Slashdot Mirror
Snapchat Users' Phone Numbers Exposed To Hackers
beaverdownunder writes with an extract from The Guardian, based on a security diclosure from Gibson Security: "Snapchat users' phone numbers may be exposed to hackers due to an unresolved security vulnerability, according to a new report released by a group of Australian hackers. Snapchat is a social media program that allows users to send pictures to each other that disappear within 10 seconds. Users can create profiles with detailed personal information and add friends that can view the photos a user shares. But Gibson Security, a group of anonymous hackers from Australia, has published a new report with detailed coding that they say shows how a vulnerability can be exploited to reveal phone numbers of users, as well as their privacy settings." Snapchat downplays the significance of the hole.
Not defending it, but the way Snapchat works is that you find your "friends" based on their phone number. Not amazingly brilliant, but that's why.
Photography, technology, and my dog Scout - http://mattstratton.com
People who give out their phone number to random Internet "services" that they are not customers of quite frankly deserve to be assaulted by telemarketers at all hours.
I don't respond to AC's.
just dial any area code.
This is verbiage of the initial Target press release. It sounds like my government talking to me.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
Especially when they basically have lied about the photos being deleted.
This is a non-issue.
Guess what, there are these big books that list names and the associated phone numbers.
But the phone numbers disappear after 10 seconds, right?
-Dave
THANK GOODNESS.
I was on edge all day today, wondering whether this concerned you.
Now that I have my answer, I can reset easy tonight.
You're welcome! I try! Sorry to stress you out, if only I had your phone number, I could keep you more up to date.
If you want news from today, you have to come back tomorrow.
Snapchat downplays the significance of the hole.
Isn't that their entire business model? Encourage more people to show of their naughty bits, therefore "downplaying the significance of the hole."
Silence is a state of mime.
For some of the younger readers: snapchat can't actually guarantee that your photo is deleted, so don't send anything you don't want all over the web, as ever.
For instance, anyone you send your photo to could screen capture your photo before it disappears, then pass that screen capture around.
Someone could also be between you and your recipient and be capturing everything you send.
Just so you know.
This is why I give out fake information. I have no reason to trust them so I give fake birthdays, fake phone numbers, fake addresses, fake names, what ever it takes. There is no reason to give them valid information. They are not to be trusted. You should pick and choose which information you want to give. Feel no obligation to answer a question truthfully just because some corporation asks you.
Obstificate.
But ONLY to "hackers", because they're like extraspecial and shit.
We give them out to friends, family, retailers, employers and for thousand of other reasons. The same goes for an email address.
Maybe only 17 queries are required. So even if they did to some kind of rate-limitting to prevent mass sucks of account names, they'd not stop the leak.
Number all the names you're interested in binary. If you have 75000 names, then the binary numbers will be 17 bits long. In the first query, do a lookup on the (75000-65536) contacts which have a set 16th bit. Store all the results. In the second query, do a lookup on all the 32768 contacts which have a set 15th bit, again, store those. In the third query, do a lookup on all the (16384+16384) contacts which have a set 14th bit, again store. After 17 queries, each contact will be returned in exactly the sets which correspond to the bits that are set in its binary number, but not the others. I.e. it will be uniquely identifiable.
Of course, the fix for the problem is for the doofera at snapchat to simply not return account names in the query, and this 4000x speedup will stop working as quickly as the original. However, anyone who's done a huge suck prior to that could leak it out, so it must be considered that your account name is known to everyone. Expect more targetted adverspamming...
Also FatPhil on SoylentNews, id 863
They are deleted the same way that any normal OS deletes a photo -- removing the reference information from the drive header, thus marking the bits the data occupies as safe for rewriting. Until the bits are written over, the file remains intact. There's nothing at all disingenuous about stating the photos are deleted. Perhaps they aren't subject to a null-0 or random data string erasure, but the file is still, by all general computing definitions, deleted. Or do you think that pressing the delete key makes the file on your computer also disappear forever?
who gives a crap about their phone numbers when their genitals are on display for the world to see.
The exploit according to Gibson is that Snapchat doesn't rate limit calls to "find_friends" to prevent massive automated brute force queries to get user details. In all fairness, considering the massive processing power behind Snapchat and the fact that your server is more likely to deplete its available resources before theirs (they're on Google App Engine apparently), there really should be rate limiting, even 1 request per second would make automated hammering non-viable.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Except they're not deleted like in a filesystem either.
According to GP's link, they merely get a ".nomedia" suffix, which stops Android from recognizing it. The file is still there, it takes up diskspace, is not going to be overwritten, they can be handled as normal files and renaming the files to remove the suffix restores it completely.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Considering the application runs on your phone, it pulls the number from the phone automatically. You also need to log into the application using a username and password so the phone number isn't used for anything really affecting your login. The phone number is used to help anyone that has your phone number in their contacts to find you on snapchat. Unless you make your snapchat username the same as your real name, there is nothing tying some random collection of letters to your phone number other than this DB.
Also, the previous exploit only worked if you knew a valid phone number that also happened to be a snapchat user.
The reality is that it is notoriously difficult to remove data from mobile devices simply because of the way data is stored using the 'wear levelling' technique. Since mobile devices are so regularly recycled for newer versions, this means that Snapchat photos that users believe no longer exist may be passed on to unknown third parties, and could be retrieved with forensic software.
I'm entirely nonplussed by your post.
Don't need 75000 queries to identif 75000 accounts
What do you mean by "identify"?
Number all the names you're interested in binary.
Snapchat usernames? Or names of humans you suspect of having a snapchat account?
In the first query, do a lookup on the (75000-65536) contacts which have a set 16th bit.
What kind of lookup are you talking about?
systemd is Roko's Basilisk.
Okay, after finding this (who the hell presents a security disclosure as a single PNG?!) I'll have another stab at what you're suggesting.
Suppose you have 75,000 phone numbers you want to try to link to snapchat accounts. Snapchat allows (or allowed) you to specify at least up to this amount of numbers in a single query - the only trouble is, it won't tell you which of the many results you receive is associated with which of the numbers you sent in the query.
By doing ~17 queries on subsets of the 75,000 numbers, you can associate the numbers with their snapchat accounts.
But couldn't you just send 75,000 single-number queries and get the associated accounts directly? That might be more queries but it would be a lot less data going back and forth.
systemd is Roko's Basilisk.