Really curious how Android sandboxing was so easily defeated. Were those ports left open for extensions or something? I need to read up on this exploit. It’s so brazen, but also shouldn’t be possible. 8 years of stolen data. Wild.
this post was submitted on 13 Jun 2025
65 points (100.0% liked)
Anti-Corporate Movement
835 readers
57 users here now
This community is the first one on lemmy of its kind. It sits between the idea of anarchism/anti-capitalism and left leaning economic policy.
Our goal is to make people aware of the dangers of corporate control, its influence on governments and people as well as the small but steady abrasion of empathy around the world indirectly caused by it.
Current topics this includes but is not limited to:
- Meta's entry into the fediverse
- Game companies putting gambling mechanics in childrens games
- Embracer groups buyout and closing of smaller game studios
- IP trolls destroying small companies and keeping progress back for profit
Feel free to debate this but beware, corporate rhetoric is not welcome here. If you have arguments, bring them on. If its rhetoric trying to defend the evil actions of corporations, we will know and you will go.
Our declared goal so far is to have all companies and individuals worldwide capped at 999 mil USD in all assets, including ownership of other companies, sister companies and marital assets. The reason for this is that companies (and individuals) are not supposed to resemble small(?) countries with a single leader(-board) and shareholder primacy. Thats why we feel like they must be kept in check indefinitely.
But companies will just wander off The argument that large companies will just wander off is valid, which we embrace. We dont need microsoft, apple, google, amazon and other trillion dollar companies. There are small competitors being kept small and driven into brankruptcy by anti competitive behavior of these giants or simply bought up and closed. If starbucks left tomorrow, we would not have an issue with this.
But then we have x little microsofts that all belong to the same person(s) If in fact nobody was allowed to accumulate more than 999 mil in assets, they would not be able to own all these. And like defending agains burglary, it is not about complete defence but time and effort. You only have to keep the thief occupied long enough for them to be caught, give up or make a mistake.
But these giants have tons of IP which would then limit our growth Thats another topic we must touch on. We will (only this one time) take a page out of russias playbook and demand that IP of non complying companies (assets over 999 mil USD) will be declared invalid, which opens them up to be copied.
But then they will "live" in one country that doesnt accept this Correct, and they should be taken into custody the moment they enter the airspace of a country that supports this act.
founded 1 year ago
MODERATORS
Update: apparently it’s worse than I expected.
Access to localhost is simply not restricted by the OS at all. Inter-app communication via localhost is unregulated, even within a browser runtime “sandbox” (not a true sandbox apparently).
The only reason Brave wasn’t affected is that it required additional user permission for localhost access, so the tracking script halts in that browser to avoid detection.
The reason this is worse is that it means not only can a browser tab “talk” to local apps through specific ports, it can use any port, can talk to other browser tabs, and apps can share data with each other without restriction. If I’m understanding the scope of this loophole, it’s a glaring vulnerability that’s been there from the beginning, and it’s unlikely Meta is the only company to exploit it.
ETA: this is what I gathered from reading the paper. I still need to do my own testing to confirm. In the meantime if anyone knows more feel free to correct any of the above.
I'm so glad I've never installed any of meta's apps and never used any of their services and never will.
I bet they're doing this with WhatsApp too. The "privacy" focussed messenger service. I just wish there was a way to get everyone I know to stop living in it like a fish in water.
You wont like the rest I have to tell you. The problem isnt whatsapp. Its the system. Its needs to go.
It's an exploit in android, yes. But it's meta who found it and instead of responsibly reporting it they took advantage. A parasitic move from a company that shouldn't exist.
No, sorry. Not the operating system. At least not that of the phone. The other system.
Isn't that their revenue for a quarter? If so this is nothing...
Cost of doing business
Exactly. It's good news though and the explanation some people might wanna hear. :)