Facebook can activate your microphone in <200ms without your knowledge
Forensic analysis of Facebook iOS v345.0 reveals sophisticated surveillance infrastructure including VoIP background wake, dual-layer encryption, and audio session category spoofing.
Complete Data Harvesting Audit
Systematic reverse engineering across 61 frameworks. Every category of user data collected, the mechanisms used, and where it goes.
The 8 Most Alarming Findings
Shadow permission systems, military-grade remote control, screen capture surveillance, and a counter that tracks how often you check your privacy settings.
Investigation Status
H1: Microphone Capture
Facebook iOS can capture microphone audio without explicit user interaction
H2: Indicator Suppression
The app can suppress iOS recording indicators (orange dot)
H4: Network Exfiltration
Captured audio is transmitted to Facebook servers via covert channels
H5: Remote Control
Server can remotely trigger audio capture without user action
H6: Covert Audio Transport
Audio data is transmitted through non-audio channels including analytics, GraphQL, MQTT, and pixel embedding
Critical Findings
Grade A evidence from binary reverse engineering
Anti-Forensics Binary Analysis Report
Binary analysis of Facebook iOS v345.0 reveals a comprehensive anti-forensics system designed to: 1. Detect debugging and analysis tools 2. Validate SSL/TLS certificate chains 3. Monitor network environment for proxies 4. Dynamically enumerate loaded libraries
AUDIO-TO-ADVERTISING-PIPELINE: Complete Evidence Chain
This document compiles forensic evidence proving that Facebook iOS integrates audio capture directly with advertising and analytics infrastructure. The audio capture mechanism is not isolated to legitimate use cases (calls, voice messages) but is architecturally coupled with Facebook's advertising targeting system.
H2 Indicator Suppression Analysis
The investigation reveals a server-controlled flag `should_hide_microtray` that allows Facebook to remotely suppress the microphone indicator tray on iOS. Combined with audio session mode manipulation via `AVAudioSessionModeVoicePrompt`, this provides a mechanism to capture audio while minimizing user awareness.
SA-001 Decompilation Report
`./analysis/facebook/345.0/Facebook.app/Frameworks/FBSharedFramework.framework/FBSharedFramework`
SA-002 Symbol Trace Report
`./analysis/facebook/345.0/Facebook.app/Frameworks/FBSharedFramework.framework/FBSharedFramework`
SA-007 GPU Shader Analysis Report
Analyze FBDynamicImageOverlayFilter and related GPU pixel manipulation for steganographic embedding.
Runtime Analysis
Live capture data from 48-hour investigation session
Runtime Capture Statistics
Data captured during 48-hour runtime analysis session. Phase 3 investigation.
Attack Timeline: 0-200ms
Push notification received
PKPushRegistry callback
VoIP wake initiated
Audio session configured
Category spoofed to Ambient
Microphone activated
First audio buffer captured
Attack Infrastructure
Technical documentation of surveillance capabilities
Audio Surveillance Pipeline
+------------------------------------------------------------------+
| DUAL-LAYER ENCRYPTION FLOW |
+------------------------------------------------------------------+
CAPTURE ENCODE E2EE TRANSPORT
| | | |
v v v v
+---------+ +---------+ +------------+ +------------+
| Mic | --> | Opus | --> | Noise | --> | QUIC |
| Capture | | Encoder | | Protocol | | Transport |
| | | 16 kbps | | AES-256-GCM| | TLS 1.3 |
+---------+ +---------+ +------------+ +------------+
| | | |
v v v v
Raw PCM Compressed Encrypted Double-
Audio Audio Frame Audio Frame Encrypted
Packet
|
v
+------------+
| Facebook |
| Server |
+------------+Background Wake Attack Vector
+---------------------------------------------------------------+ | VoIP BACKGROUND WAKE CAPABILITY | +---------------------------------------------------------------+ | | | 1. Facebook server sends VoIP push via APNS | | - High-priority, immediate delivery | | - Bypasses Do Not Disturb, Low Power Mode | | | | 2. iOS wakes app instantly (even if force-quit) | | - didReceiveIncomingPushWithPayload: called | | - App gets ~30 seconds execution time | | | | 3. App can: | | - Activate audio session | | - Start microphone capture | | - Stream audio to servers | | - Optionally show CallKit UI (or suppress) | | | | 4. No user interaction required | | - Works in background | | - Works when device locked | | - Works when app not running | | | +---------------------------------------------------------------+
Technical Evidence
Recovered code and configuration from binary analysis
Audio Embeddings for Ad Targeting
// Audio capture → ML classification → Ad targeting
FBMediaAnalyzerXRayInput (0x01c91220)
→ XRay ML Model (100 audio concepts)
→ musicEmbeddingsForEditingAttachment
→ CreateInspirationEditingAttachmentMutation
→ graph.facebook.com (user profile update)Audio bypass called from FBMessagingAnalyticsCustomizeEventPayload. 50,700+ captures per session.
Audio Category Spoofing
// Declared category (no mic indicator)
AVAudioSessionCategoryAmbient
// Actual runtime category (mic active)
AVAudioSessionCategoryPlayAndRecordDynamic category switching at runtime. Declares ambient (no indicator) but activates PlayAndRecord (mic active).
This is just the beginning
Explore the full investigation with 107 technical reports, 50+ Frida scripts, and detailed runtime capture logs.