Facebook on Wednesday announced it’s open-sourcing Mariana
Trench[1], an Android-focused
static analysis platform the company uses to detect and prevent
security and privacy bugs in applications created for the mobile
operating system at scale.
“[Mariana Trench] is designed to be able to scan large mobile
codebases and flag potential issues on pull requests[2]
before they make it into production,” the Menlo Park-based social
tech behemoth said[3].
In a nutshell, the utility allows developers to frame rules for
different data flows to scan the codebase for in order to unearth
potential issues — say, intent[4]
redirection[5]
flaws[6]
that could result in the leak of sensitive data or injection
vulnerabilities that would allow adversaries to insert arbitrary
code — explicitly setting boundaries as to where user-supplied data
entering the app is allowed to come from (source) and flow into
(sink) such as a database, file, web view, or a log.
Data flows found violating the rules are then surfaced back
either to a security engineer or the software engineer who made the
pull request containing the changes.
The social media giant said over 50% of vulnerabilities detected
across its family of apps, including Facebook, Instagram, and
WhatsApp, were found using automated tools. Mariana Trench also
marks the third such service the company has open-sourced after
Zoncolan[7]
and Pysa[8], each of which target
Hack[9] and Python programming
languages, respectively.
The development also follows similar moves from Microsoft-owned
GitHub, which acquired Semmle[10] and launched a Security Lab[11] in 2019 with an aim to
secure open-source software, in addition to making semantic code
analysis tools such as CodeQL freely available to spot
vulnerabilities in publicly available code.
“There are differences in patching and ensuring the adoption of
code updates between mobile and web applications, so they require
different approaches,” the company said.
“While server-side code can be updated almost instantaneously
for web apps, mitigating a security bug in an Android application
relies on each user updating the application on the device they own
in a timely way. This makes it that much more important for any app
developer to put systems in place to help prevent vulnerabilities
from making it into mobile releases, whenever possible.”
Mariana Trench can be accessed here[12] via GitHub, and
Facebook has also released a Python
package[13] on the PyPi
repository.
References
- ^
Mariana Trench
(mariana-tren.ch) - ^
pull
requests (docs.github.com) - ^
said
(engineering.fb.com) - ^
intent
(blog.oversecured.com) - ^
redirection
(support.google.com) - ^
flaws (snyk.io) - ^
Zoncolan
(engineering.fb.com) - ^
Pysa
(engineering.fb.com) - ^
Hack
(hacklang.org) - ^
Semmle
(thenextweb.com) - ^
Security Lab
(thenextweb.com) - ^
here
(github.com) - ^
Python
package (pypi.org)