Facebook engineers discovered technique of adding read call log/SMS permissions during an app update without notifying the user. Was used in a production release (x-post /r/programming)

submitted by /u/nakilon to r/netsec
[link] [comments]