Facebook's Most Dangerous App

0:01 It's 2018.

0:03 You're on Facebook.

0:04 You open the menu, scroll down, and spot this little protect button.

0:07 [music] Sounds like a good idea.

0:09 You tap it.

0:10 Millions of others do, too.

0:12 You're prompted to install something called Onava Protect.

0:15 A free VPN that protects your privacy.

0:18 Allegedly.

0:20 If only you knew.

0:22 I'm proud that we've given people who've never

0:24 had a voice before the opportunity to be heard.

0:28 Facebook accused of spying

0:29 a VPN app called Onavo.

0:32 This VPN spied on almost everything users

0:34 did and sent detailed data to Facebook.

0:36 Potentially a giant wiretap.

0:38 It gets into the root access of your phone.

0:41 Any websites you went to, any app you used, things along those lines.

0:44 Everything you did on your phone was open to Facebook.

0:46 And so far, there've been almost no legal consequences.

0:49 We're heading into a new privacy future.

0:51 We're already there, aren't we?

0:53 But this story is even bigger than Onavo.

0:56 It's a story about betrayal of trust, surveillance of minors,

1:00 and corporate espionage, all in the race for market dominance.

1:04 This is the Facebook scandal you've probably never heard of.

1:11 Though VPN providers sometimes sponsor our videos,

1:14 they aren't involved in the production of this video in any way.

1:17 They didn't finance this story or suggest this coverage.

1:25 Double rainbow.

1:26 Oh my god.

1:27 When it comes to the internet,

1:28 a lot of people remember the last decade as a simpler time.

1:32 Those were the years of the Harlem Shake,

1:34 the Ice Bucket Challenge, that one celebrity selfie.

1:39 Compared to today, it all seems so wholesome.

1:42 Back in the 2010s, many people

1:44 still believed something that seems impossible today.

1:46 That Facebook, of all companies, could be trusted.

1:49 So, when their users saw a friendly-seeming protect button,

1:53 by 2018, millions of them had tapped in.

2:03 For many years, Mark Zuckerberg has been open about

2:05 his goal of making Facebook [music] the ultimate platform for connection.

2:09 By 2013, that's going well.

2:11 Facebook is bigger than ever and the most popular social network.

2:15 In 2012, they cracked a billion users and they

2:18 pulled off the largest tech IPO in US history,

2:20 raising $16 billion in a single day.

2:23 But users in the US are losing interest, especially younger ones.

2:27 They're usually the first to flock to newer apps.

2:30 Zuckerberg is under increasing pressure.

2:32 He really can't risk losing these users to other social media companies.

2:36 So his strategy becomes,

2:37 as it would later be described, copy, acquire, and kill.

2:43 In 2012, he made Instagram an offer they couldn't refuse.

2:48 Americans share photos on Instagram.

2:50 A company with only 13 employees bought today by Facebook for $1 billion.

2:55 The acquisition was ridiculed at the time.

2:57 A billion dollars for a cute photo app that doesn't turn a profit?

3:01 Investment bankers were puzzled.

3:03 It was a risky move right before Facebook's IPO.

3:06 But the move will end up paying off massively.

3:09 Instagram will deliver billions of users

3:11 and billions of dollars in yearly ad revenue.

3:14 Just 6 years after the acquisition,

3:16 Instagram's estimated worth will be 100 times what Facebook paid.

3:21 For a while now, Zuckerberg has had another target in sight.

3:24 Snapchat.

3:27 The app was launched in the fall of 2011

3:29 by Stanford friends Evan Spiegel and Robert Murphy.

3:32 Spiegel is the CEO, Murphy the developer.

3:35 Snapchat is yet another photo sharing app, but with one key difference.

3:39 The images shared disappear after just a few

3:41 seconds and can't be screenshotted without the sender knowing.

3:45 Snapchat's appeal is in its impermanence.

3:47 And unlike on Instagram, the photos aren't meant to be perfect.

3:50 They can be awkward, funny, and messy.

3:54 [music] Teenagers love it, and Zuckerberg wants in.

3:56 At the end of 2012, he invited Spiegel for a chat.

3:59 At the time, Facebook was building a competing app called Poke.

4:02 It launched in December 2012 and failed badly.

4:06 People briefed on the matter told the Wall Street Journal

4:08 Zuckerberg then offered to buy Snapchat for a billion dollars.

4:11 Now, in late 2013, he comes back with a new offer,

4:15 $6 million for the app, six times what he offered Instagram,

4:19 a huge sum for an app that's only been around for 2

4:21 years and isn't profitable with no guarantees that it ever will be.

4:25 Spiegel and Murphy mull it over, but eventually decline the offer.

4:28 Spiegel will later say he didn't want

4:30 to make the same mistake that Instagram did.

4:32 Our view was that Instagram had been wildly undervalued and that um

4:37 acquisition ultimately had given up like a massive massive opportunity.

4:42 Fine, then.

4:44 Time for a new approach.

4:47 You know we cover a lot of tech stories in this channel.

4:49 Almost all of these stories feature code,

4:51 and recently you might have heard of vibe coding.

4:53 But you're always going to be ahead if you

4:55 actually understand how things are built and how systems work.

5:00 Cody is the platform to get into coding.

5:02 Whether you're a beginner or an aspiring dev,

5:04 Cody offers bite-sized gamified lessons.

5:07 Instead of overwhelming you with theory,

5:09 it creates a personalized learning path right from the start.

5:12 When you sign up, you get a journey tailored

5:14 to your goals based on just a few quick questions.

5:17 Then you learn by doing.

5:18 There's short challenges, real code, instant feedback if you get stuck.

5:22 [music] It's kind of like a certain language learning app, but for programming.

5:26 There's even a streak system to keep you [music] consistent,

5:28 and it's free to use with the daily limit.

5:31 Start learning with Cody Tech now.

5:32 Check out the link in the description or scan this QR code.

5:35 Use code fern20 for 20% off.

5:39 In 2013, Facebook acquired an Israeli startup called Onavo.

5:44 Zuckerberg's company reportedly spent around $100 million dollars on it.

5:48 Back then, mobile data was expensive, [music] especially in the US.

5:52 Onavo was known for two products that saved

5:54 consumers money by helping them stretch their data plans.

5:57 Onavo Extend could compress emails, photos, and app data.

6:00 Onavo Count allowed users to see how

6:02 much mobile data different apps were consuming.

6:05 Both required users to send their data to Onavo servers.

6:08 And a few months before getting bought,

6:10 they had launched their [music] latest product, a VPN called Onavo Protect.

6:14 But Facebook was probably interested in the startup

6:17 for more than just data compression or traffic re-routing.

6:20 Originally, Facebook made money by tracking user behavior on their site.

6:24 They did this with so-called cookies.

6:26 Cookies are small files that websites store in your device to remember logins,

6:29 preferences, and activities.

6:31 This data can then be used to sell hyper-targeted ads.

6:33 But smartphones changed the game.

6:35 People started using apps instead of browsers.

6:38 And apps often store data internally.

6:40 They track behavior through app-specific systems,

6:42 making traditional browser cookies less useful.

6:45 Facebook was lagging behind in the shift to smartphones.

6:48 It was struggling to monetize mobile usage.

6:51 [music] So it needed insights.

6:52 At the time, it was hard to know how well apps were performing.

6:55 You could see how many people downloaded them,

6:57 but that didn't say much about how often or how exactly they were used.

7:00 Onavo saw an opportunity to fill this knowledge gap.

7:03 Thanks to the traffic that was routed through Extend and Count,

7:06 the company was sitting on a treasure trove of engagement data.

7:10 By acquiring the company,

7:11 Facebook suddenly had a secret window into their competitors.

7:14 And one app immediately stood out.

7:17 Onavo [music] data showed that 99% of Android

7:19 users in Spain had WhatsApp installed on their phones.

7:23 In the US, far more mobile messages

7:25 were being sent through WhatsApp than through Facebook.

7:27 WhatsApp was powerful competition, yet it also promised incredible growth.

7:32 This is likely one of the reasons Zuckerberg

7:33 decided to pay 19 billion dollars for it.

7:36 Facebook is making a major move into mobile this morning.

7:39 The social media behemoth is buying the messaging company WhatsApp.

7:43 WhatsApp was also both a competitor and complimentary.

7:46 It's a messaging app that is incredibly popular.

7:49 They send billions of messages a day.

7:52 Zuckerberg made no apology for what he considers a very good deal.

7:56 Facebook also used Onavo to gain insights into Snapchat, their arch-nemesis.

8:00 And there was so much they wanted to know.

8:02 Perhaps most importantly, which features people actually used.

8:06 But there was a problem.

8:07 All the traffic sent through Onavo's

8:08 apps was increasingly hidden behind encryption.

8:14 A year before the acquisition,

8:16 Snowden revealed that the NSA was spying on the world.

8:19 Concerns about online surveillance entered the mainstream,

8:22 and suddenly everyone wanted more protection.

8:24 As the decade marched on, the internet moved toward increased security,

8:28 including Facebook's main competitors.

8:31 Enter the rise of HTTPS.

8:34 When you visit bankofamerica.com,

8:36 your browser doesn't just take the website's word for it.

8:40 It verifies that you're actually connecting to the site you intended to visit.

8:44 It does so by requesting the website's security certificate, its digital ID.

8:49 This contains information such as domain ownership,

8:51 the issuing authority, and its validity period.

8:55 Once the certificate is issued, the site keeps it for a set period of time.

8:59 To verify these certificates, your browser relies on digital judges,

9:03 the so-called certificate authorities or CAs.

9:06 They issue digital IDs and verify that websites are really who they claim to be.

9:10 Every time you visit, your browser checks whether it's still valid.

9:14 See this little icon in your address bar?

9:17 It means your browser has checked

9:18 the website's certificate against its trusted list,

9:21 and confirmed that it links back to a trusted authority.

9:24 Everything is legitimate.

9:26 Then they agree on a temporary secret key for your session.

9:30 From now on, only you and the site can read the traffic.

9:33 Your communication is encrypted.

9:35 Any data you type into bankofamerica.com travels safely to their server.

9:40 Eavesdroppers can't read it.

9:42 On your phone, things work similarly.

9:44 Tucked deep inside your phone is a high security vault called a trust store.

9:49 It's maintained by the company that makes the operating system.

9:51 Think Apple, Google, or Microsoft.

9:55 [music]

9:54 By default, your phone trusts a built-in list of so-called root certificates.

9:58 But users or companies can sometimes add their own trusted certificates.

10:03 Some apps trust only specific pre-approved certificates.

10:06 This is called certificate pinning.

10:09 Even if a new certificate is added to your phone's trusted list,

10:12 the app won't accept it.

10:14 Like many others, Snapchat started using HTTPS.

10:18 However, they didn't use certificate pinning for their analytics domain.

10:22 This was Facebook's way in.

10:25 In June 2016, Zuckerberg sent an email to three senior executives

10:29 demanding that they figure out how to get around Snapchat's encryption.

10:33 Whenever someone asks a question about Snapchat,

10:35 the answer is usually that because their traffic is encrypted,

10:38 we have no analytics about them.

10:40 Given how quickly they're growing,

10:41 it seems important to figure out a new way to get analytics about them.

10:45 This effectively kicks off Project Ghostbusters.

10:49 A few weeks after the email, the Onavo team comes up with a solution.

11:00 Say you're at a library.

11:02 You see free Wi-Fi, and since it's 2016 and your data plan is tiny, you connect.

11:07 Just down the aisle sits a man in a hoodie named Elliot.

11:11 He's about to hack you.

11:13 He might be running a device from his backpack

11:15 that pretends to be the library Wi-Fi.

11:17 Or he's just quietly monitoring the network looking for traffic.

11:21 Either way, he can read the unencrypted info you send over

11:24 the network and steal things like login credentials or credit card data.

11:29 Elliot is a so-called man-in-the-middle.

11:32 Because these man-in-the-middle attacks are really scary and easy to pull off,

11:36 more and more people start using VPNs.

11:39 They create a secure tunnel between the user's device and the VPN server.

11:43 Along the way, all the data that passes through it is encrypted.

11:47 From now on, it's harder for hackers to intercept or read your traffic.

11:51 A VPN also hides your IP address by routing

11:54 all your internet requests through its own servers.

11:57 On the surface, Onavo Protect seems like a great option.

12:00 It's free, [music] it protects you,

12:02 and it offers some data compression features.

12:05 Plus, Facebook itself is promoting it, [music]

12:07 and tech experts are singing its praises.

12:10 But Onavo Protect is doing something very sneaky.

12:14 The following is based on an analysis

12:16 by an Australian hacker who publishes under the alias hacksrob.

12:20 We cannot independently verify the results.

12:22 It all starts with a nudge.

12:24 When you install the app on Android,

12:26 it says, "Your privacy is a top priority." Then,

12:30 Onavo reportedly prompts you to install

12:31 a trusted root certificate on your device.

12:34 Once permission is granted, the root certificate is installed.

12:38 It will then be trusted by many applications on your phone.

12:41 Now, whenever your Snapchat app wants

12:43 to send some analytics data to their server,

12:45 Onavo forces that traffic to its server first because it's a VPN.

12:51 [music] Hacksrob reports that a service called Squid places

12:54 itself between the app and Snapchat's analytics server.

12:57 It presents a certificate to your phone.

12:59 Yo, I'm totally legit.

13:01 Your phone accepts [music] it because of the judge powers Facebook gave itself.

13:05 Yeah, yeah, this is totally legit.

13:08 Normally, only Snapchat would be able to decrypt this data.

13:11 [music] But because Onavo installed its own trusted certificate,

13:14 it can unlock the traffic first.

13:16 Now, all these Snapchat analytics from your phone

13:18 get decrypted and land on Onavo's servers.

13:21 Detailed in-app activity, ripe for the taking.

13:24 Next, Squid uses a separate HTTPS connection

13:27 with Snapchat's real server [music] and re-encrypts the traffic.

13:30 From the app's perspective, the connection appears normal.

13:34 According to Hacker Rob,

13:35 it isn't clear whether all app users were targeted or just a subset of users.

13:41 We asked Meta for a comment on Hacker Rob's findings,

13:43 but didn't receive a response.

13:46 So, in a startling case of irony, a VPN marketed by Facebook to protect you,

13:51 presumably from man-in-the-middle attacks,

13:53 was itself an enormous man-in-the-middle.

13:56 These aren't our words, they're Facebook's.

13:57 [music] This is a man-in-the-middle approach.

14:01 For Facebook, the intercepted data is a gold mine.

14:04 After launching Instagram stories,

14:05 they observed that Snapchat's growth slows, its stock value plummets.

14:10 Facebook appears to be winning the war.

14:13 But, it seems a novel was useful beyond just crushing a rival.

14:18 According to The Wall Street Journal, Facebook could tell that live video was

14:21 picking up through apps like Meerkat and Periscope.

14:24 This helped guide their decision to add live video to Facebook.

14:27 But, over time, their certificate shenanigans became more difficult to pull off.

14:31 The security of iOS and Android improved,

14:33 so Facebook had to look for new ways in.

14:36 According to court filings,

14:37 Facebook internally considered exploiting Android's features

14:40 designed to support users with disabilities.

14:42 [music] When we asked Facebook to comment on this, they didn't get back to us.

14:47 And maybe all of this could have just been forgotten,

14:49 buried [music] tech history.

14:50 But, over the years,

14:51 the public slowly started to realize what Facebook was up to.

14:58 In a sense, users were warned.

15:01 In the App Store description, a novel did tell users it was tracking them.

15:05 But, they framed it as a way to build a better experience.

15:08 Based on that language,

15:08 it's doubtful users really understood the level of access the company had.

15:13 When Project Ghostbusters launched, not everyone at Facebook was on board.

15:17 The heads of the infrastructure, engineering,

15:19 and security engineering departments both expressed their concerns by email.

15:23 One wrote, I can't think of a good argument for why this is okay.

15:26 No security person is ever comfortable with this, no

15:29 matter what consent we get from the general public.

15:31 The general public just doesn't know how this stuff works.

15:34 People familiar with the technology spoke to the press anonymously.

15:38 In August 2017, they told the Wall Street Journal

15:40 that Facebook had an internal early bird warning system,

15:44 one that alerts them to potential new threats.

15:47 It's a novel.

15:49 At the time, according to Facebook insiders,

15:51 don't be too proud to copy became an informal slogan within the company.

15:55 Speaking to the public, Zuckerberg would claim it was normal for tech

15:58 companies to build off of each other's innovations.

16:01 In early 2018, a security researcher named Will Strafach took

16:05 a closer look at how a novel functioned on iOS.

16:08 He discovered it was even more intrusive

16:09 than the Wall Street Journal had reported.

16:13 Wired also warned against a novel.

16:17 Nothing happened.

16:19 But then 3 months later, Apple introduced new developer policies that strictly

16:23 banned apps from collecting data about other

16:25 apps in a device unless it was strictly necessary for the app to function.

16:29 Apple warned Facebook that a novel protect violated this policy,

16:32 and Facebook had no choice but to remove it from the App Store.

16:35 Many of our competitors have hundreds of millions or billions of users.

16:39 Some are upstarts, but others are gatekeepers with the power to decide if

16:43 we can even release our apps in their App Stores to compete with them.

16:47 But it turns out a novel was just the tip of the iceberg.

16:52 Back in 2016, next to a novel protect,

16:55 Facebook launches a shadow operation to specifically

16:57 collect data on how teens use their phones.

17:00 After all, they're often the first adopters

17:02 of whatever app might become the next big threat.

17:05 A project later called Project Atlas is born.

17:09 Facebook offers teens and young adults up to $20

17:11 a month to install a VPN called Facebook Research.

17:15 This app's code is later found to be

17:16 suspiciously similar to that of Onavo Protect.

17:20 [music] Once installed, the app grants access to a user's internet history,

17:23 including encrypted information and private messages with other

17:26 users who have never given their consent.

17:28 The whole project is shrouded in secrecy.

17:31 An assessment a Facebook spokesperson later disputed.

17:34 There was nothing secret about this.

17:35 It was literally called the Facebook research app.

17:38 However, Facebook doesn't promote the app publicly.

17:41 Instead, they rely on intermediaries who often don't

17:43 reveal Facebook's involvement until users are already signing up.

17:47 The VPN is also not listed publicly in the App Store.

17:50 Instead, Facebook leverages the Apple Enterprise Developer Program,

17:54 a system meant only for company's employees to download work apps.

17:58 By having users install an enterprise profile,

18:01 Facebook bypasses the security measures Apple has in place for regular users.

18:05 To join the so-called research program,

18:07 users are guided through a complex installation process.

18:10 When Apple's system displays a warning

18:12 that the software could access their private data,

18:15 Facebook tells them to ignore it.

18:17 Users are told they're part of a social media study,

18:20 but Facebook never discloses the true scale of the project.

18:23 TechCrunch reports that users faced legal threats if they disclosed details,

18:27 part of an effort to keep the project hidden.

18:32 [music] In January 2019, Facebook research was finally exposed.

18:35 TechCrunch worked with security researcher Will Strafach.

18:38 He analyzed the full level of access the users,

18:41 many of them minors, were granting Facebook.

18:44 It became clear that this access even included private videos and messages,

18:47 as well as real-time location data.

18:49 And all that data went straight to a server using the same IP as Onavo Protect.

18:55 [music] When we asked Meta to comment on this, we didn't receive a response.

18:59 7 hours after the article was published,

19:01 Facebook told TechCrunch it would shut down the iOS version of its research app.

19:05 Facebook accused of spying and using teenagers to help them.

19:09 People between the ages of 13 and 35 were paid up to $20 a month

19:13 to spy on their phones.

19:15 Photos, videos, location, web browsing history.

19:18 The teens signing up to this don't know what they're getting into.

19:21 A month later, Facebook is pulling its virtual private network,

19:26 a VPN app called Onavo, from Google Play.

19:30 US senators demanded answers, accusing Facebook of exploiting minors

19:33 and sidestepping basic privacy safeguards.

19:37 Um Uh They condemned the program and questioned how meaningful consent

19:44 could be when users were as young as 13.

19:47 In 2023, Australia's Federal Court ruled that Facebook Israel

19:51 and Onavo Incorporated had engaged in conduct liable to mislead consumers.

19:57 Today, the ACCC has instituted proceedings against Facebook in relation

20:02 to the way it promoted its Onavo Protect app.

20:06 The two subsidiaries of Meta had marketed Onavo as a privacy

20:09 tool while secretly using it to harvest data for Facebook's business purposes.

20:14 The court ordered the companies to pay a combined $13 million in fines.

20:18 We don't know who actually paid the fine, but for their parent company Meta,

20:22 which turns a profit of way over $50 million a year, this is pocket change.

20:29 As technology becomes more sophisticated, privacy often takes a hit.

20:33 It's become increasingly normal to sacrifice personal data for convenience.

20:37 A lot of people [music] are fine with facial

20:39 recognition at the airport if it means shorter lines.

20:42 And the more we accept these tradeoffs,

20:43 the more [music] they become standard until opting out is no longer an option.

20:47 Social media makes this pattern especially stark.

20:50 Over the years, heavy Facebook users have been

20:52 shown to exhibit increasingly relaxed attitudes towards privacy.

20:56 They're slowly growing more accustomed to sharing,

20:58 tracking, and surveillance as the default.

21:01 Mark Zuckerberg has said that Facebook's mission is to connect the world.

21:04 He seems to hope that this will be his legacy.

21:07 But maybe a better fit would be move fast, break privacy.