Facebook announced that it is open-sourcing Mariana Trench, an Android-focused static analysis platform which is used to detect and prevent security and privacy bugs in applications created for the mobile operating system at scale.
Mariana Trench has been designed to scan large mobile codebases and flag potential issues on pull requests before they make it into production.
The utility allows developers to frame rules for different data flows to scan the codebase for in order to unearth potential issues like, intent redirection flaws that could result in the leak of sensitive data or injection vulnerabilities that would allow adversaries to insert arbitrary code — explicitly setting boundaries as to where user-supplied data entering the app is allowed to come from (source) and flow into (sink) such as methods that can execute code and retrieve or interact with user data.
Data flows found violating the rules are then surfaced back either to a security engineer or the software engineer who made the pull request containing the changes.
The tech giant said that more than 50% of vulnerabilities detected across its family of apps, including Facebook, Instagram, and WhatsApp, were found using automated tools.
Mariana Trench also marks the third such service the company has open-sourced after Zoncolan and Pysa, each of which target Hack and Python programming languages, respectively.
The company stated that there are differences in patching and ensuring the adoption of code updates between mobile and web applications, so they require different approaches.
Server-side code can be updated almost instantaneously for web apps, but mitigating a security bug in an Android application relies on each user updating the application on the device they own in a timely way. This makes it that much more important for any app developer to put systems in place to help prevent vulnerabilities from making it into mobile releases, whenever possible.
