, Twitter  and LinkedIn to read more exclusive content we post.