Softpedia >News >Security
Softpedia Homepage   

Facebook App Uploads System Libraries Without Permission, Researcher Finds

Only the Android version of the apps seems to do this

Aug 30, 2019 19:35 GMT  ·  By
Facebook caught in the act
   Facebook caught in the act

The Facebook Android application is using something called the "Global Library Collector" to gather information about the user’s system libraries and uploads them to Facebook servers.

Facebook is not exactly the model corporation, as we’ve seen in the past with the Facebook Research VPN which collected all the information from a user’s phone. The company was rewarding people willing to install it financially.

On the other hand, the Facebook app didn’t stand up in any particular way, with the exception of a few releases that were draining the battery. It turns out that the Facebook app might be doing some things that could be considered unethical.

Facebook wants your libraries

Jane Manchun Wong, an app researcher from Hong-Kong, discovered that her Facebook Android app was scanning the phone, indexing system libraries and uploading them to some Facebook server, somewhere.

“Facebook scans system libraries from their Android app user’s phone in the background and uploads them to their server This is called Global Library Collector at Facebook, known as GLC in app’s code It periodically uploads metadata of system libraries to the server. There doesn’t seem to be an opt-out option for Facebook Global Library Collector, nor does it not seem to be possible to view what they have uploaded from our devices Not sure what’s the purpose of GLC, but I guess it can be used for determining system integrity, compatibility” wrote Jane.

To make matters a worse, the Facebook app knows to compress each file before uploading it, which would make sense if you want to keep the traffic down to a minimum. But it also seems that the files are going to a collection that’s specific to the user.

It’s unclear what the purpose of this data collection, what is Facebook doing with the data, and if the uploads are covered by the user agreement. It’s very likely that it’s some sort of security measure, but unless the company actually clears this matter, it remains in a very grey area.