This is nothing, you can intercept the snap with wireshark and MITM:
Decrypting Android Snapchat images
21–30 of 65 posts
Re: Decrypting Android Snapchat images
#22Earlier quoted context omitted.
In the end the application needs a key to decrypt the storage. That key has to be stored somewhere on the device. On a rooted phone there is no place out of reach, so all they can do is make the storage obscure. Unless the hardware provides some inaccessible secure thingy there's not much they can do... I guess even if it did a script like that could access the secure thingy via USB debug as well. I don't think the d…
No matter how secure they store the photo, at the end the day a simple screenshot makes it all for nothing. It would be cool if Android had some API to disable screenshots.
[deleted]
Re: Decrypting Android Snapchat images
#23Lemme get this straight.. The password is hardcoded into Java code, so by decompiling it you can get that pw and break it? So essentially simple decompilation was all that was needed? That's weak.
What would have been some better alternatives to keep the encrypted files safe on the phone? Couldn't they have it call the server for a dynamic (safe) key?
Re: Decrypting Android Snapchat images
#24This work was done within the Sadosky Foundation in Argentina under a new program to research/enhance security for mobile users. World renown researchers are part of the team. Kudos to them!
Re: Decrypting Android Snapchat images
#25This is nothing, you can intercept the snap with wireshark and MITM: https://www.youtube.com/watch?v=CuW-Rz65zLs
You can do this for any app.... not just snapchat.
He sets his computer as a proxy between snapchat-app and snappchat-server. When I did this, Snapchat was certificate pinned to their server (it's been over a year though..so correct me if Im wrong).
This isn't an attack other people on the network can perform on you.
Re: Decrypting Android Snapchat images
#26How a company with $163M in funding is not able to put just a normal encryption into their app or hire someone who knows about encryption is out of my comprehension. We implemented a standard Blowfish encryption in university at a small project on the side and it was better than that. I'm by no means a cryptography expert, but you don't store keys on the device, they are generated dynamically. Storing them in a direc…
Because DRM does not work.
Re: Decrypting Android Snapchat images
#27> The key is generated from an MD5 hash using the Android ID concatenated to the string 'seems legit...'. That is a stellar decision. I wonder if there were application-specific constraints that prevented a more secure option.
In the end the application needs a key to decrypt the storage. That key has to be stored somewhere on the device. On a rooted phone there is no place out of reach, so all they can do is make the storage obscure. Unless the hardware provides some inaccessible secure thingy there's not much they can do... I guess even if it did a script like that could access the secure thingy via USB debug as well. I don't think the d…
The real problem is that snapchat promises something it can not technically deliver. Once a photo leaves your phone and is delivered to somebody else, you lost control over that photo.
It's precisely the same problem with DRM. You either lock down everyone's devices against their owners (a massive "do not want" situation) - and then you could still copy the data via the old-fashioned analogue hole (I'm not including the truly disturbing idea of adding implants to people's brains that force them to "delete" something they've seen) - or accept the inevitable fact that data that can be accessed is data that can be copied.
Quite frankly, Snapchat is a form of DRM, except it's marketed toward users in a way that makes it appear desirable.
Re: Decrypting Android Snapchat images
#28I don't understand why it says the IVs are unnecessarily stored as without them you could not decrypt the first block for each image properly.
Re: Decrypting Android Snapchat images
#29Nothing instills confidence in cryptographic code like the constants "bananas" and "seems legit...". I'd have hoped that anyone dealing with AES and block cipher modes would take the task a bit more seriously, even if the whole task is, in this instance, ultimately futile due to the lack of a trust root.
> Nothing instills confidence in cryptographic code like the constants "bananas" and "seems legit..."
Not to mention, even if the hardcoded password was somehow stored securely, using AES in ECB mode is insecure. ECB mode leaks information, particularly when applied to images: http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#...
Re: Decrypting Android Snapchat images
#30How a company with $163M in funding is not able to put just a normal encryption into their app or hire someone who knows about encryption is out of my comprehension. We implemented a standard Blowfish encryption in university at a small project on the side and it was better than that. I'm by no means a cryptography expert, but you don't store keys on the device, they are generated dynamically. Storing them in a direc…
Enlightens on then on how you would solve the issue. You have a program, and the program is storing data and the "attacker" (here really the user himself) wants to bypass the policies enforced by the application. The attacker has access to both the binary of the app and the data.
What would you encrypt the data with that the user himself cannot also access? Without a secure encryption hardware module, there's little you can do except add additional layers of obscurity.
You could encrypt all the data with a key derived off the user's password, and require the user to re-enter the key if the app stops. That too could be broken.
You could store the images in some odd obfuscated format that only the app can understand. That too could be broken after some time.
You could never store any images on disk at all and fetch them only when requested. Then you have the third-party services imitating the app.