More Details On The 3rd-Party Apps That Led to Snapchat Leaks

Yesterday we posted a link to Computerworld's reports that (unnamed) third-party apps were responsible for a massive leak of Snapchat images from the meant-to-be-secure service. An anonymous reader writes with some more details: Ars Technica identifies the culprit as SnapSaved, which was created to allow Snapchat users to access their sent and received images from a browser but which also secretly saved those images on a SnapSaved server hosted by HostGator. Security researcher Adam Caudill warned Snapchat about the vulnerability of their API back in 2012, and although the company has reworked their code multiple times as advised by other security researchers, Caudill concludes that the real culprit is the concept behind Snapchat itself. "Without controlling the endpoint devices themselves, Snapchat can't ensure that its users' photos will truly be deleted. And by offering that deletion as its central selling point, it's lured users into a false sense of privacy."

Comments

Excuse me while..

[Anonymous Coward]

I don't feel sorry for those who thought this was seriously secure, and two, who the hell sends naked pictures of themselves and actually thinks other people won't see them? 1999 called and it wants it's noobs back.

Re:Excuse me while..

[houstonbofh]

A lot of the people falling for it were not here in 1999...

Re:Excuse me while..

[Calydor]

Which means it has been like this for ALL OF THEIR LIVES.

At least old people have the excuse that it's relatively new to them.

Re:Excuse me while..

[Lehk228]

if they are 15 and under they should not be taking nude photos at all!

Re:Excuse me while..

[TWX]

I don't feel sorry for those who thought this was seriously secure, and two, who the hell sends naked pictures of themselves and actually thinks other people won't see them? 1999 called and it wants it's noobs back.

See, I can feel some mild sympathy, basically pity, for those that were stupid enough to think that something electronic and stored in a common format over a common communications medium was secure. That doesn't mean that don't assign at least some blame for their circumstances though.

This has been a problem since well before 1999. Naked pictures were exchanged on BBSes and on Usenet since the inventions of the scanner and the digital camera. The only difference is that it's easier than ever to do that distribution now, and sharing requiring human interaction has been supplemented by software that seeks out and stores such content.

Until the technology has actually matured there's no safe solution. Even computer professionals don't necessarily understand all aspects of all of the software that could have access to the content on a user's electronic devices; simple users literally have no chance.

Re: Excuse me while..

[Anonymous Coward]

Even if you were to "..control the endpoint device..." in the sense I read (locked down hardware, software), what's to prevent someome from simply taking a picture of the image being displayed using an independent camera?

The fact of the matter is, once data is shared in the analog, there's plenty of independent technologies that can capture a rendition of the data and there will be for the forseeable future (quantum entanglement has come a long way but we're not sharing nudes using the principle, *yet*). They may no be perfect and may be lossy, but they're good enough to be damaging in this context.

Re:Excuse me while..

[Kjella]

and two, who the hell sends naked pictures of themselves and actually thinks other people won't see them? 1999 called and it wants it's noobs back.

Teens who want to get laid. Like it or not, cell phones and social media has taken over a lot of the real-world interaction we used to have as teens. Mainly because I didn't have a cell phone until my late teens, much less a camera phone and nothing like social media. A lot of the flirting and teasing that used to happen in dark corners at parties is now happening through texting and sexting online. Not to mention the upkeep of an ongoing relationship, if you wanted to get more graphical than you'd say over a fixed phone line in the hallway you had to hook up in person. Today you're more expected to keep it up all the time, even if you're apart which means sending naughties on Snapchat and such. Yes, sometimes it backfires badly but people in love won't believe their love will stab them in the back. And while I'm pulling this statistic out of my ass, I think most personal photos most of the time aren't shared with anyone but the intended recipient and aren't abused. And I think that still holds true even though these 200k pics leaked.

Re:Excuse me while..

[drnb]

"I don't feel sorry for those who thought banks were seriously secure, and two [where's "one?"], who the hell sends dollars to banks and actually thinks other people won't steal them? 1999 called and it wants it's noobs back."

Banks are regulated by the government. Bank deposits are insured by the government. When banks get robbed depositors do not lose money. If you want to refer to "noobish" days when depositors were vulnerable you have to go back long long before 1999.

Re:Excuse me while..

[wvmarle]

Agreed with the "should not" part.

However "should not" and "not doing" are two different things - especially for exactly kids that age. It's the age of self-discovery, of rebellion, doing things they know they shouldn't do, without yet realising the consequences.

In my time (I was that age in the late 1980s), taking nude pics of oneself and sending it to school friends was just not an option. That's probably the only reason it didn't happen back then, or any time before the early 2000s - the time web cams became ubiquitous, and instant digital shots could be made from the privacy of one's bedroom, with little to no chance of parents finding out. Nowadays of course web cams have been replaced by mobile phones, making it even easier.

It is more reasonable to understand that there are always kids that actually do this, trying to stop them is futile. Instead teaching general computer security as part of modern day computer lessons would be the way to go. One major part should be to have all people understand that if you can see a picture, you can save that picture, period. No matter what the app proclaims. It may be hard, you may not be able to pull it off yourself, but it can be done, and as a result those pics and other data may end up where you don't want them to.

Re:Excuse me while..

[wvmarle]

Banknotes are pretty anonymous, if someone steals a banknote from me, that sucks as I lose some money, however if he shows it to someone else there's no additional harm to me.

Now compare that to digital nude photos, especially the ones with the person's face in it.

Re:Nice article

[CaptainDork]

Some of the photos were taken by minors. Kids often use poor judgement.

Adults looking for those photos have no excuse.

Assuming you're not a jerk looking to exploit children, then it's clear you want adult pornography.

Try Google.

Re:Nice article

[wiredlogic]

A healthy percentage of those pictures are going to be of underage teens. They aren't going to be as readily distributed as the celeb leaks because of the real threat of jail time and a ruined life for anyone attempting it.

So wait-- where's the outrage?

[Anonymous Coward]

Where are all the Lovejoy Law paternalists who normally go after tor and p2p services? Shouldn't they be going after Snapchat for the same reason?

The rules are the problem

[fermion]

Collecting personal information on users is the status quo. All backends, be it google, apple, ms, collect information on users. It is how they make money and 'improve the product'. So instead of being in a position where everyone can agree that private information is private, we live in a world where we have to really work to understand what information is private, and what isn't. We see this with law enforcement and text messages. Most would say they are private, but law enforcement says they are public information. It is a small jump from text messages to photo sent to another person. If information collection were not the norm for everyone, then perhaps we could be upset that private information is being collected. But the web site provides a service, and of course it is going to take it's cut, in the forms of saving photos, for providing that service.

This is the way the web works. Service in exchange for private information. If it were 2000 it might be surprising. But it is not. And most everyone who is using snapchat has grown up in a world where such is standard mode of operation.

Re:Nice article

[sumdumass]

I'm currious if anyone is being exploited in the sense of exploiting children if they take their own pics and you end up seeing them.

I'm not saying it is ok to view them or anything, I'm just under the impression that the exploitation comes from children being forced or enticed into the photos and the viewer while not participating in the actual act, it enabling it by creating demand. So if a child takes a photo of themselves for their own reasons, is anyone actual being exploited?

Or is that a legal term that applied in all situations regardless of any inherent or lack of logical connection?

Web Server 101

[Anonymous Coward]

"...was created to allow Snapchat users to access their sent and received images from a browser...

"...but which also secretly saved those images on a SnapSaved server

Uh, hold up there, genius Snapchat users. Perhaps this is oversimplifying a bit, but let me remind you how a server works .

You see, images are uploaded to server storage in order to be served to your browser as you so deftly requested to access at a later time...you know, with a browser.

What the hell do you mean "secretly" saved?!?

I suppose the rest of the worlds servers magically save their images nowhere. And totally in secret so no browser could find it, right?

And yet you're now shocked and appalled to find images all over your Snap Saved server.

SMFH

IDWISOTT

[pushing-robot]

Ars Technica identifies the culprit as SnapSaved, which...secretly saved [users'] images on a SnapSaved server

In related news: Mysterious Twitter-related injuries traced to users of popular addon service TweetAndWeHitYouWithASpanner.com

(and why in god's name does a service like SnapChat have an API?)

Re:Nice article

[CaptainDork]

Good question:

"Though their laws were created to protect minors from exploitation caused by others, states are prosecuting minors under child pornography statutes for sending nude or otherwise lurid self-portraits, even when the minors sent the selfies without coercion. The common quirk in the laws is that there is no exception for taking or distributing sexually explicit pictures of oneself. Thus, a high school student sending a racy seflie to a boyfriend or girlfriend could subject both themselves and the receiver to prosecution for child pornography. If the picture makes its way around other social circles through online or direct sharing, anyone who received or distributed the photo could also find themselves open to charges."

Re:A Novel Idea....

[russotto]

Don't take naked pictures of yourself...

Why not? Looking at them is going to hurt you a hell of a lot more than it hurts me.

film at 11

[Hognoxious]

Ill-conceived idea turns out to have been badly implemented. Film at 11.

Re:Nice article

[dcollins117]

I'm currious if anyone is being exploited in the sense of exploiting children if they take their own pics and you end up seeing them.

Not in my view.

I'm just under the impression that the exploitation comes from children being forced or enticed into the photos and the viewer while not participating in the actual act, it enabling it by creating demand.

It's funny how Hollywood claims that downloading music and movies is destroying the entertainment industries, while the think-of-the-children crowd says downloading photos somehow "creates demand". I suspect both sides are just making shit up to bolster their particular agendas.