Facebook's Most Dangerous App
fern
0:01 It's 2018.
0:03 You're on Facebook.
0:04 You open the menu, scroll down, and spot this little protect button.
0:07 [music] Sounds like a good idea.
0:09 You tap it.
0:10 Millions of others do, too.
0:12 You're prompted to install something called Onavo Protect,
0:15 a free VPN that protects your privacy, allegedly.
0:20 If only you knew.
0:22 I'm proud that we've given people who've never
0:24 had a voice before the opportunity to be heard.
0:28 Facebook accused of spying.
0:30 A VPN app called Onavo.
0:32 His VPN spied on almost everything users did and sent detailed data to Facebook.
0:37 Potentially a giant wire tab.
0:39 It gets into the root access of your phone.
0:41 Any websites you went to, any apps you used, things along those lines.
0:44 Everything you did on your phone was open to Facebook.
0:46 And so far, there have been almost no legal consequences.
0:49 We're heading into a no privacy future.
0:52 We're already there, aren't we?
0:52 I mean, but this story is even bigger than Onavo.
0:56 It's a story about betrayal of trust, surveillance of minors,
1:00 and corporate espionage, all in the race for market dominance.
1:04 This is the Facebook scandal you've probably never heard of.
1:11 Confirmed.
1:11 Though VPN providers sometimes sponsor our videos,
1:14 they aren't involved in the production of this video in any way.
1:17 They didn't finance this story or suggest this coverage.
1:25 Double rainbow.
1:26 Oh my god.
1:27 When it comes to the internet,
1:28 a lot of people remember the last decade as a simpler time.
1:32 Those were the years of the Harlem Shake,
1:34 the Ice Bucket Challenge, that one celebrity selfie.
1:39 Compared to today, it all seems so wholesome.
1:42 Back in the 2010s, many people still believed something that seems
1:45 impossible today that Facebook of all companies could be trusted.
1:50 So when their users saw a friendly seeming protect button,
1:53 by 2018 millions of them had tapped in.
2:03 For many years, Mark Zuckerberg has been open about
2:05 his goal of making Facebook [music] the ultimate platform for connection.
2:09 By 2013, that's going well.
2:11 Facebook is bigger than ever and the most popular social network.
2:15 In 2012, they cracked a billion users and they
2:18 pulled off the largest tech IPO in US history,
2:20 raising $16 billion in a single day.
2:23 But users in the US are losing interest, especially younger ones.
2:27 They're usually the first to flock to newer apps.
2:30 Zuckerberg is under increasing pressure.
2:32 You really can't risk losing these users to other social media companies.
2:36 So, his strategy becomes,
2:37 as it would later be described, copy, acquire, and kill.
2:43 In 2012, he made Instagram an offer they couldn't refuse.
2:48 Americans share photos on Instagram,
2:50 a company with only 13 employees bought today by Facebook for $1 billion.
2:55 The acquisition was ridiculed at the time.
2:58 A billion dollars for a cute photo app that doesn't turn a profit.
3:01 Investment bankers were puzzled.
3:03 It was a risky move right before Facebook's IPO,
3:06 but the move will end up paying off massively.
3:09 Instagram will deliver billions of users
3:11 and billions of dollars in yearly ad revenue.
3:14 Just 6 years after the acquisition,
3:16 Instagram's estimated worth will be a hundred times what Facebook paid.
3:21 For a while now, Zuckerberg is at another target in sight, Snapchat.
3:27 The app was launched in the fall of 2011
3:29 by Stanford friends Evan Spiegel and Robert Murphy.
3:32 Spiegel is the CEO, Murphy the developer.
3:35 Snapchat is yet another photo sharing app, but with one key difference.
3:39 The images shared disappear after just a few
3:42 seconds and can't be screenshotted without the sender knowing.
3:45 Snapchat's appeal is in its impermanence.
3:48 And unlike on Instagram, the photos aren't meant to be perfect.
3:50 They can be awkward, funny, and messy.
3:53 [music] Teenagers love it, and Zuckerberg wants in.
3:56 At the end of 2012, he invited Spiegel for a chat.
3:59 At the time, Facebook was building a competing app called Poke.
4:02 It launched in December 2012 and failed badly.
4:06 People briefed on the matter told the Wall Street Journal
4:08 Zuckerberg then offered to buy Snapchat for a billion dollars.
4:11 Now in late 2013, he comes back with a new offer,
4:15 $6 billion for the app, six times what he offered Instagram,
4:19 a huge sum for an app that's only been around for 2
4:21 years and isn't profitable with no guarantees that it ever will be.
4:25 Spiegel and Murphy mull it over but eventually declined the offer.
4:28 Spiegel will later say he didn't want
4:30 to make the same mistake that Instagram did.
4:32 Our view was that Instagram had been wildly undervalued in that um
4:37 acquisition ultimately had given up like a massive massive opportunity.
4:42 Fine then time for a new approach.
4:47 You know we cover a lot of tech stories in this channel.
4:49 Almost all of these stories feature code
4:51 and recently you might have heard of vibe coding.
4:54 You're always going to be ahead if you actually
4:56 understand how things are built and how systems work.
5:00 Kotti is the platform to get into coding.
5:02 Whether you're a beginner or an aspiring dev,
5:04 Kotti offers bite-sized, gamified lessons.
5:07 Instead of overwhelming you with theory,
5:09 it creates a personalized learning path right from the start.
5:12 When you sign up, you get a journey tailored
5:14 to your goals based on just a few quick questions.
5:17 Then you learn by doing.
5:18 There are short challenges, real code, and instant feedback if you get stuck.
5:22 [music] It's kind of like a certain language learning app, but for programming.
5:26 There's even a streak system to keep [music] you consistent.
5:29 And it's free to use with the daily limit.
5:31 Start learning with Kotty Techch now.
5:33 Check out the link in the description or scan this QR code.
5:35 Use code Fern 20 for 20% off.
5:39 In 2013, Facebook acquired an Israeli startup called Onavo.
5:44 Zuckerberg's company reportedly spent around hund00 million on it.
5:48 Back then, mobile data was expensive, [music] especially in the US.
5:52 Ono was known for two products that saved
5:54 consumers money by helping them stretch their data plans.
5:57 Ono Extend could compress emails, photos, and app data.
6:00 Ono count allowed users to see how
6:02 much mobile data different apps were consuming.
6:05 Both required users to send their data to Anavo servers.
6:08 And a few months before getting bought,
6:10 they had launched their [music] latest product, a VPN called the Novel Protect.
6:14 But Facebook was probably interested in the startup
6:17 for more than just data compression or traffic rerouting.
6:20 Originally, Facebook made money by tracking user behavior on their site.
6:24 They did this with so-called cookies.
6:26 Cookies are small files that websites store in your device to remember login,
6:29 preferences, and activities.
6:31 This data can then be used to sell hyperargeted ads.
6:33 But smartphones changed the game.
6:35 People started using apps instead of browsers.
6:38 And apps often store data internally.
6:40 They track behavior through appsp specific systems,
6:42 making traditional browser cookies less useful.
6:45 Facebook was lagging behind in the shift to smartphones.
6:48 It was struggling to monetize mobile usage, [music] so it needed insights.
6:52 At the time, it was hard to know how well apps were performing.
6:55 You could see how many people downloaded them,
6:57 but that didn't say much about how often or how exactly they were used.
7:00 When Navo saw an opportunity to fill this knowledge gap,
7:03 thanks to the traffic that was routed to Extend and Count,
7:06 the company was sitting on a treasure trove of engagement data.
7:10 By acquiring the company,
7:11 Facebook suddenly had a secret window into their competitors,
7:14 and one app immediately stood out.
7:17 Ono [music] data showed that 99% of Android
7:19 users in Spain had WhatsApp installed on their phones.
7:23 In the US, far more mobile messages
7:25 were being sent through WhatsApp than through Facebook.
7:27 WhatsApp was powerful competition, yet it also promised incredible growth.
7:32 This is likely one of the reasons Zuckerberg decided to pay $19 billion for it.
7:36 Facebook is making a major move into mobile this morning.
7:39 The social media behemoth is buying the messaging company WhatsApp.
7:43 WhatsApp was uh also both a competitor and complimentary.
7:46 It's a messaging app that is incredibly popular.
7:49 They send billions of messages a day.
7:52 Zuckerberg made no apology for what he considers a very good deal.
7:56 Facebook also used to gain insights into Snapchat, their arch nemesis.
8:00 And there was so much they wanted to know.
8:02 Perhaps most importantly, which features people actually used.
8:06 But there was a problem.
8:07 All the traffic sent through Anavo's
8:08 apps was increasingly hidden behind encryption.
8:14 A year before the acquisition,
8:16 Snowden revealed that the NSA was spying on the world.
8:19 Concerns about online surveillance entered the mainstream,
8:22 and suddenly everyone wanted more protection.
8:24 As the decade marched on, the internet moved toward increased security,
8:28 including Facebook's main competitors.
8:31 Enter the rise of HTTPS.
8:34 When you visit bank ofofamea.com,
8:36 your browser doesn't just take the website's word for it.
8:40 It verifies that you're actually connecting to the site you intended to visit.
8:44 It does so by requesting the website's security certificate, its digital ID.
8:49 This contains information such as domain ownership,
8:52 the issuing authority, and its validity period.
8:55 Once a certificate is issued, the site keeps it for a set period of time.
8:59 To verify these certificates, your browser relies on digital judges,
9:03 the so-called certificate authorities or CAS.
9:06 They issue digital IDs and verify that websites are really who they claim to be.
9:10 Every time you visit, your browser checks whether it's still valid.
9:14 See this little icon in your address bar?
9:17 It means your browser has checked the website certificate against its
9:20 trusted list and confirmed that it links back to a trusted authority.
9:24 Everything is legitimate.
9:26 Then they agree on a temporary secret key for your session.
9:30 From now on, only you and the site can read the traffic.
9:33 Your communication is encrypted.
9:35 Any data you type into bank of america.com travels safely to their server.
9:40 Eavesdroppers can't read it.
9:42 On your phone, things work similarly.
9:44 Tucked deep inside your phone is a highsecurity vault called a trust store.
9:49 It's maintained by the company that makes the operating system.
9:52 Think Apple, Google, or Microsoft.
9:55 [music]
9:54 By default, your phone trusts a built-in list of so-called root certificates,
9:58 but users or companies can sometimes add their own trusted certificates.
10:03 Some apps trust only specific pre-approved certificates.
10:06 This is called certificate pinning.
10:09 Even if a new certificate is added to your phone's trusted list,
10:12 the app won't accept it.
10:14 Like many others, Snapchat started using HTTPS.
10:18 However, they didn't use certificate pinning for their analytics domain.
10:22 This was Facebook's way in.
10:25 In June 2016, Zuckerberg sent an email to three senior executives
10:29 demanding that they figure out how to get around Snapchat's encryption.
10:33 Whenever someone asks a question about Snapchat,
10:35 the answer is usually that because their traffic is encrypted,
10:38 we have no analytics about them.
10:40 Given how quickly they're growing,
10:41 it seems important to figure out a new way to get analytics about them.
10:45 This effectively kicks off Project Ghostbusters.
10:49 A few weeks after the email, the Onavo team comes up with a solution.
11:00 Say you're at a library.
11:02 You see free Wi-Fi.
11:03 And since it's 2016 and your data plan is tiny, you connect.
11:08 Just down the aisle sits a man in a hoodie named Elliot.
11:11 He's about to hack you.
11:13 He might be running a device from his backpack
11:15 that pretends to be the library Wi-Fi,
11:17 or he's just quietly monitoring the network looking for traffic.
11:21 Either way, he can read the unencrypted info you send over
11:24 the network and steal things like login credentials or credit card data.
11:29 Elliot is a so-called man-in-the-middle.
11:32 Because these man-in-the-middle attacks are really scary and easy to pull off,
11:36 more and more people start using VPNs.
11:39 They create a secure tunnel between the user's device and the VPN server.
11:43 Along the way, all the data that passes through it is encrypted.
11:47 From now on, it's harder for hackers to intercept or read your traffic.
11:51 A VPN also hides your IP address by routing
11:54 all your internet requests through its own servers.
11:57 On the surface, Onavo Protect seems like a great option.
12:00 It's free, [music] it protects you,
12:02 and it offers some data compression features.
12:05 Plus, Facebook itself is promoting it,
12:07 [music] and tech experts are singing its praises.
12:10 But a novel protect is doing something very sneaky.
12:14 The following is based on an analysis
12:16 by an Australian hacker who publishes under the alias Hacksro.
12:20 We cannot independently verify the results.
12:22 It all starts with a nudge.
12:24 When you install the app on Android, it says,
12:26 "Your privacy is a top priority." Then a novel reportedly
12:30 prompts you to install a trusted root certificate on your device.
12:34 Once permission is granted, the root certificate is installed.
12:38 It will then be trusted by many applications on your phone.
12:41 Now, whenever your Snapchat app wants
12:43 to send some analytics data to their server,
12:45 Onavo forces that traffic to its server first because it's a VPN.
12:50 [music] HR reports that a service called Squid
12:53 places itself between the app and Snapchat's analytics server.
12:57 It presents a certificate to your phone.
12:59 Yo, I'm totally legit.
13:01 Your phone accepts [music] it because of the judge powers Facebook gave itself.
13:05 Yeah.
13:05 Yeah.
13:06 This is totally legit.
13:08 Normally only Snapchat would be able to decrypt this data.
13:11 [music] But because Anavo installed its own trusted certificate,
13:14 it can unlock the traffic first.
13:16 Now all these Snapchat analytics from your phone
13:18 get decrypted and land on Anavo servers.
13:21 Detailed inapp activity ripe for the taking.
13:24 Next, Squid uses a separate HTTPS connection
13:27 with Snapchat's real server [music] and reencrypts the traffic.
13:30 From the app's perspective, the connection appears normal.
13:34 According to HackRob,
13:35 it isn't clear whether all app users were targeted or just a subset of users.
13:41 We asked Metaphor a comment on Hacks Robb's findings,
13:43 but didn't receive a response.
13:46 So, in a startling case of irony, a VPN marketed by Facebook to protect you,
13:51 presumably from man-in-the-middle attacks
13:53 was itself an enormous man-in-the-middle.
13:56 These aren't our words, they're [music] Facebooks.
13:58 This is a man-in-the-middle approach.
14:01 For Facebook, the intercepted data is a gold mine.
14:04 After launching Instagram stories, they observe that Snapchat's growth slows.
14:08 Its stock value plummets.
14:10 Facebook appears to be winning the war.
14:13 But it seems a novel was useful beyond just crushing arrival.
14:18 According to the Wall Street Journal, Facebook could tell that live video was
14:21 picking up through apps like Mircat and Periscope.
14:24 This helped guide their decision to add live video to Facebook.
14:27 But over time, their certificate shenanigans became more difficult to pull off.
14:31 The security of iOS and Android improved,
14:33 so Facebook had to look for new ways in.
14:36 According to court filings,
14:37 Facebook internally considered exploiting Android's features
14:40 designed to support users with disabilities.
14:42 [music] When we asked Facebook to comment on this, they didn't get back to us.
14:47 And maybe all of this could have just been forgotten,
14:49 buried [music] tech history.
14:50 But over the years, the public slowly
14:52 started to realize what Facebook was up to.
14:58 In a sense, users were warned.
15:01 In the app store description, Anavo did tell users it was tracking them,
15:05 but they framed it as a way to build a better experience.
15:08 Based on that language,
15:09 it's doubtful users really understood the level of access the company had.
15:13 When Project Ghostbusters launched, not everyone at Facebook was on board.
15:17 The heads of the infrastructure engineering and security
15:19 engineering departments both expressed their concerns by email.
15:23 One wrote, "I can't think of a good argument for why this is okay.
15:26 No security person is ever comfortable with this.
15:29 No matter what consent we get from the general public,
15:31 the general public just doesn't know how this stuff works.
15:34 People familiar with the technology spoke to the press anonymously.
15:38 In August 2017, they told the Wall Street Journal
15:41 that Facebook had an internal early bird warning system,
15:44 one that alerts them to potential new threats.
15:47 It's a no.
15:49 At the time, according to Facebook insiders,
15:51 don't be too proud to copy became an informal slogan within the company.
15:55 Speaking to the public, Zuckerberg would claim it was normal for tech
15:58 companies to build off of each other's innovations.
16:01 In early 2018, a security researcher named Will Strawfac took
16:05 a closer look at how a NAVO functioned on iOS.
16:08 He discovered it was even more intrusive
16:09 than the Wall Street Journal had reported.
16:13 Wyard also warned against the Navo.
16:17 Nothing happened.
16:19 But then 3 months later, Apple introduced new developer policies.
16:22 It strictly banned apps from collecting data about other apps
16:25 in a device unless it was strictly necessary for the app to function.
16:29 Apple warned Facebook that a novel protect violated this policy and Facebook
16:33 had no choice but to remove it from the app store.
16:35 Many of our competitors have hundreds of millions or billions of users.
16:39 Some are upstarts, but others are gatekeepers with the power to decide if
16:43 we can even release our apps in their app stores to compete with them.
16:47 But it turns out was just the tip of the iceberg.
16:52 Back in 2016, next to a novel protect,
16:55 Facebook launches a shadow operation to specifically
16:58 collect data on how teens use their phones.
17:00 After all, they're often the first adopters
17:02 of whatever app might become the next big threat.
17:05 A project later called Project Atlas is born.
17:09 Facebook offers teens and young adults up to $20
17:11 a month to install a VPN called Facebook Research.
17:15 This app's code is later found to be
17:16 suspiciously similar to that of Onavo Protect.
17:19 [music] Once installed, the app grants access to a user's internet history,
17:23 including encrypted information and private messages with other
17:26 users who have never given their consent.
17:28 The whole project is shrouded in secrecy.
17:31 An assessment to Facebook spokesperson later disputed.
17:34 There was nothing secret about this.
17:35 It was literally called the Facebook Research App.
17:38 However, Facebook doesn't promote the app publicly.
17:41 Instead, they rely on intermediaries who often don't
17:44 reveal Facebook's involvement until users are already signing up.
17:47 The VPN is also not listed publicly in the app store.
17:50 Instead, Facebook leverages the Apple Enterprise Developer Program,
17:54 a system meant only for company's employees to download work apps.
17:58 By having users install an enterprise profile,
18:01 Facebook bypasses the security measures Apple has in place for regular users.
18:05 To join the so-called research program,
18:07 users are guided through a complex installation process.
18:10 When Apple's system displays a warning
18:12 that the software could access their private data,
18:15 Facebook tells them to ignore it.
18:17 Users are told they're part of a social media study,
18:20 but Facebook never discloses the true scale of the project.
18:23 TechCrunch reports that users faced legal threats if they disclose details,
18:27 part of an effort to keep the project hidden.
18:30 [music] In January 2019, Facebook research was finally exposed.
18:35 TechCrunch worked with security researcher Will Stra.
18:38 He analyzed the full level of access the users,
18:41 many of them miners, were granting Facebook.
18:44 It became clear that this access even included private
18:46 videos and messages as well as realtime location data.
18:49 And all that data went straight to a server
18:51 using the same IP as a novel protect.
18:54 [music] When we asked Meta to comment on this, we didn't receive a response.
18:59 7 hours after the article was published,
19:01 Facebook told TechCrunch it would shut down the iOS version of its research app.
19:05 Facebook accused of spying and using teenagers to help them.
19:09 People between the ages of 13 and 35 were paid up to $20 a month
19:13 to spy on their phones.
19:15 Photos, videos, location, web browsing history.
19:18 The teens signing up to this don't know what they're getting into.
19:21 A month later, Facebook is pulling its virtual private network,
19:26 a VPN app called Onavo from Google Play.
19:30 US senators demanded answers, accusing Facebook of exploiting minors
19:33 and sidestepping basic privacy safeguards.
19:38 Um uh they condemned the program and questioned how meaningful consent
19:44 could be when users were as young as 13.
19:48 In 2023, Australia's federal court ruled that Facebook Israel
19:51 and Anavo Incorporated had engaged in conduct liable to mislead consumers.
19:57 Today, the AC has instituted proceedings against Facebook in relation
20:02 to the way it promoted its Anavo Protect app.
20:06 The two subsidiaries of Meta had marketed Anavo as a privacy
20:09 tool while secretly using it to harvest data for Facebook's business purposes.
20:14 The court ordered the companies to pay a combined $13 million in fines.
20:18 We don't know who actually paid the fine, but for their parent company, Meta,
20:22 which turns a profit of way over $50 billion a year, this is pocket change.
20:29 As technology becomes more sophisticated, privacy often takes a hit.
20:33 It's become increasingly normal to sacrifice personal data for convenience.
20:37 A lot of [music] people are fine with facial
20:39 recognition at the airport if it means shorter lines.
20:42 And the more we accept these trade-offs,
20:43 the more [music] they become standard until opting out is no longer an option.
20:47 Social media makes this pattern especially stark.
20:50 Over the years, heavy Facebook users have been
20:52 shown to exhibit increasingly relaxed attitudes towards privacy.
20:56 They're slowly growing more accustomed to sharing,
20:58 tracking, and surveillance as the default.
21:01 Mark Zuckerberg has said that Facebook's mission is to connect the world.
21:04 He seems to hope that this will be his legacy,
21:07 but maybe a better fit would be move fast, break privacy.