Facebook open-sources Mariana Trench – a tool used to detect security bugs in Android and Java apps

guest · Sep 29, 2021

Facebook open-sources internal tool used to detect security bugs in Android apps
September 29, 2021
https://therecord.media/facebook-op...used-to-detect-security-bugs-in-android-apps/

Facebook's new Mariana Trench security tool can find security bugs in Android and Java applications.

Mariana Trench is currently used to find vulnerabilities in the Facebook, Instagram, and WhatsApp Android apps.

Facebook said the tool can go through its entire Java code base (tens of millions of line of code) in roughly 45 minutes.

Click to expand...

The tool, made available on GitHub a few months back but formally released today, has been used internally at Facebook for the past months to find bugs in the Facebook, Instagram, and WhatsApp Android applications.

Under the hood, Facebook said the tool works by analyzing Dalvik bytecode, the format in which Android apps are packaged for distribution.
The benefit of being able to work with Dalvik bytecode is that Mariana Trench (MT) can scan apps with or without direct access to their source code.
Click to expand...

Mariana Trench is also the third static code analyzer that Facebook has released so far.
Mariana Trench was built for speed
While there are plenty of static code analyzers built for Java code and Android apps, some of which have been around for decades, Facebook said MT’s main advantage is its speed, with the tool needing around 45 minutes to go through the entire Facebook code base, estimated in the realm of tens of millions of lines of code.

The social network said that tools like Zoncolan, Pysa, and Mariana Trench are essential to its security teams, which are relying more and more on automated bug detection systems.
Click to expand...

Facebook: Open-sourcing Mariana Trench: Analyzing Android and Java app security in depth

In the first half of 2021, over 50 percent of the security vulnerabilities we found across our family of apps were detected using automated tools.

MT works very similarly to Zoncolan and Pysa. The main difference is that MT is optimized for analyzing Android and Java applications. We briefly cover the basics in this blog post and encourage our readers to review our previous write-ups for a more in-depth technical explanation.
Click to expand...

Log in or Sign up

Facebook open-sources Mariana Trench – a tool used to detect security bugs in Android and Java apps

guest Guest

Log in or Sign up

Facebook open-sources Mariana Trench – a tool used to detect security bugs in Android and Java apps

guest Guest

Useful Searches