Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse Engineering Snapchat: Obfuscation Techniques

hot3eed.github.io

Post reply on HN
Print view View original

51–60 of 180 posts

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#51

Post by xuki »

zebraflask wrote: post #29
just-ok wrote: post #27

This is an awesome write-up; I’m shocked at the level of effort that went into Snap’s obfuscation process. It implies that are entire teams of engineers out there whose sole job it is to play cat&mouse with reverse engineers and nothing more. Another comment mentioned that this effort is outsourced, so not only are there teams, but entire companies dedicated to this! What a blast that must be... though the immense am…

I can't help but wonder if it's more of a "a little from Column A, a little from Column B" scenario. There's no doubt they have skilled security staff, but - as a company overall - they also grew very quickly. How much of that obfuscation is intentional and how much might just be old code from a few years ago that nobody got around to removing? Before it was passed through obfuscation.

I'd say they make it a priority to keep people from tampering with their code, and maybe maintaining the platform's integrity. They even ban people who use tweak on jailbroken iPhone/Android. I found these articles about avoid Snapchat detection a while ago, it's a cat and mouse game.

https://aeonlucid.com/Snapchat-detection-on-Android/

https://aeonlucid.com/Snapchat-detection-on-iOS/

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#52

Post by jor-el »

Some I see are surprised to see the level of obfuscation used in the application. Many pointed, many ingredients for the obfuscation used in the app are off-the-shelf and few of them can be said to be well known in the industry, but still there is a cost in integrating them into a product. Obfuscation is notorious in breaking things which should work normally (normal compilation process) and as a own goal making it hard to debug as well. Integrating, testing, debugging and difficulty in debugging production crash logs is a considerable cost.

That said, obfuscation is increasingly being used in mobile applications now. Check your banking application or some government applications, you will find obfuscation being used. With mobile applications getting richer and lot of code executing on the client side, makes it compelling case to secure applications by using obfuscation (as a defense-in-depth approach).

Open standards like OWASP MSTG [1] MSTG-RESILIENCE-9 recommend such approach.

  Obfuscation is applied to programmatic defenses, which in turn impede de-obfuscation via dynamic analysis.
[1] https://github.com/OWASP/owasp-masvs/blob/master/Document/0x...

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#53

Post by brendonjohn »

This is brilliant work, I'm hoping in part II we get to see it working against the API.

I reverse engineered this in a production environment. It took approximately 7 months to build a scalable solution.

The investigation on how to create the x-snapchat-client-auth token is brilliant. One day I hope to do a talk on what my old team did to circumvent it.

There's a painful gotcha on the homestretch for this token: You may be creating the token, but it's not obvious what you're supposed to be using the method to sign.

What do they use it for? As far as I could tell, it's so they can verify requests at the edge nodes of their network. When you provide a bad x-snapchat-client-auth, you get a near-instant 403.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#54

Post by __float »

zelly wrote: post #18
mox1 wrote: post #12

Earlier quoted context omitted.

Certificate pinning spoils that, no spoofing of certs with pinning. Cert (or hash of) delivered with app. If server cert doesn't match expected value coded into app, someone is messing with something, terminate connection.

Yes that complicates things. But if you can find the cert in the binary's data section, maybe you can patch it with your own.

This probably runs into the same issue mentioned in the article, where the checksums are wrong and you end up in an infinite loop.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#55

Post by sbuccini »

plausibility wrote: post #46
sbuccini wrote: post #15

I remember back in 2013(?) I went to a collegiate hackathon in Santa Monica. Evan Spiegel showed up to walk the floor and someone showed him how they had sniffed the API and did something interesting with it (forget the particulars now, getting old). If I recall correctly, Evan offered the kid a job on the spot but the kid turned him down. They've come a long way since then!

Was this perhaps LA Hacks [0] in 2014, or Hacktech [1]? Evan Spiegel attended LA Hacks, but I had someone who was attending Hacktech email me for help with the Snapchat API for their project. (I was part of Gibson Security, and published some early Snapchat API research [2] online in 2013) [0] https://en.wikipedia.org/wiki/LA_Hacks [1] https://medium.com/hacktech-2014/everyones-watching-hacktech... [2] https://gibson…

Almost certainly HackTECH; it was held in a mall in Santa Monica right by the beach. I’m almost sure Evan came but it wasn’t to give a formal talk, but rather take a pretty low-key stroll-through. Maybe my mind is playing tricks on me. I did attend LA Hacks as well but I think it was in 2015, it was in Pauley Pavilion for the first time.

Your research looks fascinating and sounds similar to what I remember of the hack. Might be the same person we’re talking about. Small world!

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#56

Post by hn_throwaway_99 »

I'm curious, can anyone recommend any techniques (or companies providing solutions) for attempting something similar with javascript in a browser calling an API? Obviously it's much more difficult to obfuscate an algorithm for generating a client token in JS than it would be in assembly, but I'm just curious if anyone has tried any form of "lock down my API so it's only callable from the web front end I provide" obfuscation.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#57

Post by nerdbaggy »

hn_throwaway_99 wrote: post #56

I'm curious, can anyone recommend any techniques (or companies providing solutions) for attempting something similar with javascript in a browser calling an API? Obviously it's much more difficult to obfuscate an algorithm for generating a client token in JS than it would be in assembly, but I'm just curious if anyone has tried any form of "lock down my API so it's only callable from the web front end I provide" obfu…

WASM would be a good option I believe

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#58

Post by elevenoh »

just-ok wrote: post #27

This is an awesome write-up; I’m shocked at the level of effort that went into Snap’s obfuscation process. It implies that are entire teams of engineers out there whose sole job it is to play cat&mouse with reverse engineers and nothing more. Another comment mentioned that this effort is outsourced, so not only are there teams, but entire companies dedicated to this! What a blast that must be... though the immense am…

>What a blast that must be... though the immense amount of [invested|wasted] (take your pick depending on cynicism) effort spent on this game makes me a little sad. All of these brilliant minds just... cosplaying Sisyphus?

And we wonder why such a high % of tech workers have a deep discontent & are desperately searching for meaning.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#59

Post by plausibility »

sbuccini wrote: post #55
plausibility wrote: post #46

Earlier quoted context omitted.

Was this perhaps LA Hacks [0] in 2014, or Hacktech [1]? Evan Spiegel attended LA Hacks, but I had someone who was attending Hacktech email me for help with the Snapchat API for their project. (I was part of Gibson Security, and published some early Snapchat API research [2] online in 2013) [0] https://en.wikipedia.org/wiki/LA_Hacks [1] https://medium.com/hacktech-2014/everyones-watching-hacktech... [2] https://gibson…

Almost certainly HackTECH; it was held in a mall in Santa Monica right by the beach. I’m almost sure Evan came but it wasn’t to give a formal talk, but rather take a pretty low-key stroll-through. Maybe my mind is playing tricks on me. I did attend LA Hacks as well but I think it was in 2015, it was in Pauley Pavilion for the first time. Your research looks fascinating and sounds similar to what I remember of the hac…

I did some more searching, and I think it was Hacktech then. According to [0], Evan dropped by because of the project by Ash Bhat and Ankit Ranjan, apparently some of the organisers called him since he lived nearby. Seems you were right.

[0] http://appstorechronicle.com/2014/01/exclusive-snapchat-hack...

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#60

Post by saagarjha »

3eed wrote: post #16
programmarchy wrote: post #3

How many of these tricks are off the shelf techniques? Seems like a tremendous effort.

OP here. About half are off the shelf. Joint functions, the breakpoint infinite loop, in-house memmove, the overflowing thing, those I haven’t read about anywhere before.

> the breakpoint infinite loop

This is a fairly standard debugging technique.

> in-house memmove

You sure they didn't just statically link a libc?

Post reply on HN