Show HN: Snapception – Intercept all snapchats received over the network • Hacker News Board

Re: Show HN: Snapception – Intercept all snapchats received over the network

#81

Post by johnsoft » Tue, Oct 14, 2014, 2:43 PM UTC

joelanders wrote: post #80

ris wrote: post #77

Earlier quoted context omitted.

Totally different incentive. Spotify only needs protection that's enough of a pain the the ass to make it easier to just get the content from somewhere else or perhaps just pay the $n.99 for it. Snapchat is full of (supposedly private) information that is not available anywhere else. Attackers will be far more determined.

See links for a bit of reading about how hard it is to break DRM on Spotify or Netflix. They're doing a lot more than Snapchat. The difference between "you just need to reverse engineer the HTTP API to make a 3rd-party client" and "you need to run IDA Pro and PANDA and whatever else" is significant. The latter exploit would have far less reach. [1] http://moyix.blogspot.de/2014/07/breaking-spotify-drm-with-p... [2] h…

I read through the Spotify article, and if I understood it correctly, you don't need to run QEMU+PANDA to get at the unencrypted stream. That was just the method the author chose to analyze the running code. He tracked every memory read and write made by the CPU, and looked for byte distributions that looked like encrypted data, and found the decryption function at address 00719b84. He then located that code inside the Spotify binary, at 0x0042e2ed.

Once you know that, you don't need to repeat the initial analysis every time. You can just set up a hook to record all the data that flows through that function after it's decrypted.

Re: Show HN: Snapception – Intercept all snapchats received over the network

#82

Post by joelanders » Tue, Oct 14, 2014, 3:40 PM UTC

johnsoft wrote: post #81

joelanders wrote: post #80

Earlier quoted context omitted.

See links for a bit of reading about how hard it is to break DRM on Spotify or Netflix. They're doing a lot more than Snapchat. The difference between "you just need to reverse engineer the HTTP API to make a 3rd-party client" and "you need to run IDA Pro and PANDA and whatever else" is significant. The latter exploit would have far less reach. [1] http://moyix.blogspot.de/2014/07/breaking-spotify-drm-with-p... [2] h…

I read through the Spotify article, and if I understood it correctly, you don't need to run QEMU+PANDA to get at the unencrypted stream. That was just the method the author chose to analyze the running code. He tracked every memory read and write made by the CPU, and looked for byte distributions that looked like encrypted data, and found the decryption function at address 00719b84. He then located that code inside t…

Yes, that's my understanding as well; my other comment was sloppy. I'm unsure what was meant by "hook," though. Is that something you set up with the target process running under a debugger? That much privilege wouldn't be available to apps in an app store, right?

Re: Show HN: Snapception – Intercept all snapchats received over the network

#83

Post by the8472 » Tue, Oct 14, 2014, 8:49 PM UTC

waxjar wrote: post #76

the8472 wrote: post #70

Earlier quoted context omitted.

To protect in-flight data HTTPS encryption would be sufficient, since the attacker would have to MITM the connection and forge certificates instead of passively listening. But once it reaches the end device it is impossible for snapshat to deliver on its promises of ephemeral messaging. To display the data the device needs to be able to decrypt it. If it can be decrypted it can be copied. It's very much the same conc…

Was this relevant to the comment you replied to?

Yes, the point is that whether they use ECB or not makes no difference and thus can't be considered an "Oops" in this use-case.

ROT13, AES-ECB or some state-of-the-art crypto, it's all the same if the end-device needs to have the key to decrypt it anyway.

Re: Show HN: Snapception – Intercept all snapchats received over the network

#84

Post by johnsoft » Fri, Oct 17, 2014, 2:21 AM UTC

joelanders wrote: post #82

johnsoft wrote: post #81

Earlier quoted context omitted.

I read through the Spotify article, and if I understood it correctly, you don't need to run QEMU+PANDA to get at the unencrypted stream. That was just the method the author chose to analyze the running code. He tracked every memory read and write made by the CPU, and looked for byte distributions that looked like encrypted data, and found the decryption function at address 00719b84. He then located that code inside t…

Yes, that's my understanding as well; my other comment was sloppy. I'm unsure what was meant by "hook," though. Is that something you set up with the target process running under a debugger? That much privilege wouldn't be available to apps in an app store, right?

I meant "hook" in the most vague, hand-wavy sense of the word… anything from attaching a debugger at runtime, to modifying the binary so it automatically saves every song on your desktop. Obviously if you did something like the latter, no extra privilege would be needed.