Mariana Trench, the latest Facebook tool, finds security and privacy bugs in Android Apps. It is an open-source Android-focused static analysis platform that detects and prevents security and privacy bugs in applications created for the mobile operating system at scale.
The developers will be able to frame rules for different data flows to scan the codebase in order to unearth potential issues, such as intent redirection flaws that could result in the leak of sensitive data or injection vulnerabilities that would allow adversaries to insert arbitrary code. Explicitly setting boundaries as to where user-supplied data entering the app is allowed to come from (source) and flow into (sink) such as methods that can execute code and retrieve or interact with user data.
The utility finds the data flows violating the rules and surfaced back to either a security engineer or the software engineer who made the pull request containing the changes.
According to Facebook, over 50% of vulnerabilities detected across its family of apps, including Facebook, Instagram, and WhatsApp, were found using automated tools. The latest Facebook tool also marks the third such service the company has open-sourced after Zoncolan and Pysa. They target Hack and Python programming languages, respectively.
Earlier Microsoft owned GitHub, acquired Semmle, and launched a Security Lab in 2019 with an aim to secure open-source software. Also developed tools such as CodeQL for making semantic code analysis, available freely to spot vulnerabilities in publicly available code.
Facebook said, “There are differences in patching and ensuring the adoption of code updates between mobile and web applications, so they require different approaches.”
Further added, “While server-side code can be updated almost instantaneously for web apps, mitigating a security bug in an Android application relies on each user updating the application on the device they own in a timely way. This makes it that much more important for any app developer to put systems in place to help prevent vulnerabilities from making it into mobile releases, whenever possible.”