Facebook's Most Dangerous App

0:01 It's 2018.

0:03 You're on Facebook.

0:04 You open the menu, scroll down, and spot this little protect button.

0:07 [music] Sounds like a good idea.

0:09 You tap it.

0:10 Millions of others do, too.

0:12 You're prompted to install something called Onavo Protect,

0:15 a free VPN that protects your privacy, allegedly.

0:20 If only you knew.

0:22 I'm proud that we've given people who've never

0:24 had a voice before the opportunity to be heard.

0:28 Facebook accused of spying.

0:30 A VPN app called Onavo.

0:32 His VPN spied on almost everything users did and sent detailed data to Facebook.

0:37 Potentially a giant wire tab.

0:39 It gets into the root access of your phone.

0:41 Any websites you went to, any apps you used, things along those lines.

0:44 Everything you did on your phone was open to Facebook.

0:46 And so far, there have been almost no legal consequences.

0:49 We're heading into a no privacy future.

0:52 We're already there, aren't we?

0:52 I mean, but this story is even bigger than Onavo.

0:56 It's a story about betrayal of trust, surveillance of minors,

1:00 and corporate espionage, all in the race for market dominance.

1:04 This is the Facebook scandal you've probably never heard of.

1:11 Confirmed.

1:11 Though VPN providers sometimes sponsor our videos,

1:14 they aren't involved in the production of this video in any way.

1:17 They didn't finance this story or suggest this coverage.

1:25 Double rainbow.

1:26 Oh my god.

1:27 When it comes to the internet,

1:28 a lot of people remember the last decade as a simpler time.

1:32 Those were the years of the Harlem Shake,

1:34 the Ice Bucket Challenge, that one celebrity selfie.

1:39 Compared to today, it all seems so wholesome.

1:42 Back in the 2010s, many people still believed something that seems

1:45 impossible today that Facebook of all companies could be trusted.

1:50 So when their users saw a friendly seeming protect button,

1:53 by 2018 millions of them had tapped in.

2:03 For many years, Mark Zuckerberg has been open about

2:05 his goal of making Facebook [music] the ultimate platform for connection.

2:09 By 2013, that's going well.

2:11 Facebook is bigger than ever and the most popular social network.

2:15 In 2012, they cracked a billion users and they

2:18 pulled off the largest tech IPO in US history,

2:20 raising $16 billion in a single day.

2:23 But users in the US are losing interest, especially younger ones.

2:27 They're usually the first to flock to newer apps.

2:30 Zuckerberg is under increasing pressure.

2:32 You really can't risk losing these users to other social media companies.

2:36 So, his strategy becomes,

2:37 as it would later be described, copy, acquire, and kill.

2:43 In 2012, he made Instagram an offer they couldn't refuse.

2:48 Americans share photos on Instagram,

2:50 a company with only 13 employees bought today by Facebook for $1 billion.

2:55 The acquisition was ridiculed at the time.

2:58 A billion dollars for a cute photo app that doesn't turn a profit.

3:01 Investment bankers were puzzled.

3:03 It was a risky move right before Facebook's IPO,

3:06 but the move will end up paying off massively.

3:09 Instagram will deliver billions of users

3:11 and billions of dollars in yearly ad revenue.

3:14 Just 6 years after the acquisition,

3:16 Instagram's estimated worth will be a hundred times what Facebook paid.

3:21 For a while now, Zuckerberg is at another target in sight, Snapchat.

3:27 The app was launched in the fall of 2011

3:29 by Stanford friends Evan Spiegel and Robert Murphy.

3:32 Spiegel is the CEO, Murphy the developer.

3:35 Snapchat is yet another photo sharing app, but with one key difference.

3:39 The images shared disappear after just a few

3:42 seconds and can't be screenshotted without the sender knowing.

3:45 Snapchat's appeal is in its impermanence.

3:48 And unlike on Instagram, the photos aren't meant to be perfect.

3:50 They can be awkward, funny, and messy.

3:53 [music] Teenagers love it, and Zuckerberg wants in.

3:56 At the end of 2012, he invited Spiegel for a chat.

3:59 At the time, Facebook was building a competing app called Poke.

4:02 It launched in December 2012 and failed badly.

4:06 People briefed on the matter told the Wall Street Journal

4:08 Zuckerberg then offered to buy Snapchat for a billion dollars.

4:11 Now in late 2013, he comes back with a new offer,

4:15 $6 billion for the app, six times what he offered Instagram,

4:19 a huge sum for an app that's only been around for 2

4:21 years and isn't profitable with no guarantees that it ever will be.

4:25 Spiegel and Murphy mull it over but eventually declined the offer.

4:28 Spiegel will later say he didn't want

4:30 to make the same mistake that Instagram did.

4:32 Our view was that Instagram had been wildly undervalued in that um

4:37 acquisition ultimately had given up like a massive massive opportunity.

4:42 Fine then time for a new approach.

4:47 You know we cover a lot of tech stories in this channel.

4:49 Almost all of these stories feature code

4:51 and recently you might have heard of vibe coding.

4:54 You're always going to be ahead if you actually

4:56 understand how things are built and how systems work.

5:00 Kotti is the platform to get into coding.

5:02 Whether you're a beginner or an aspiring dev,

5:04 Kotti offers bite-sized, gamified lessons.

5:07 Instead of overwhelming you with theory,

5:09 it creates a personalized learning path right from the start.

5:12 When you sign up, you get a journey tailored

5:14 to your goals based on just a few quick questions.

5:17 Then you learn by doing.

5:18 There are short challenges, real code, and instant feedback if you get stuck.

5:22 [music] It's kind of like a certain language learning app, but for programming.

5:26 There's even a streak system to keep [music] you consistent.

5:29 And it's free to use with the daily limit.

5:31 Start learning with Kotty Techch now.

5:33 Check out the link in the description or scan this QR code.

5:35 Use code Fern 20 for 20% off.

5:39 In 2013, Facebook acquired an Israeli startup called Onavo.

5:44 Zuckerberg's company reportedly spent around hund00 million on it.

5:48 Back then, mobile data was expensive, [music] especially in the US.

5:52 Ono was known for two products that saved

5:54 consumers money by helping them stretch their data plans.

5:57 Ono Extend could compress emails, photos, and app data.

6:00 Ono count allowed users to see how

6:02 much mobile data different apps were consuming.

6:05 Both required users to send their data to Anavo servers.

6:08 And a few months before getting bought,

6:10 they had launched their [music] latest product, a VPN called the Novel Protect.

6:14 But Facebook was probably interested in the startup

6:17 for more than just data compression or traffic rerouting.

6:20 Originally, Facebook made money by tracking user behavior on their site.

6:24 They did this with so-called cookies.

6:26 Cookies are small files that websites store in your device to remember login,

6:29 preferences, and activities.

6:31 This data can then be used to sell hyperargeted ads.

6:33 But smartphones changed the game.

6:35 People started using apps instead of browsers.

6:38 And apps often store data internally.

6:40 They track behavior through appsp specific systems,

6:42 making traditional browser cookies less useful.

6:45 Facebook was lagging behind in the shift to smartphones.

6:48 It was struggling to monetize mobile usage, [music] so it needed insights.

6:52 At the time, it was hard to know how well apps were performing.

6:55 You could see how many people downloaded them,

6:57 but that didn't say much about how often or how exactly they were used.

7:00 When Navo saw an opportunity to fill this knowledge gap,

7:03 thanks to the traffic that was routed to Extend and Count,

7:06 the company was sitting on a treasure trove of engagement data.

7:10 By acquiring the company,

7:11 Facebook suddenly had a secret window into their competitors,

7:14 and one app immediately stood out.

7:17 Ono [music] data showed that 99% of Android

7:19 users in Spain had WhatsApp installed on their phones.

7:23 In the US, far more mobile messages

7:25 were being sent through WhatsApp than through Facebook.

7:27 WhatsApp was powerful competition, yet it also promised incredible growth.

7:32 This is likely one of the reasons Zuckerberg decided to pay $19 billion for it.

7:36 Facebook is making a major move into mobile this morning.

7:39 The social media behemoth is buying the messaging company WhatsApp.

7:43 WhatsApp was uh also both a competitor and complimentary.

7:46 It's a messaging app that is incredibly popular.

7:49 They send billions of messages a day.

7:52 Zuckerberg made no apology for what he considers a very good deal.

7:56 Facebook also used to gain insights into Snapchat, their arch nemesis.

8:00 And there was so much they wanted to know.

8:02 Perhaps most importantly, which features people actually used.

8:06 But there was a problem.

8:07 All the traffic sent through Anavo's

8:08 apps was increasingly hidden behind encryption.

8:14 A year before the acquisition,

8:16 Snowden revealed that the NSA was spying on the world.

8:19 Concerns about online surveillance entered the mainstream,

8:22 and suddenly everyone wanted more protection.

8:24 As the decade marched on, the internet moved toward increased security,

8:28 including Facebook's main competitors.

8:31 Enter the rise of HTTPS.

8:34 When you visit bank ofofamea.com,

8:36 your browser doesn't just take the website's word for it.

8:40 It verifies that you're actually connecting to the site you intended to visit.

8:44 It does so by requesting the website's security certificate, its digital ID.

8:49 This contains information such as domain ownership,

8:52 the issuing authority, and its validity period.

8:55 Once a certificate is issued, the site keeps it for a set period of time.

8:59 To verify these certificates, your browser relies on digital judges,

9:03 the so-called certificate authorities or CAS.

9:06 They issue digital IDs and verify that websites are really who they claim to be.

9:10 Every time you visit, your browser checks whether it's still valid.

9:14 See this little icon in your address bar?

9:17 It means your browser has checked the website certificate against its

9:20 trusted list and confirmed that it links back to a trusted authority.

9:24 Everything is legitimate.

9:26 Then they agree on a temporary secret key for your session.

9:30 From now on, only you and the site can read the traffic.

9:33 Your communication is encrypted.

9:35 Any data you type into bank of america.com travels safely to their server.

9:40 Eavesdroppers can't read it.

9:42 On your phone, things work similarly.

9:44 Tucked deep inside your phone is a highsecurity vault called a trust store.

9:49 It's maintained by the company that makes the operating system.

9:52 Think Apple, Google, or Microsoft.

9:55 [music]

9:54 By default, your phone trusts a built-in list of so-called root certificates,

9:58 but users or companies can sometimes add their own trusted certificates.

10:03 Some apps trust only specific pre-approved certificates.

10:06 This is called certificate pinning.

10:09 Even if a new certificate is added to your phone's trusted list,

10:12 the app won't accept it.

10:14 Like many others, Snapchat started using HTTPS.

10:18 However, they didn't use certificate pinning for their analytics domain.

10:22 This was Facebook's way in.

10:25 In June 2016, Zuckerberg sent an email to three senior executives

10:29 demanding that they figure out how to get around Snapchat's encryption.

10:33 Whenever someone asks a question about Snapchat,

10:35 the answer is usually that because their traffic is encrypted,

10:38 we have no analytics about them.

10:40 Given how quickly they're growing,

10:41 it seems important to figure out a new way to get analytics about them.

10:45 This effectively kicks off Project Ghostbusters.

10:49 A few weeks after the email, the Onavo team comes up with a solution.

11:00 Say you're at a library.

11:02 You see free Wi-Fi.

11:03 And since it's 2016 and your data plan is tiny, you connect.

11:08 Just down the aisle sits a man in a hoodie named Elliot.

11:11 He's about to hack you.

11:13 He might be running a device from his backpack

11:15 that pretends to be the library Wi-Fi,

11:17 or he's just quietly monitoring the network looking for traffic.

11:21 Either way, he can read the unencrypted info you send over

11:24 the network and steal things like login credentials or credit card data.

11:29 Elliot is a so-called man-in-the-middle.

11:32 Because these man-in-the-middle attacks are really scary and easy to pull off,

11:36 more and more people start using VPNs.

11:39 They create a secure tunnel between the user's device and the VPN server.

11:43 Along the way, all the data that passes through it is encrypted.

11:47 From now on, it's harder for hackers to intercept or read your traffic.

11:51 A VPN also hides your IP address by routing

11:54 all your internet requests through its own servers.

11:57 On the surface, Onavo Protect seems like a great option.

12:00 It's free, [music] it protects you,

12:02 and it offers some data compression features.

12:05 Plus, Facebook itself is promoting it,

12:07 [music] and tech experts are singing its praises.

12:10 But a novel protect is doing something very sneaky.

12:14 The following is based on an analysis

12:16 by an Australian hacker who publishes under the alias Hacksro.

12:20 We cannot independently verify the results.

12:22 It all starts with a nudge.

12:24 When you install the app on Android, it says,

12:26 "Your privacy is a top priority." Then a novel reportedly

12:30 prompts you to install a trusted root certificate on your device.

12:34 Once permission is granted, the root certificate is installed.

12:38 It will then be trusted by many applications on your phone.

12:41 Now, whenever your Snapchat app wants

12:43 to send some analytics data to their server,

12:45 Onavo forces that traffic to its server first because it's a VPN.

12:50 [music] HR reports that a service called Squid

12:53 places itself between the app and Snapchat's analytics server.

12:57 It presents a certificate to your phone.

12:59 Yo, I'm totally legit.

13:01 Your phone accepts [music] it because of the judge powers Facebook gave itself.

13:05 Yeah.

13:05 Yeah.

13:06 This is totally legit.

13:08 Normally only Snapchat would be able to decrypt this data.

13:11 [music] But because Anavo installed its own trusted certificate,

13:14 it can unlock the traffic first.

13:16 Now all these Snapchat analytics from your phone

13:18 get decrypted and land on Anavo servers.

13:21 Detailed inapp activity ripe for the taking.

13:24 Next, Squid uses a separate HTTPS connection

13:27 with Snapchat's real server [music] and reencrypts the traffic.

13:30 From the app's perspective, the connection appears normal.

13:34 According to HackRob,

13:35 it isn't clear whether all app users were targeted or just a subset of users.

13:41 We asked Metaphor a comment on Hacks Robb's findings,

13:43 but didn't receive a response.

13:46 So, in a startling case of irony, a VPN marketed by Facebook to protect you,

13:51 presumably from man-in-the-middle attacks

13:53 was itself an enormous man-in-the-middle.

13:56 These aren't our words, they're [music] Facebooks.

13:58 This is a man-in-the-middle approach.

14:01 For Facebook, the intercepted data is a gold mine.

14:04 After launching Instagram stories, they observe that Snapchat's growth slows.

14:08 Its stock value plummets.

14:10 Facebook appears to be winning the war.

14:13 But it seems a novel was useful beyond just crushing arrival.

14:18 According to the Wall Street Journal, Facebook could tell that live video was

14:21 picking up through apps like Mircat and Periscope.

14:24 This helped guide their decision to add live video to Facebook.

14:27 But over time, their certificate shenanigans became more difficult to pull off.

14:31 The security of iOS and Android improved,

14:33 so Facebook had to look for new ways in.

14:36 According to court filings,

14:37 Facebook internally considered exploiting Android's features

14:40 designed to support users with disabilities.

14:42 [music] When we asked Facebook to comment on this, they didn't get back to us.

14:47 And maybe all of this could have just been forgotten,

14:49 buried [music] tech history.

14:50 But over the years, the public slowly

14:52 started to realize what Facebook was up to.

14:58 In a sense, users were warned.

15:01 In the app store description, Anavo did tell users it was tracking them,

15:05 but they framed it as a way to build a better experience.

15:08 Based on that language,

15:09 it's doubtful users really understood the level of access the company had.

15:13 When Project Ghostbusters launched, not everyone at Facebook was on board.

15:17 The heads of the infrastructure engineering and security

15:19 engineering departments both expressed their concerns by email.

15:23 One wrote, "I can't think of a good argument for why this is okay.

15:26 No security person is ever comfortable with this.

15:29 No matter what consent we get from the general public,

15:31 the general public just doesn't know how this stuff works.

15:34 People familiar with the technology spoke to the press anonymously.

15:38 In August 2017, they told the Wall Street Journal

15:41 that Facebook had an internal early bird warning system,

15:44 one that alerts them to potential new threats.

15:47 It's a no.

15:49 At the time, according to Facebook insiders,

15:51 don't be too proud to copy became an informal slogan within the company.

15:55 Speaking to the public, Zuckerberg would claim it was normal for tech

15:58 companies to build off of each other's innovations.

16:01 In early 2018, a security researcher named Will Strawfac took

16:05 a closer look at how a NAVO functioned on iOS.

16:08 He discovered it was even more intrusive

16:09 than the Wall Street Journal had reported.

16:13 Wyard also warned against the Navo.

16:17 Nothing happened.

16:19 But then 3 months later, Apple introduced new developer policies.

16:22 It strictly banned apps from collecting data about other apps

16:25 in a device unless it was strictly necessary for the app to function.

16:29 Apple warned Facebook that a novel protect violated this policy and Facebook

16:33 had no choice but to remove it from the app store.

16:35 Many of our competitors have hundreds of millions or billions of users.

16:39 Some are upstarts, but others are gatekeepers with the power to decide if

16:43 we can even release our apps in their app stores to compete with them.

16:47 But it turns out was just the tip of the iceberg.

16:52 Back in 2016, next to a novel protect,

16:55 Facebook launches a shadow operation to specifically

16:58 collect data on how teens use their phones.

17:00 After all, they're often the first adopters

17:02 of whatever app might become the next big threat.

17:05 A project later called Project Atlas is born.

17:09 Facebook offers teens and young adults up to $20

17:11 a month to install a VPN called Facebook Research.

17:15 This app's code is later found to be

17:16 suspiciously similar to that of Onavo Protect.

17:19 [music] Once installed, the app grants access to a user's internet history,

17:23 including encrypted information and private messages with other

17:26 users who have never given their consent.

17:28 The whole project is shrouded in secrecy.

17:31 An assessment to Facebook spokesperson later disputed.

17:34 There was nothing secret about this.

17:35 It was literally called the Facebook Research App.

17:38 However, Facebook doesn't promote the app publicly.

17:41 Instead, they rely on intermediaries who often don't

17:44 reveal Facebook's involvement until users are already signing up.

17:47 The VPN is also not listed publicly in the app store.

17:50 Instead, Facebook leverages the Apple Enterprise Developer Program,

17:54 a system meant only for company's employees to download work apps.

17:58 By having users install an enterprise profile,

18:01 Facebook bypasses the security measures Apple has in place for regular users.

18:05 To join the so-called research program,

18:07 users are guided through a complex installation process.

18:10 When Apple's system displays a warning

18:12 that the software could access their private data,

18:15 Facebook tells them to ignore it.

18:17 Users are told they're part of a social media study,

18:20 but Facebook never discloses the true scale of the project.

18:23 TechCrunch reports that users faced legal threats if they disclose details,

18:27 part of an effort to keep the project hidden.

18:30 [music] In January 2019, Facebook research was finally exposed.

18:35 TechCrunch worked with security researcher Will Stra.

18:38 He analyzed the full level of access the users,

18:41 many of them miners, were granting Facebook.

18:44 It became clear that this access even included private

18:46 videos and messages as well as realtime location data.

18:49 And all that data went straight to a server

18:51 using the same IP as a novel protect.

18:54 [music] When we asked Meta to comment on this, we didn't receive a response.

18:59 7 hours after the article was published,

19:01 Facebook told TechCrunch it would shut down the iOS version of its research app.

19:05 Facebook accused of spying and using teenagers to help them.

19:09 People between the ages of 13 and 35 were paid up to $20 a month

19:13 to spy on their phones.

19:15 Photos, videos, location, web browsing history.

19:18 The teens signing up to this don't know what they're getting into.

19:21 A month later, Facebook is pulling its virtual private network,

19:26 a VPN app called Onavo from Google Play.

19:30 US senators demanded answers, accusing Facebook of exploiting minors

19:33 and sidestepping basic privacy safeguards.

19:38 Um uh they condemned the program and questioned how meaningful consent

19:44 could be when users were as young as 13.

19:48 In 2023, Australia's federal court ruled that Facebook Israel

19:51 and Anavo Incorporated had engaged in conduct liable to mislead consumers.

19:57 Today, the AC has instituted proceedings against Facebook in relation

20:02 to the way it promoted its Anavo Protect app.

20:06 The two subsidiaries of Meta had marketed Anavo as a privacy

20:09 tool while secretly using it to harvest data for Facebook's business purposes.

20:14 The court ordered the companies to pay a combined $13 million in fines.

20:18 We don't know who actually paid the fine, but for their parent company, Meta,

20:22 which turns a profit of way over $50 billion a year, this is pocket change.

20:29 As technology becomes more sophisticated, privacy often takes a hit.

20:33 It's become increasingly normal to sacrifice personal data for convenience.

20:37 A lot of [music] people are fine with facial

20:39 recognition at the airport if it means shorter lines.

20:42 And the more we accept these trade-offs,

20:43 the more [music] they become standard until opting out is no longer an option.

20:47 Social media makes this pattern especially stark.

20:50 Over the years, heavy Facebook users have been

20:52 shown to exhibit increasingly relaxed attitudes towards privacy.

20:56 They're slowly growing more accustomed to sharing,

20:58 tracking, and surveillance as the default.

21:01 Mark Zuckerberg has said that Facebook's mission is to connect the world.

21:04 He seems to hope that this will be his legacy,

21:07 but maybe a better fit would be move fast, break privacy.