Feeds

Saucy Snapchat addicts EXPOSED: Exploit code to poke holes goes wild

Researchers go public with vuln claims, biz plays down risk

Top three mobile application threats

Updated Four months ago Gibson Security, a group of freelance vulnerability researchers, notified Snapchat that it had found serious flaws in the image-flinging service's security and privacy systems.

Having heard nothing back, the group has now released the details and some exploit code to back up its claims.

"Given that it's been around four months since our last Snapchat release, we figured we'd do a refresher on the latest version, and see which of the released exploits had been fixed (full disclosure: none of them)," said the group in a Christmas Eve missive to the security community.

Gibson studied Snapchat's Android app, and claims to have found flaws in its private API – the interface between the software and the Snapchat servers – that enable an attacker to decode and decrypt received data, and build a database linking users to their cell numbers.

It appears photos sent via Snapchat are encrypted using AES and a key hardwired into the application's code, allowing anyone to decrypt and view intercepted images. Separately, denial-of-service attacks are also possible, we're told.

"We were able to crunch through 10 thousand phone numbers (an entire sub-range in the American number format (XXX) YYY-ZZZZ - we did the Zs) in approximately 7 minutes on a gigabit line on a virtual server," the report states.

"Given some asynchronous optimizations, we believe that you could potentially crunch through that many in as little as a minute and a half (or, as a worst case, two minutes). This means you'd be railing through as many as 6666 phone numbers a minute (or, in our worst case, 5000!)"

The published exploit code can harvest these phone numbers, and a separate piece can register multiple bogus accounts for spamming purposes, we're told.

Snapchat's application allows its predominantly young users base to send up to ten second views of pictures before they are permanently deleted. Given the current fad for sexting, and the ensuing moral panic it has inspired, the service has a significant following among those who wish to send titillating titbits to a paramour.

This crucial young adult market has had VCs valuing the firm at $800m in June, although Evan Spiegel, Snapchat’s 23-year-old co-founder and CEO reportedly turned down a $3bn offer from Facebook and $4bn counter-bid from Chinese e-commerce conglomerate Tencent Holdings.

Snapchat's audience might be young and valuable, but they are also fickle, and if malware can use the newly released information then those kinds of valuation figures may evaporate like summer mist. ®

Updated to add

Snapchat has downplayed the significance of the reported security holes, and suggested it has checks in place to thwart a mass slurping of users' private data. On its blog today, the company stated:

This week, on Christmas Eve, a security group posted documentation for our private API. This documentation included an allegation regarding a possible attack by which one could compile a database of Snapchat usernames and phone numbers.

Theoretically, if someone were able upload a huge set of phone numbers, like every number in an area code, or every possible number in the US, they could create a database of the results and match usernames to phone numbers that way. Over the past year we’ve implemented various safeguards to make it more difficult to do. We recently added additional counter-measures and continue to make improvements to combat spam and abuse.

3 Big data security analytics techniques

More from The Register

next story
OpenBSD founder wants to bin buggy OpenSSL library, launches fork
One Heartbleed vuln was too many for Theo de Raadt
Got Windows 8.1 Update yet? Get ready for YET ANOTHER ONE – rumor
Leaker claims big release due this fall as Microsoft herds us into the CLOUD
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Patch iOS, OS X now: PDFs, JPEGs, URLs, web pages can pwn your kit
Plus: iThings and desktops at risk of NEW SSL attack flaw
Ubuntu 14.04 LTS: Great changes, but sssh don't mention the...
Why HELLO Amazon! You weren't here last time
Batten down the hatches, Ubuntu 14.04 LTS due in TWO DAYS
Admins dab straining server brows in advance of Trusty Tahr's long-term support landing
Red Hat to ship RHEL 7 release candidate with a taste of container tech
Grab 'near-final' version of next Enterprise Linux next week
Apple inaugurates free OS X beta program for world+dog
Prerelease software now open to anyone, not just developers – as long as you keep quiet
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.