Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse Engineering Snapchat: Obfuscation Techniques

hot3eed.github.io

Post reply on HN
Print view View original

141–150 of 180 posts

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#141

Post by historyremade »

the_duke wrote: post #126
hn_throwaway_99 wrote: post #56

I'm curious, can anyone recommend any techniques (or companies providing solutions) for attempting something similar with javascript in a browser calling an API? Obviously it's much more difficult to obfuscate an algorithm for generating a client token in JS than it would be in assembly, but I'm just curious if anyone has tried any form of "lock down my API so it's only callable from the web front end I provide" obfu…

You can study the Instagram or TikTok web versions for inspiration. Both use some wacky methods for request signing that include encrypted code, obfuscated control flow, hashing the browser environment, ... Assembly obviously allows for much more powerful obfuscation than Javascript. Webassembly is somewhere inbetween, but a viable path since it is pretty universally supported by now. Networks requests can be inspect…

Other methods out there to hide network requests in-browser.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#142

Post by ta17711771 »

Spivak wrote: post #129
RNCTX wrote: post #84

Earlier quoted context omitted.

Because Snapchat is ultimately an application designed to trade in porn of amateurs including (and perhaps especially) teenagers. They have a vested interest in playing dumb to that fact. They can't really do so if the content escapes out into the wild and shows up in congressional hearings, lawsuits, FBI investigations, DOJ reports, etc.

That was Snapchat maybe for like the first year after its launch. It's just a normal semi-ephemeral chat app now where you keep steaks going with your friends and screenshotting is similar to liking.

Orrrrrr you just got older?

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#144

Post by 3eed »

jwyatt1995 wrote: post #111

How would one go about understanding the content of this write-up? Even after the first paragraph it begins to go completely over my head.

You need some assembly background, then OWASP's guide[1], has all basics.

[1]: https://github.com/OWASP/owasp-mstg

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#145

Post by the_duke »

historyremade wrote: post #141
the_duke wrote: post #126

Earlier quoted context omitted.

You can study the Instagram or TikTok web versions for inspiration. Both use some wacky methods for request signing that include encrypted code, obfuscated control flow, hashing the browser environment, ... Assembly obviously allows for much more powerful obfuscation than Javascript. Webassembly is somewhere inbetween, but a viable path since it is pretty universally supported by now. Networks requests can be inspect…

Other methods out there to hide network requests in-browser.

Sure, you could do all kinds of things. Using GET requests with a encrypted payload in the URL, websockets with some wacky custom protocol on top, WebRTC shenanigans, ...

I haven't seen anything like that in the wild, though.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#147

Post by trishume »

One thing I'm curious about is what they do to try to stop you from just ripping out the obfuscated token generation library and setting up a harness to run the whole thing in https://www.unicorn-engine.org/ or something. Like presumably they don't compile their whole app with obfuscation and it's just some library that's linked in with some kind of stable-ish API contract with the rest of the app. I wouldn't be surprised if they do interesting things to try and stop you from ripping it out and it'd be cool to learn what those are.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#148

Post by deanCommie »

meowface wrote: post #136
elevenoh wrote: post #58

Earlier quoted context omitted.

>What a blast that must be... though the immense amount of [invested|wasted] (take your pick depending on cynicism) effort spent on this game makes me a little sad. All of these brilliant minds just... cosplaying Sisyphus? And we wonder why such a high % of tech workers have a deep discontent & are desperately searching for meaning.

I would find that a very fulfilling and meaningful project, personally. I'd actually consider it way more fulfilling than working on the core product, which likely mostly involves trying to think of and implement clever ways to expose users to ads and sponsored content, and otherwise try to directly and indirectly monetize users. Here, the goal is to prevent phishers, fraudsters, scammers, spammers, catfish, imperson…

> Here, the goal is to prevent phishers, fraudsters, scammers, spammers, catfish, impersonators, malware spreaders, etc. from running amok in a somewhat unprecedented way by tricking users en masse into thinking they're really receiving photos/videos in real-time, using automated tooling. My understanding is this heavy degree of obfuscation (combined with other anti-tampering tactics) has gone a very long way to mitigate a huge amount of abuse.

Which is STILL in the service of trying to expose users to ads and sponsored content.

I find it sad that people in our industry are so easily distracted by the technical challenge du jour without looking at the bigger picture of what their work is in service of, which was OP's point.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#149

Post by ponker »

deanCommie wrote: post #148
meowface wrote: post #136

Earlier quoted context omitted.

I would find that a very fulfilling and meaningful project, personally. I'd actually consider it way more fulfilling than working on the core product, which likely mostly involves trying to think of and implement clever ways to expose users to ads and sponsored content, and otherwise try to directly and indirectly monetize users. Here, the goal is to prevent phishers, fraudsters, scammers, spammers, catfish, imperson…

> Here, the goal is to prevent phishers, fraudsters, scammers, spammers, catfish, impersonators, malware spreaders, etc. from running amok in a somewhat unprecedented way by tricking users en masse into thinking they're really receiving photos/videos in real-time, using automated tooling. My understanding is this heavy degree of obfuscation (combined with other anti-tampering tactics) has gone a very long way to miti…

Are you saying you shouldn’t help an app that exposes users to ads prevent people from running automated fishing-for-nudes campaigns that have been used in the past to bully teenagers into suicide?

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#150

Post by ponker »

trishume wrote: post #147

One thing I'm curious about is what they do to try to stop you from just ripping out the obfuscated token generation library and setting up a harness to run the whole thing in https://www.unicorn-engine.org/ or something. Like presumably they don't compile their whole app with obfuscation and it's just some library that's linked in with some kind of stable-ish API contract with the rest of the app. I wouldn't be surp…

Why wouldn’t they obfuscate the whole app?
Post reply on HN