Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse Engineering Snapchat: Obfuscation Techniques

hot3eed.github.io

Post reply on HN
Print view View original

161–170 of 180 posts

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#161

Post by snazz »

RNCTX wrote: post #158
snazz wrote: post #133

Earlier quoted context omitted.

I think you wildly misunderstand how many people (teenagers included) who use Snapchat for PG-rated things exclusively. The end-to-end encryption (of snaps) and “disappearing” nature makes it work well for anything sensitive, but porn is certainly not the only thing people use it for. Also, any party to a conversation can use the report button to send the unencrypted message to Snap for review. They employ actual con…

Sounds like a bit of lipstick on a billion dollar pig. I'm sure we all remember their early days, their marketing material was straight out of any drunken frat boy's phone. I mean, pornstars say 90% of pornstars are selling content on Snapchat. https://www.wired.co.uk/article/premium-snapchat-adult-model...

I think that's true for the beginning, and I'm not disputing your statistic, but as a percentage of the total userbase today, people using it for non-porn-related purposes are the vast majority. Even if nearly 90% of porn stars use it, nowhere near 90% of Snapchat's users produce or consume adult content on the platform.

Do you use Snapchat? Do you have friends who do? It's the de facto communication standard for teenagers because of Quick Add and the gamified nature, not porn.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#162

Post by 3eed »

yamrzou wrote: post #85

How does one go about learning reverse engineering? Is it mostly by practicing? Are there any good up-to-date resources? I remember taking a reverse engineering course in the university where the professor didn't even bother to explain the basics, it was like black magic and left me frustrated, but I still feel amazed when I read blog posts like these.

https://news.ycombinator.com/item?id=23563556

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#163

Post by SXX »

saagarjha wrote: post #70
SXX wrote: post #67

Earlier quoted context omitted.

Apple don't need the source of your app, but some bytecode that they can optimize for target platform. As for making sure that certain app not using private frameworks they can just do it through the testing.

Bytecode is not required for applications targeting iOS. And I will note that the latter is fairly difficult to actually check in principle, and it's mainly enforced (actually, in certain cases it's not ;) ) in practice by the threat of consequences if they catch you doing it rather than testing.

So providing bitcode is still optional for release on App Store?

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#164

Post by [deleted] »

3eed wrote: post #117
underdeserver wrote: post #94

Earlier quoted context omitted.

Funny thing about things like that is that you can likely write tools to automatically deobfuscate, if you know the mechanisms. Of course, this takes time and effort, and is beyond most spammers' capabilities.

I'm gonna write about this in pt. 2. Basically you can use symbolic execution to recover the CFG[1] (using something like miasm), you can eliminate dead code, restore dynamic lib calls with an emulation, and whatever else. But the point is that it would take an incredible amount of work and co-operation between tools, and then you wouldn't have even begun understanding anything about the binary, which is a whole anot…

[deleted]

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#165

Post by icebraining »

whereistimbo wrote: post #48
dang wrote: post #45

Earlier quoted context omitted.

Your account's fine, but some comments were getting caught in a software filter. Sorry! I've marked it legit so this won't happen again. (Fortunately users vouched for all the affected comments, so they were unkilled before mods got to this thread. That's exactly what the vouch feature is for and I love to see it work so well.)

Hi dang, why is my latest submission flagged?

You should send that question to hn@ycombinator.com

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#166

Post by pixelrevision »

just-ok wrote: post #27

This is an awesome write-up; I’m shocked at the level of effort that went into Snap’s obfuscation process. It implies that are entire teams of engineers out there whose sole job it is to play cat&mouse with reverse engineers and nothing more. Another comment mentioned that this effort is outsourced, so not only are there teams, but entire companies dedicated to this! What a blast that must be... though the immense am…

Snap spent an awful lot of money on the facial recognition tech they acquired. I’d imagine the investment was somewhat worth it even it only slowed down competitors time to market.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#167

Post by RNCTX »

snazz wrote: post #161
RNCTX wrote: post #158

Earlier quoted context omitted.

Sounds like a bit of lipstick on a billion dollar pig. I'm sure we all remember their early days, their marketing material was straight out of any drunken frat boy's phone. I mean, pornstars say 90% of pornstars are selling content on Snapchat. https://www.wired.co.uk/article/premium-snapchat-adult-model...

I think that's true for the beginning, and I'm not disputing your statistic, but as a percentage of the total userbase today, people using it for non-porn-related purposes are the vast majority. Even if nearly 90% of porn stars use it, nowhere near 90% of Snapchat's users produce or consume adult content on the platform. Do you use Snapchat? Do you have friends who do? It's the de facto communication standard for tee…

No, I have no purpose for it, but I'm in my 40s. Twitter and Facebook are the only social media platforms I use.

To say snapchat has no basis in trading porn is to say that pornhub could relaunch itself tomorrow and say "oh sorry we're just a youtube knockoff now, we're not in the adult industry."

Well, it would still say pornhub in the URL, wouldn't it. And it would still be a site whose entire userbase was built on trading porn. That's what Snapchat built and used to grow its userbase, so trying to re-image themselves after getting the money is dubious at best.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#168

Post by tekknik »

ponker wrote: post #149
deanCommie wrote: post #148

Earlier quoted context omitted.

> Here, the goal is to prevent phishers, fraudsters, scammers, spammers, catfish, impersonators, malware spreaders, etc. from running amok in a somewhat unprecedented way by tricking users en masse into thinking they're really receiving photos/videos in real-time, using automated tooling. My understanding is this heavy degree of obfuscation (combined with other anti-tampering tactics) has gone a very long way to miti…

Are you saying you shouldn’t help an app that exposes users to ads prevent people from running automated fishing-for-nudes campaigns that have been used in the past to bully teenagers into suicide?

No, not this way. If my goal is really to push content to users I’d get a set of account and automate the sending/scraping using a device emulator. Ultimately their efforts are better spent elsewhere if this is the actual goal. In reality the goal is to attempt to keep people from reverse engineering the api so they can create a custom, ad free, client.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#169

Post by tekknik »

dylz wrote: post #39
just-ok wrote: post #27

This is an awesome write-up; I’m shocked at the level of effort that went into Snap’s obfuscation process. It implies that are entire teams of engineers out there whose sole job it is to play cat&mouse with reverse engineers and nothing more. Another comment mentioned that this effort is outsourced, so not only are there teams, but entire companies dedicated to this! What a blast that must be... though the immense am…

> It implies that are entire teams of engineers out there whose sole job it is to play cat&mouse with reverse engineers and nothing more Do you think the same thing of anti-spam teams too? This is pretty much just anti-spam/anti-abuse.

Personally I don’t see these as the same. These attempts to prevent RE are mostly moot as the machine needs to interpret the code, so therefore it must be valid code and some of this either bloats the binary or decreases performance. The user pays for these inefficiencies (and are therefore user hostile) and in the case of battery powered devices incur additional costs through premature battery wear.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#170

Post by dylz »

tekknik wrote: post #169
dylz wrote: post #39

Earlier quoted context omitted.

> It implies that are entire teams of engineers out there whose sole job it is to play cat&mouse with reverse engineers and nothing more Do you think the same thing of anti-spam teams too? This is pretty much just anti-spam/anti-abuse.

Personally I don’t see these as the same. These attempts to prevent RE are mostly moot as the machine needs to interpret the code, so therefore it must be valid code and some of this either bloats the binary or decreases performance. The user pays for these inefficiencies (and are therefore user hostile) and in the case of battery powered devices incur additional costs through premature battery wear.

Snap is not usually something the user scrolls through all day (akin to FB/Insta infinite scroll); it's typically send a message or nude/recieve a message or nude and then backgrounded.

There is a rare case where people watch clickbait ads for hours but that's usually plugged in laying in bed with nothing better to do

Post reply on HN