{"id":6843,"date":"2024-03-29T07:55:04","date_gmt":"2024-03-29T14:55:04","guid":{"rendered":"https:\/\/jasonsblog.ddns.net\/?p=6843"},"modified":"2024-03-29T08:01:25","modified_gmt":"2024-03-29T15:01:25","slug":"facebook-snooped-on-users-snapchat-traffic-in-secret-project-documents-reveal","status":"publish","type":"post","link":"https:\/\/jasonsblog.ddns.net\/index.php\/2024\/03\/29\/facebook-snooped-on-users-snapchat-traffic-in-secret-project-documents-reveal\/","title":{"rendered":"Facebook Snooped on Users\u2019 Snapchat Traffic in Secret Project, Documents Reveal"},"content":{"rendered":"\n

This tells you everything you need to know about the morality and ethics of the people at Fakebook, so why does anyone use the service or install their smartphone application? And using a VPN to do a man in the middle attack to break the encryption of competitors is pretty bad behavior, and makes you wonder what kind of other violations are they conducting against users. Consequently, after reading The Facebook Effect: The Inside Story of the Company That Is Connecting the World<\/em> and the history of Schmuckerburg I was out on the operation. Also, Facebook has embedded trackers in a lot of webpages, so you might want to investigate disabling it with uMatrix which combines well with uBlock Origin<\/a> Ad blocker.<\/p>\n\n\n\n

https:\/\/techcrunch.com\/2024\/03\/26\/facebook-secret-project-snooped-snapchat-user-traffic\/<\/a><\/p>\n\n\n

<\/div><\/div><\/div>\n\n\n

By Lorenzo Franceschi-Bicchierai<\/p>\n\n\n\n

\"Mark<\/figure>\n\n\n\n

Image Credits: <\/strong>Alex Wong\/Getty Images<\/p>\n\n\n\n

In 2016, Facebook launched a secret project designed to intercept and decrypt the network traffic between people using Snapchat\u2019s app and its servers. The goal was to understand users\u2019 behavior and help Facebook compete with Snapchat, according to newly unsealed court documents. Facebook called this \u201cProject Ghostbusters,\u201d in a clear reference to Snapchat\u2019s ghost-like logo.<\/p>\n\n\n\n

On Tuesday, a federal court in California released new documents discovered as part of the class action lawsuit between consumers and Meta, Facebook\u2019s parent company.<\/p>\n\n\n\n

The newly released documents reveal how Meta tried to gain a competitive advantage over its competitors, including Snapchat and later Amazon and YouTube, by analyzing the network traffic of how its users were interacting with Meta\u2019s competitors. Given these apps\u2019 use of encryption, Facebook needed to develop special technology to get around it.<\/p>\n\n\n\n

One of the documents<\/a> details Facebook\u2019s Project Ghostbusters. The project was part of the company\u2019s In-App Action Panel (IAPP) program, which used a technique for \u201cintercepting and decrypting\u201d encrypted app traffic from users of Snapchat, and later from users of YouTube and Amazon, the consumers\u2019 lawyers wrote in the document.<\/p>\n\n\n\n

The document includes internal Facebook emails discussing the project.<\/p>\n\n\n\n

\u201cWhenever someone asks a question about Snapchat, the answer is usually that because their traffic is encrypted we have no analytics about them,\u201d Meta chief executive Mark Zuckerberg wrote in an email dated June 9, 2016, which was published as part of the lawsuit. \u201cGiven how quickly they\u2019re growing, it seems important to figure out a new way to get reliable analytics about them. Perhaps we need to do panels or write custom software. You should figure out how to do this.\u201d<\/p>\n\n\n\n

Facebook\u2019s engineers solution was to use Onavo<\/a>, a VPN-like service that Facebook acquired in 2013. In 2019, Facebook shut down Onavo<\/a> after a TechCrunch investigation revealed that Facebook had been secretly paying teenagers to use Onavo<\/a> so the company could access all of their web activity.<\/p>\n\n\n\n

After Zuckerberg\u2019s email, the Onavo team took on the project and a month later proposed a solution: so-called kits that can be installed on iOS and Android that intercept traffic for specific subdomains, \u201callowing us to read what would otherwise be encrypted traffic so we can measure in-app usage,\u201d read an email from July 2016. \u201cThis is a \u2018man-in-the-middle\u2019 approach.\u201d<\/p>\n\n\n\n

A man-in-the-middle attack \u2014 nowadays also called adversary-in-the-middle \u2014 is an attack where hackers intercept internet traffic flowing from one device to another over a network. When the network traffic is unencrypted, this type of attack allows the hackers to read the data inside, such as usernames, passwords, and other in-app activity.<\/p>\n\n\n\n

Given that Snapchat encrypted the traffic between the app and its servers, this network analysis technique was not going to be effective. This is why Facebook engineers proposed using Onavo, which when activated had the advantage of reading all of the device\u2019s network traffic before it got encrypted and sent over the internet.<\/p>\n\n\n\n

\u201cWe now have the capability to measure detailed in-app activity\u201d from \u201cparsing snapchat [sic] analytics collected from incentivized participants in Onavo\u2019s research program,\u201d read another email.<\/p>\n\n\n\n

Later, according to the court documents, Facebook expanded the program to Amazon and YouTube.<\/p>\n\n\n\n

Inside Facebook, there wasn\u2019t a consensus on whether Project Ghostbusters was a good idea. Some employees, including Jay Parikh, Facebook\u2019s then-head of infrastructure engineering, and Pedro Canahuati, the then-head of security engineering, expressed their concern.<\/p>\n\n\n\n

\u201cI can\u2019t think of a good argument for why this is okay. No security person is ever comfortable with this, no matter what consent we get from the general public. The general public just doesn\u2019t know how this stuff works,\u201d Canahuati wrote in an email, included in the court documents.<\/p>\n\n\n\n

In 2020, Sarah Grabert and Maximilian Klein filed a class action lawsuit against Facebook<\/a>, claiming that the company lied about its data collection activities and exploited the data it \u201cdeceptively extracted\u201d from users to identify competitors and then unfairly fight against these new companies.<\/p>\n\n\n\n

An Amazon spokesperson declined to comment.<\/p>\n\n\n\n

Google, Meta, and Snap did not respond to requests for comment.<\/p>\n","protected":false},"excerpt":{"rendered":"

This tells you everything you need to know about the morality and ethics of the people at Fakebook, so why does anyone use the service or install their smartphone application? And using a VPN to do a man in the middle attack to break the encryption of competitors is pretty bad behavior, and makes you […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-6843","post","type-post","status-publish","format-standard","hentry","category-tech"],"blocksy_meta":[],"featured_image_src":null,"author_info":{"display_name":"Jason","author_link":"https:\/\/jasonsblog.ddns.net\/index.php\/author\/jturning\/"},"_links":{"self":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/6843","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/comments?post=6843"}],"version-history":[{"count":5,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/6843\/revisions"}],"predecessor-version":[{"id":6848,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/6843\/revisions\/6848"}],"wp:attachment":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/media?parent=6843"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/categories?post=6843"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/tags?post=6843"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}