Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why can we still crack snapchat photos in 12 lines of Ruby?

security.stackexchange.com

Post reply on HN
Print view View original

21–30 of 38 posts

Re: Why can we still crack snapchat photos in 12 lines of Ruby?

#21

Post by e12e »

Stealth- wrote: post #2

I don't totally see the point to these arguments. The inherent nature of the technology we have means that if they can view it once, they can view it as long and as many times as they want. Anything trying to restrict that is just futile -- look at DRM. Snapchat has never given that particular illusion of privacy. As the most common and basic example, it has absolutely no way of stopping people from simply taking a s…

> I don't totally see the point to these arguments.

Yes and no. The encryption key is fixed? Why not use a session key that is (nominally) ephemeral to the running snapchat process at least?

> if they can view it once

I have a camera and a phone. I can record anything displayed on my phone forever regardless of technology, and so can a three year old. Especially for "sensitive" snapchats, the "analog hole" (aka: a human has to be able to view it for it to be visual communication) renders all these ideas moot. It has absolutely nothing to do with "clever" drm-like hacks.

Re: Why can we still crack snapchat photos in 12 lines of Ruby?

#22

Post by e12e »

girvo wrote: post #16
kartikkumar wrote: post #12

Forgive my ignorance, but why does SnapChat maintain a local cache beyond the 10-sec limit in the first place? Why don't they delete the photo and overwrite the disk space so that the photo is pretty much unrecoverable? Is it simply that this is too cumbersome to implement? Are there any technical restrictions? I tried Googling the issue and just came across the wave of articles that covered the discovery of the fact…

I wonder if you'd even have block level access to storage to pull that off through mobile APIs?

Well, it runs on Android? And you can compile your own kernel, and install google apps (or even run it in an emulator, anyway)... so... game over (wrt access to whatever is written to disc (or ram...))...

Re: Why can we still crack snapchat photos in 12 lines of Ruby?

#23

Post by e12e »

rplnt wrote: post #10

How would one solve this? One solution seems to be to generate key for each user and store the public keys on the server. If there is need to access the images on the server, encrypt them with a server key and then re-encrypt with the recipients' public key. Are there some problems with this approach (like some functionality of snapchat wouldn't work with this)?

You could improve (but not solve) the problem of raw access to data. But that does nothing wrt solving the "problem" of recipients storing a permanent copy of received snaps -- all they need is a camera.

It's a little like the old (tv series) adage of don't discuss crime in a car -- it's easy to place a bug in a car, so assume that it's bugged, if you have reason to fear someone's bugging you. Even if you're using encrypted phone/voip-chat -- that won't help squat if there's a microphone in the vicinity that can pick up both ends of the conversation...

Re: Why can we still crack snapchat photos in 12 lines of Ruby?

#24

Post by wlesieutre »

StavrosK wrote: post #9
gaius wrote: post #4

Earlier quoted context omitted.

Actually it does attempt to do that - it requires you keep your finger on the screen while viewing so you can't perform whatever the screenshot command is. Which is lame but that's not the point - their selling point is that they do claim the images are transient. I'll wager 90% of their traffic is images people would not want made public, and some of it will be technically illegal.

What's the point of that? I just tried it, and I can take a screenshot fine with one finger on the screen.

It used to be that taking a screenshot briefly stopped the touch event, so it could notify the sender when you took a screenshot.

iOS 7 fixed that bug, but added an official way for apps to detect screenshots. I would guess snapchat has just hung on to their old interface out of tradition, since it still works. It just doesn't have anything to do with screenshots anymore.

Re: Why can we still crack snapchat photos in 12 lines of Ruby?

#25

Post by scott_w »

ZoFreX wrote: post #18

I don't fully understand this issue. I understand that you are never going to be able to stop the intended recipient keeping the image - that's trivial just with a screenshot, and anyone even capable / caring enough to run the linked code is going to defeat any further obfuscation you pile on. What isn't clear to me from the link is: Is this same encryption the only protection applied to "snaps" that are in-flight? I…

My understanding is, because they're kept on the disk, other apps can access them with no extra permissions - thus the reason they're "encrypted".

If you know the key, and because Snapchat will have to know where the files are, malware developers can write apps that scan the image directory, decrypt the files then send them to their own service.

Re: Why can we still crack snapchat photos in 12 lines of Ruby?

#26

Post by neohaven »

girvo wrote: post #16
kartikkumar wrote: post #12

Forgive my ignorance, but why does SnapChat maintain a local cache beyond the 10-sec limit in the first place? Why don't they delete the photo and overwrite the disk space so that the photo is pretty much unrecoverable? Is it simply that this is too cumbersome to implement? Are there any technical restrictions? I tried Googling the issue and just came across the wave of articles that covered the discovery of the fact…

I wonder if you'd even have block level access to storage to pull that off through mobile APIs?

Unless there are COW mechanisms in place, simply pulling characters from /dev/{,u}random and scribbling over the original file should work well enough for the purpose of overwriting after the 10 second window.

Re: Why can we still crack snapchat photos in 12 lines of Ruby?

#27

Post by StavrosK »

wlesieutre wrote: post #24
StavrosK wrote: post #9

Earlier quoted context omitted.

What's the point of that? I just tried it, and I can take a screenshot fine with one finger on the screen.

It used to be that taking a screenshot briefly stopped the touch event, so it could notify the sender when you took a screenshot. iOS 7 fixed that bug, but added an official way for apps to detect screenshots. I would guess snapchat has just hung on to their old interface out of tradition, since it still works. It just doesn't have anything to do with screenshots anymore.

Ah, that makes sense, thank you.

Re: Why can we still crack snapchat photos in 12 lines of Ruby?

#28

Post by habosa »

I've worked with the unofficial Snapchat API a lot, and I've had the same thoughts. Basically Snapchat used AES ECB encryption with a symmetric key hardcoded into their binary. That's not a good idea, but its also better than nothing. Their api requests are all sent with a generated key parameter that takes 3 steps to make but really boils down to security by obscurity.

Snapchat made these security decisions long before anyone had any interest in "cracking" the app, and now I imagine they are looking for a way to get rid of this legacy code without breaking the millions of installed clients out there. It's an interesting problem and for now I'm having fun hacking on the API. If you're a Java person, check out my JavaSnap library which lets you send and receive Snaps.

Re: Why can we still crack snapchat photos in 12 lines of Ruby?

#29

Post by habosa »

ZoFreX wrote: post #18

I don't fully understand this issue. I understand that you are never going to be able to stop the intended recipient keeping the image - that's trivial just with a screenshot, and anyone even capable / caring enough to run the linked code is going to defeat any further obfuscation you pile on. What isn't clear to me from the link is: Is this same encryption the only protection applied to "snaps" that are in-flight? I…

Yes the same encryption is on in-flight snaps. You could absolutely set up something like that.
Post reply on HN