Slashdot Mirror
Snapchat Users' Phone Numbers Exposed To Hackers
beaverdownunder writes with an extract from The Guardian, based on a security diclosure from Gibson Security: "Snapchat users' phone numbers may be exposed to hackers due to an unresolved security vulnerability, according to a new report released by a group of Australian hackers. Snapchat is a social media program that allows users to send pictures to each other that disappear within 10 seconds. Users can create profiles with detailed personal information and add friends that can view the photos a user shares. But Gibson Security, a group of anonymous hackers from Australia, has published a new report with detailed coding that they say shows how a vulnerability can be exploited to reveal phone numbers of users, as well as their privacy settings." Snapchat downplays the significance of the hole.
... would anyone give their real phone number to anyone who doesn't need it? I don't argue when a merchant asks for my phone number -- I just give them what they want. So any marketers who call me get to peddle their wares to whoever answers the pay phone at the Chevron station at the corner of Who-the-hell-knows St. and Nowhere-in-particular Ave., Seattle, Washington.
But they're going to keep your info safe from the NSA!!! LOLOLOLOLOL!!!
Stupid fucking hipsters and brogrammers.
What do you do next, hotshot?
People who give out their phone number to random Internet "services" that they are not customers of quite frankly deserve to be assaulted by telemarketers at all hours.
I don't respond to AC's.
OK, doesn't concern me.
If you want news from today, you have to come back tomorrow.
just dial any area code.
This is verbiage of the initial Target press release. It sounds like my government talking to me.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
This is a non-issue.
Guess what, there are these big books that list names and the associated phone numbers.
Who the fuck would put their real phone number in to some random application like Snapchat?
Seriously... Dumb much?
It's funny to watch the "normals" go through the idiocy we geeks saw 30 years ago.
But the phone numbers disappear after 10 seconds, right?
-Dave
How do you know that the parent isn't into big fat black hose up the ass?
Snapchat downplays the significance of the hole.
Isn't that their entire business model? Encourage more people to show of their naughty bits, therefore "downplaying the significance of the hole."
Silence is a state of mime.
I am shocked, shocked I tell you.
For some of the younger readers: snapchat can't actually guarantee that your photo is deleted, so don't send anything you don't want all over the web, as ever.
For instance, anyone you send your photo to could screen capture your photo before it disappears, then pass that screen capture around.
Someone could also be between you and your recipient and be capturing everything you send.
Just so you know.
This "Gibson" firm got their name in the papers, for what? Because a hacker "may" be able to see phone numbers with a username attached. So what? Where I live they still print peoples names and phone numbers in the phone book, which is available at the public library. What exactly bad is going to happen when someone decides to hack Snapchat to obtain those phone numbers?
Gently reply
This is why I give out fake information. I have no reason to trust them so I give fake birthdays, fake phone numbers, fake addresses, fake names, what ever it takes. There is no reason to give them valid information. They are not to be trusted. You should pick and choose which information you want to give. Feel no obligation to answer a question truthfully just because some corporation asks you.
Obstificate.
Thanks to the "Judge" its all legal and protected by US laws.
How sweet.
But ONLY to "hackers", because they're like extraspecial and shit.
We give them out to friends, family, retailers, employers and for thousand of other reasons. The same goes for an email address.
Beware,African American male. The Trailer Trash Crackers' elite hacking team can see the pictures you took of your clean, tight little black butthole -- and when that happens, they will destroy that cute little black butthole.
The Trailer Trash Crackers are the biggest and meanest prison gang in all parts of the US, mainly the deep south. I knew a scrawny, African American boy who took a lot of Snapchat pictures of his anus because he happened to have a girlfriend who had a fetish for the anuses of straight and dorky African American men.
And whoa, boy, once the Trailer Trash Crackers hacked that guy's Snapchat, it was like catnip to them. Not only did they want more, but they must have more, so they used their freedmen contacts on the outside to throw a potato-sack over the hapless little African American man, kidnapping him and gaping his poor lil' ol' rear end to Goatse proportions.
All that happened because a scrawny little white man thought he was smarter than the Prison Niggers, that the Snapchat "hack" was some nagging non-issue within his safe middle-class suburban house. Well, hoss, you got that all wrong now.
...Snapchat deleted her photo before it had finished downloading.
Maybe only 17 queries are required. So even if they did to some kind of rate-limitting to prevent mass sucks of account names, they'd not stop the leak.
Number all the names you're interested in binary. If you have 75000 names, then the binary numbers will be 17 bits long. In the first query, do a lookup on the (75000-65536) contacts which have a set 16th bit. Store all the results. In the second query, do a lookup on all the 32768 contacts which have a set 15th bit, again, store those. In the third query, do a lookup on all the (16384+16384) contacts which have a set 14th bit, again store. After 17 queries, each contact will be returned in exactly the sets which correspond to the bits that are set in its binary number, but not the others. I.e. it will be uniquely identifiable.
Of course, the fix for the problem is for the doofera at snapchat to simply not return account names in the query, and this 4000x speedup will stop working as quickly as the original. However, anyone who's done a huge suck prior to that could leak it out, so it must be considered that your account name is known to everyone. Expect more targetted adverspamming...
Also FatPhil on SoylentNews, id 863
who gives a crap about their phone numbers when their genitals are on display for the world to see.
I'm entirely nonplussed by your post.
Don't need 75000 queries to identif 75000 accounts
What do you mean by "identify"?
Number all the names you're interested in binary.
Snapchat usernames? Or names of humans you suspect of having a snapchat account?
In the first query, do a lookup on the (75000-65536) contacts which have a set 16th bit.
What kind of lookup are you talking about?
systemd is Roko's Basilisk.
Okay, after finding this (who the hell presents a security disclosure as a single PNG?!) I'll have another stab at what you're suggesting.
Suppose you have 75,000 phone numbers you want to try to link to snapchat accounts. Snapchat allows (or allowed) you to specify at least up to this amount of numbers in a single query - the only trouble is, it won't tell you which of the many results you receive is associated with which of the numbers you sent in the query.
By doing ~17 queries on subsets of the 75,000 numbers, you can associate the numbers with their snapchat accounts.
But couldn't you just send 75,000 single-number queries and get the associated accounts directly? That might be more queries but it would be a lot less data going back and forth.
systemd is Roko's Basilisk.