Feeds

Snapchat vows to shut its hole in wake of 4.6 million user data breach

Words like 'apologize' and 'sorry' notably absent

Top 5 reasons to deploy VMware with Tegile

Mobile image-sharer Snapchat has promised an update to its service to seal off a security hole that allowed hackers to harvest the account details of some 4.6 million users.

The company said that its update will allow users to opt out of the Find Friends system and prevent others from looking up their account information through address books. In doing so, users will no longer appear in results when others seek to match their address book numbers with potential Snapchat friends.

"When we first built Snapchat, we had a difficult time finding other friends that were using the service," Snapchat told users. "We wanted a way to find friends in our address book that were also using Snapchat – so we created Find Friends."

The move looks to close a security hole in the Snapchat service which left users subject to a "brute force" hacking process in which an attacker could build a database of contact information by uploading an archive of phone numbers to the service and saving those which returned links for Snapchat users.

Such methods were described by researchers at security firm Gibson Security, who claim to have notified Snapchat of the flaw several months ago. The company said that by exploiting flaws in the Snapchat API, the process of searching and collecting account information for mobile spam and other services could be largely automated.

Though initially dismissed by Snapchat as a "theoretical" flaw, the vulnerability was soon seized upon to build a partially secured archive of 4.6 million user names and phone numbers.

Snapchat said that in addition to implementing an opt-out for Find Friends, the company is updating its systems to help prevent automated brute force attacks or exploits.

According to security vendor AdaptiveMobile, the leaked numbers are largely concentrated to California and New York, with the two states accounting for some 2.3 million accounts. Other regions impacted include Illinois, Colorado, and Florida.

Snapchat accounts by state

Leaked accounts are largely confined to the coasts (source: AdaptiveMobile – click to enlarge)

Snapchat noted that no other personal data or user photos were collected in the attack, and CEO Evan Spiegel stopped short of issuing a mea culpa for the incident when speaking with The Today Show.

"I believe at the time we thought we had done enough," he said, "but in a business like this that is moving so quickly, if you spend your time looking backwards, you're just going to kill yourself." ®

Internet Security Threat Report 2014

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Oi, Europe! Tell US feds to GTFO of our servers, say Microsoft and pals
By writing a really angry letter about how it's harming our cloud business, ta
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Internet Security Threat Report 2014
An overview and analysis of the year in global threat activity: identify, analyze, and provide commentary on emerging trends in the dynamic threat landscape.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.