Researchers publish Snapchat code allowing phone number matching

Re:Researchers publish Snapchat code allowing phone number m... by kaivi on Wednesday December 25, 2013 @06:07AM (#6962793)

I have been following with their API changes since it's major update in early 2013, and anyone could have exploited the phone lookup function easily, because everything is there in the open. I was surprised by how easy it was to decompile the Android app:

  public static boolean NEEDS_FUCKED_UP_NEXUS_422_SETTINGS()

  Timber.d("Looks like camprevs gon hide dis shit", new Object[0]);

There really is no way for the Snapchat team to completely prevent others from reversing their API. A client is the endpoint after all. In order to make things difficult for hackers, they could do the following: 1. Implement a custom protocol over TCP/IP, kind of what Skype does. 2. Obfuscate the hell out of it and everything else. 3. Roll out new updates with both APIs. 4. After a reasonable amount of time, break backwards-compatibility on server side.

[ Parent | on HN ]

Re:Researchers publish Snapchat code allowing phone number m... by gibsonsecurity on Wednesday December 25, 2013 @06:14AM (#6962805)

Hahahaha, I don't think making it harder to reverse would be any better, it would probably motivate people even more (deobfuscation is too much fun and fairly easy!).

They should really just focus on improving what they have and pushing clients towards a safer protocol slowly.

Snaps being stolen will always happen, but I do like the approach Instagram took to preventing spammers (getInstagramString(), it stopped everyone until they adapted!).

[ Parent | on HN ]

Re:Researchers publish Snapchat code allowing phone number m... by kaivi on Wednesday December 25, 2013 @06:53AM (#6962844)

Yep, but at least that would be fun, don't you agree?

I also wonder why didn't anybody set up a Snapchat bot yet: it could successfully impersonate multiple humans by forwarding snaps between pairs of unsuspecting users, gathering a lot of data that way.

[ Parent | on HN ]

Re:Researchers publish Snapchat code allowing phone number m... by rmccue on Wednesday December 25, 2013 @07:10AM (#6962857)

Actually, I know of one set up by a friend: snaproulettebot. You send a snap, and it sends you a random one back later from another user. Being called "snaproulettebot" makes it pretty obvious what it is, but you could do it in a more opaque way.

[ Parent | on HN ]

Re:Researchers publish Snapchat code allowing phone number m... by gibsonsecurity on Wednesday December 25, 2013 @06:59AM (#6962850)

Definitely, lol.

That's a pretty sneaky idea, I'm sure its possible with all the clients now available!

[ Parent | on HN ]

Re:Researchers publish Snapchat code allowing phone number m... by way66 on Wednesday December 25, 2013 @08:14AM (#6962937)

Could you explain what is the getInstagramString()? Thanks!

[ Parent | on HN ]