Man, I was hoping it was written in C, or at least C++, not Python.
Would certainly be overkill given the purpose it serves. A clean scripting language makes much more sense here for general consumption.
Show HN: Snapception – Intercept all snapchats received over the network
31–40 of 84 posts
Re: Show HN: Snapception – Intercept all snapchats received over the network
#32Connecting via a proxy and installing a CA means this is more of a tool for a snooping parent to intercept the snapchats of their kids while they are at home, rather than a scary-looking tool for intercepting the general stream of snaps (as it is made out to be).
Or, perhaps, as a tool for an individual user who, for miscellaneous reasons, wants to store his or her received snaps for use later. Again, the point, as given by the author and expanded by me, is that the Snapchat system contains a large security vulnerability, and that it is foolhardy to believe that snaps you send will be gone as soon as the recipient sees them.
Re: Show HN: Snapception – Intercept all snapchats received over the network
#33Connecting via a proxy and installing a CA means this is more of a tool for a snooping parent to intercept the snapchats of their kids while they are at home, rather than a scary-looking tool for intercepting the general stream of snaps (as it is made out to be).
Not necessarily. If you control the gateway, it's possible to transparently redirect outbound connections into your proxy. I used to do this back in the 90s to force our employees browsers through an ad-blocking proxy. Depending on your user base (kids?), it could be as simple as setting up an open wifi access point in a place where all other APs are password-locked. Edit: I just realized that this proxy requires the…
Yes, but they would be clued in because the SSL certificate wouldn't be valid unless they trust your CA.
Re: Show HN: Snapception – Intercept all snapchats received over the network
#34Really seems like more of a snapanopticon than a snapception.
Re: Show HN: Snapception – Intercept all snapchats received over the network
#35Snapchat use ECB as the cipher mode of operation: https://github.com/thebradbain/snapception/blob/781ebb13cd7e...
To see why this is a problem, see the ECB-encrypted Tux image on http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#...
Oops.
Re: Show HN: Snapception – Intercept all snapchats received over the network
#36> Intercept and decrypt all snapchats received over your network Somewhat misleading in light of: > Anyway, for Snapception to intercept your snapchats, you must be connected to the computer via a proxy and have installed its CA Interesting, nevertheless, because it exposes that: > they use one, hardcoded key for all video and image encryption
Their point was, I believe, that you could store copies of all snaps sent to you without anything on your device which snapchat could "check" to see if it was being interfered with.
Re: Show HN: Snapception – Intercept all snapchats received over the network
#37Snapchat use ECB as the cipher mode of operation: https://github.com/thebradbain/snapception/blob/781ebb13cd7e... To see why this is a problem, see the ECB-encrypted Tux image on http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#... Oops.
To be fair, that demo only works on an uncompressed bitmap image with large areas of solid color. It relies on the fact that identical input blocks encrypt to identical outputs, leading to visible repeating patterns. In a format like JPEG, which has an entropy-coding stage and all kinds of internal headers, the chance of encountering two identical blocks in a file is miniscule.
Of course ECB is still a very bad choice, because there are plenty of other ways to attack it. But recovering Snapchat images without the key would not be nearly as trivial as that example might suggest.
Re: Show HN: Snapception – Intercept all snapchats received over the network
#38Earlier quoted context omitted.
Out of curiosity, how come? Python runs on pretty much any platform you'd want to use and is much easier to develop in than C/C++.
I was hoping to see low level socket programming, you know, connect, close, open, bind, accept, recvfrom
All of those system calls are available in Python, FWIW.
Re: Show HN: Snapception – Intercept all snapchats received over the network
#39Doesn't seem to work. It's catching traffic but the snaps directory is empty.
Re: Show HN: Snapception – Intercept all snapchats received over the network
#40But snapchat updated its encryption just a couple of days ago: https://github.com/programa-stic/snapchat-decrypt
You will need the android id of the phone, which I don't think you can easily get as a man in the middle?