Mariana Trench - Latest Facebook Tool Finds Security and Privacy Bugs in Android Apps
Reading Time: 2 minutes

Mariana Trench, the latest Facebook tool, finds security and privacy bugs in Android Apps. It is an open-source Android-focused static analysis platform that detects and prevents security and privacy bugs in applications created for the mobile operating system at scale.

Menlo Park-based social tech giant said, “[Mariana Trench] is designed to be able to scan large mobile codebases and flag potential issues on pull requests before they make it into production. “

The developers will be able to frame rules for different data flows to scan the codebase in order to unearth potential issues, such as intent redirection flaws that could result in the leak of sensitive data or injection vulnerabilities that would allow adversaries to insert arbitrary code. Explicitly setting boundaries as to where user-supplied data entering the app is allowed to come from (source) and flow into (sink) such as methods that can execute code and retrieve or interact with user data.

The utility finds the data flows violating the rules and surfaced back to either a security engineer or the software engineer who made the pull request containing the changes.

According to Facebook, over 50% of vulnerabilities detected across its family of apps, including Facebook, Instagram, and WhatsApp, were found using automated tools. The latest Facebook tool also marks the third such service the company has open-sourced after Zoncolan and Pysa. They target Hack and Python programming languages, respectively.

Earlier Microsoft owned GitHub, acquired Semmle, and launched a Security Lab in 2019 with an aim to secure open-source software. Also developed tools such as CodeQL for making semantic code analysis, available freely to spot vulnerabilities in publicly available code.

Facebook said, “There are differences in patching and ensuring the adoption of code updates between mobile and web applications, so they require different approaches.”

Further added, “While server-side code can be updated almost instantaneously for web apps, mitigating a security bug in an Android application relies on each user updating the application on the device they own in a timely way. This makes it that much more important for any app developer to put systems in place to help prevent vulnerabilities from making it into mobile releases, whenever possible.”

You can access Mariana Trench here via GitHub, and Facebook has also released a Python package on the PyPi repository.

Related Articles:

CNN Blocks Australians From Accessing its Facebook pages
Can You Hack A Facebook Account?
Facebook and RayBan Smart Glasses Leaked Ahead of the Release