21–30 of 180 posts
Well at this point, you might as well run the binary in a Mach-O ARM emulator since Snap has seriously cranked up the reversing difficulty to level 10,000. I suggest anyone looking at this would need to use Corellium such that Snap has made it hard for almost anyone to get their private API.
How many of these tricks are off the shelf techniques? Seems like a tremendous effort.
Why not just track usage stats and ban clearly fake/high throughput users?
Snapchat is notoriously difficult to automate/spam. The goal is to get the X-Snapchat token. The most elegant solution is to find the secret in the binary and reverse the algorithm to generate tokens. Wouldn't it be easier to MITM the endpoint; set up a dummy server (which collects tokens) in front of a proxy that spoofs the DNS and TLS certs (may be easier on rooted Android than iOS). In my last attempt I gave up an…
My guess is the X-Snapchat is a one-time use token that changes on a per-call basis and may even been hashed to the actual data being sent in the API call. For example, if Snapchat is sending a pic that has a MD5 hash of X, the token somehow encodes that or other information so you cannot reuse that token. I’m confident the security engineering team at Snap has all kinds of white hat teams to prove and probe the secu…
These secret keys are there but heavily obfuscated and is nothing more than white-box cryptography which can be bypassed via emulation.
Philosophically I never gave much thought to securing app client code. Why not just track usage stats and ban clearly fake/high throughput users?
How many of these tricks are off the shelf techniques? Seems like a tremendous effort.
There are numerous commercial compilers (for C and C++) that specialize in obfuscation. I suspect they are using one because to do that level of obfuscation manually would make the source code unreadable.
What a blast that must be... though the immense amount of [invested|wasted] (take your pick depending on cynicism) effort spent on this game makes me a little sad. All of these brilliant minds just... cosplaying Sisyphus?
That sounds particularly devious.
This is an awesome write-up; I’m shocked at the level of effort that went into Snap’s obfuscation process. It implies that are entire teams of engineers out there whose sole job it is to play cat&mouse with reverse engineers and nothing more. Another comment mentioned that this effort is outsourced, so not only are there teams, but entire companies dedicated to this! What a blast that must be... though the immense am…
There's no doubt they have skilled security staff, but - as a company overall - they also grew very quickly.
How much of that obfuscation is intentional and how much might just be old code from a few years ago that nobody got around to removing? Before it was passed through obfuscation.