Grabbing rootkit artifacts that could be on the device?
Its just that its not Facebooks place to do this. I wouldn't expect a app linux binary to upload the contents of /usr/lib, or a windows app to start sending system32 dll's off system.
FB can try to sell this as a 'lite-AntiVirus' type service, but that is not its place. There is no indication the app is doing this. Its FB being creepy as usual.
If Google did it, it would be less creepy, just like how Microsoft can grab malicious files detected by Defender -- but they write, support and protect the OS! FB is just an app. It shouldn't be harvesting its users operating system files!
Google already does what people are spewing apologetics about as justification for Facebook's behaviour, but they do it the right way.
Google's SafetyNet scans the system files, but it looks for _specific_ files that should not be there and ensures that certain files that must remain unaltered actually remained unaltered to ensure that the security model is still intact, so it doesn't need to violate copyright laws by stealing copies of files off the user's phone without permission or user awareness.
...and funny that you mention Windows Defender because it repeatedly advises the user that it might upload files to Microsoft and asks for their approval for doing so at multiple points. Microsoft is being perfectly transparent about what they're doing and giving users the ability to opt-out. They're also the people who make the entire operating system so they've got an obligation to try real hard to prevent another Blaster incident. Facebook just makes a social media app.
This is the biggest one for me. Anyone who has that data is capable of playing back the 0-days that affect android. How many android phones are kept out of date?
As other user mentioned, the Android ecosystem is like the Wild West. Given there's a report for 2.5B active devices, how many can be affected by such an attack?
1% would affect 25M devices, around the population of Australia.
10% - 250 million devices.
40% - 1 billion devices...
Perhaps their motivation is to launch a campaign saying "Facebook keeps you safe!" by scanning your phone, and use it to justify people signing up for more surveillance. Perhaps this is a stealth beta test.
That’s one misconception (or misnomer) about Facebook and Google. They don’t “sell or give away your data”. They sell access to you based on your data. The distinction is important if we want to pass laws limiting what they can do with your data. If there was a law passed saying they couldn’t “share your data” they would just shrug.
