9 ms·

Snapchat Source Code GitHub Leak Caused by Bad iOS Update

85 points by koin0r 8y ago

mnx 8y ago
This article is not very information rich, but one thing is clear: this is not a github leak, the code was just posted to github by whoever got access to it. So the headline is pretty misleading.
- icedchai 8y ago
  Okay. So the code was "leaked" on Github. How is the headline misleading?
  - torstenvl 8y ago
    The headline is misleading because it implies the source code was already on GitHub. If the source was not already on GitHub, then a "GitHub Leak" of that source could not possibly be caused by a software error.
    - icedchai 8y ago
      It doesn't imply that to me.
      - _r_o_y_ 8y ago
        Just by reading the title my first though was somehow a iOS update caused a bug in GitHub that led to the source code leaking.
        asdkhadsj 8y ago
        I figured the iOS bug somehow leaked credentials that gave access to GitHub. Regardless, many of us agree that the title suggests GitHub as a central role to the leak. If, as other commenters say, it was just used as a file host.. it doesn't belong in the title imo. It's just there to pull in more views. It may as well been Piratebay.
      - jehlakj 8y ago
        The fact that it’s ambiguous is itself misleading. Typical headlines.
  - geoah 8y ago
    Cause probably many people (including me) assumed that "Github leak caused by bad ios" was the reason why snapchat's code was leaked.
  - zamadatix 8y ago
    Github has private repos for customers. When I first read the title I assumed it had something to do with breaking into one of those.
p410n3 8y ago
The DMCA request reads like its written by a 14 year old. ALL CAPS. LEAKED SOURCE: TAKE DOWN PLOX
- neuralk 8y ago
  Exactly what I was wondering about -- couldnt illegitimate DMCA requests be an attack vector to shut down a public GitHub repo temporarily? There wasn't much to the quoted DMCA request. Edit: I'm guessing there's enough in the redacted part of the notice to prove SC's identity. But I think the question of DMCA abuse remains.
  - deleted 8y ago
    [deleted]
  - ma2rten 8y ago
    Actually it could be and it is sometimes abused. You don't need to proof that you are the copyright holder to submit the request. Companies tend to err on the side of removing things to make sure they don't become liable for copyright violation.
  - threesquared 8y ago
    This happened to the SickRage project a while ago when a developer was not happy about the project being forked. The repositories were down for some time. https://www.reddit.com/r/sickrage/comments/6oep02/false_dmca_request_has_taken_our_repos_down/ https://www.reddit.com/r/sickrage/comments/6oep02/false_dmca...
    - jenscow 8y ago
      So, a developer of software geared towards piracy issues DMCA against OSS. face palm
  - p410n3 8y ago
    That happened before on other platforms, I know about steam and its workshop in particular.
peterkelly 8y ago
The user mentioned in the DCMA notice has a second repository containing what appears to be SnapChat source code, which hasn't been taken down. It's been forked 49 times so far.
- deleted 8y ago
  [deleted]
- netsharc 8y ago
  But forking on Github is useless, if the parent project gets memory-holed, your fork will disappear too. But git is a distributed version control system, so git clone before the takedown would help.
  - philipov 8y ago
    We can't know how many people cloned it, but we can guess that most of the people who forked it also cloned it.
  - joshribakoff 8y ago
    Off topic but that would be pretty bad if you forked code and did significant work for years only for it to randomly disappear overnight
    - metalliqaz 8y ago
      That's why you should always keep clones of your repositories hosted by a third party.
    - asdkhadsj 8y ago
      Yea I didn't know that this would happen. If I fork a repo and plan on maintaining it myself, I guess I have to fully clone it, removing the fork.
      - rpeden 8y ago
        It doesn't happen: https://help.github.com/articles/what-happens-to-forks-when-a-repository-is-deleted-or-changes-visibility/ https://help.github.com/articles/what-happens-to-forks-when-... If you fork a public repo and the original is deleted, your fork survives.
Drdrdrq 8y ago
What is the effect of this? Apart from some security through obscurity measures that might now be useless, what could the worst negative effect of this be? I can't imagine it could hurt Snapchat.
- deleted 8y ago
  [deleted]
- seren 8y ago
  Same potential damages from source code leaks : revealing secret projects in roadmap, security or privacy malpractices, lack or respect of SW licenses.
  - _r_o_y_ 8y ago
    Yeah definitely the SW licenses as SnapChat is mainly US so there probably won't be any real repercussions related to privacy.
- napolux 8y ago
  You can probably scavenge code looking for possible leaks and attack vectors. Plus (I didn't check the code) you can find some tokens/salts/whatever used internally, or new features already there and hidden, a/b tests, etc....
- Grue3 8y ago
  Don't these guys have a super-secretive work culture? Like, you can't even ask what your colleague from another building is currently working on. I'd imagine they'd be very displeased with this leak, and somebody probably got fired.
snehesht 8y ago
https://twitter.com/x0rz/status/1026735377955086337 https://twitter.com/x0rz/status/1026735377955086337
xevb3k 8y ago
I’m confused, did they somehow just include the source code in the app bundle? As a resource perhaps? Or can source code leak into the app through some other vector?
- akerro 8y ago
  Once I was hacking an android app to get free coupons. After some investigation I found out they decided to generate the same coupon for n-customers, the coupons were changed every day, the coupon was based on MD5 or SHA1 of generated deterministic value (based on customer ID and date). There were 32k possible coupons per day. App was checking if the account and coupon is valid on their server, but it was always valid as they used the same algorithms in the app and on server... The core of the application was written in C#, launched by Mono on Android. Java was compiled correctly with ProGuard (code obfuscator), but C# code was compiled in debug mode. C# in debug mode keeps variable/class/method names as they are in source code, leaves comments in the binary, binary file is bigger and slower. You can decompile it to compilable source code, literally. I managed to get incorrectly protected secret key (they used GPG to encrypt JWT to server lol), later I managed RE of their API, make my own app with identical UI and working coupons. This allowed me to get free coupons every day for next almost 2 years. There were several updates in Google Play since then, but they haven't changed the logic or anything, the app is still in debug mode and anyone can use it. What is interesting, they have also app for iOS which is not in debug mode. Consistency is the key. After I stopped using their services, I checked their ToS that you have to accept before registering and they prohibit app decompilation, but I never registered and never before read ToS, so it's OK for me ;) I wanted to report the problem but they have literally no contact information, I spent a few hours trying to find their contact details, Twitter is dead since 2014, no contact@ email, no contact form on website... nothing. Lesson for you: check if your apps are correctly compiled and secrets protected, there are tools for it. In my previous company we had a Jenkins job to test it before release.
  - SmellyGeekBoy 8y ago
    This sounds like fraud, is it wise to be admitting to this publicly?
Raphmedia 8y ago
Did anyone here take a look at the source? Anything we should be worried about?
- chedabob 8y ago
  It wasn't very exciting. It was only a tiny fraction of the whole source. Some UI controls, some headers for the lens engine and their job system.
  - Roland0ull 8y ago
    So this is not quite a big deal. Others do share the code for free to go in wide open.
  - deleted 8y ago
    [deleted]
- ythn 8y ago
  I wish we could see why such a seemingly simple app is 300 MB.
ythl 8y ago
On a side note, does anyone know why the app is 300 MB? Seems excessive for what is essentially a photo viewer.
curiousgal 8y ago
https://twitter.com/i5aaaald/status/1025563719877709825 https://twitter.com/i5aaaald/status/1025563719877709825 > The problem is that we tried to communicate with you but to no avail. The source code has been published on Github and I will publish it again until we get a response.
- dylz 8y ago
  Ah, it's an extortion attempt. Sad.
  - Rjevski 8y ago
    Couldn't have happened to a nicer company.
    - Gigablah 8y ago
      This says more about you than the company.
deleted 8y ago
[deleted]
apostacy 8y ago
This is a case of the Streisand Effect[1] in action. If anyone is really curious, it is called Source-SnapChat and it is all over Github. Github is going to have to mass delete these mirrors, and prevent anyone from re-commiting it anywhere. Snapchat sending DMCAs is not going to be enough. [1]: https://en.wikipedia.org/wiki/Streisand_effect https://en.wikipedia.org/wiki/Streisand_effect
- nathancahill 8y ago
  When specific repos are blacklisted on GitHub, they have a system that automatically flags uploaded forks. Not sure if/why they haven't blacklisted this codebase yet.
mediocrejoker 8y ago
No explanation on _how_ a bad iOS update leaked source code? Can't imagine Apple is too happy to be blamed for this with no details.
- cnowacek 8y ago
  I'm guessing that somehow a chunk of their source code got marked as "copy to the bundle" from within the project's build phase. One scenario I could think of this happening is a bug in a custom build script that was intended to copy other resources (images, sounds, etc.) to the bundle and copied an unintended directory containing the leaked source code as well.
driverdan 8y ago
If you're interested in it you can find other repos by searching Github for Source-SnapChat and Source-SCCamera.
welder 8y ago
I find it strange their app is all Objective-C and no Swift.
- stefanfisk 8y ago
  AFAIK neither does Spotify. Swift is nicer in a lot of ways, but it is still not as safe a bet as objc for large projects.
burger_moon 8y ago
Is it weird that all of their methods start with SC? I guess we do that a little bit for the product I work on but it's also just one product in a much larger company and part of an entire platform. Snap is just snap.
- bradenb 8y ago
  This is pretty common for Objective-C, I believe.
Bromskloss 8y ago
Well, what is the verdict? Was there anything interesting in the source code? Does having it publicly available matter at all?

85 points by koin0r 8y ago

mnx 8y ago

This article is not very information rich, but one thing is clear: this is not a github leak, the code was just posted to github by whoever got access to it. So the headline is pretty misleading.

icedchai 8y ago
Okay. So the code was "leaked" on Github. How is the headline misleading?
- torstenvl 8y ago
  The headline is misleading because it implies the source code was already on GitHub. If the source was not already on GitHub, then a "GitHub Leak" of that source could not possibly be caused by a software error.
  - icedchai 8y ago
    It doesn't imply that to me.
    - _r_o_y_ 8y ago
      Just by reading the title my first though was somehow a iOS update caused a bug in GitHub that led to the source code leaking.
      - asdkhadsj 8y ago
        I figured the iOS bug somehow leaked credentials that gave access to GitHub. Regardless, many of us agree that the title suggests GitHub as a central role to the leak. If, as other commenters say, it was just used as a file host.. it doesn't belong in the title imo. It's just there to pull in more views. It may as well been Piratebay.
    - jehlakj 8y ago
      The fact that it’s ambiguous is itself misleading. Typical headlines.
- geoah 8y ago
  Cause probably many people (including me) assumed that "Github leak caused by bad ios" was the reason why snapchat's code was leaked.
- zamadatix 8y ago
  Github has private repos for customers. When I first read the title I assumed it had something to do with breaking into one of those.

p410n3 8y ago

The DMCA request reads like its written by a 14 year old. ALL CAPS. LEAKED SOURCE: TAKE DOWN PLOX

neuralk 8y ago
Exactly what I was wondering about -- couldnt illegitimate DMCA requests be an attack vector to shut down a public GitHub repo temporarily? There wasn't much to the quoted DMCA request. Edit: I'm guessing there's enough in the redacted part of the notice to prove SC's identity. But I think the question of DMCA abuse remains.
- deleted 8y ago
  [deleted]
- ma2rten 8y ago
  Actually it could be and it is sometimes abused. You don't need to proof that you are the copyright holder to submit the request. Companies tend to err on the side of removing things to make sure they don't become liable for copyright violation.
- threesquared 8y ago
  This happened to the SickRage project a while ago when a developer was not happy about the project being forked. The repositories were down for some time. https://www.reddit.com/r/sickrage/comments/6oep02/false_dmca_request_has_taken_our_repos_down/ https://www.reddit.com/r/sickrage/comments/6oep02/false_dmca...
  - jenscow 8y ago
    So, a developer of software geared towards piracy issues DMCA against OSS. face palm
- p410n3 8y ago
  That happened before on other platforms, I know about steam and its workshop in particular.

peterkelly 8y ago

The user mentioned in the DCMA notice has a second repository containing what appears to be SnapChat source code, which hasn't been taken down. It's been forked 49 times so far.

deleted 8y ago
[deleted]
netsharc 8y ago
But forking on Github is useless, if the parent project gets memory-holed, your fork will disappear too. But git is a distributed version control system, so git clone before the takedown would help.
- philipov 8y ago
  We can't know how many people cloned it, but we can guess that most of the people who forked it also cloned it.
- joshribakoff 8y ago
  Off topic but that would be pretty bad if you forked code and did significant work for years only for it to randomly disappear overnight
  - metalliqaz 8y ago
    That's why you should always keep clones of your repositories hosted by a third party.
  - asdkhadsj 8y ago
    Yea I didn't know that this would happen. If I fork a repo and plan on maintaining it myself, I guess I have to fully clone it, removing the fork.
    - rpeden 8y ago
      It doesn't happen: https://help.github.com/articles/what-happens-to-forks-when-a-repository-is-deleted-or-changes-visibility/ https://help.github.com/articles/what-happens-to-forks-when-... If you fork a public repo and the original is deleted, your fork survives.

Drdrdrq 8y ago

What is the effect of this? Apart from some security through obscurity measures that might now be useless, what could the worst negative effect of this be? I can't imagine it could hurt Snapchat.

deleted 8y ago
[deleted]
seren 8y ago
Same potential damages from source code leaks : revealing secret projects in roadmap, security or privacy malpractices, lack or respect of SW licenses.
- _r_o_y_ 8y ago
  Yeah definitely the SW licenses as SnapChat is mainly US so there probably won't be any real repercussions related to privacy.
napolux 8y ago
You can probably scavenge code looking for possible leaks and attack vectors. Plus (I didn't check the code) you can find some tokens/salts/whatever used internally, or new features already there and hidden, a/b tests, etc....
Grue3 8y ago
Don't these guys have a super-secretive work culture? Like, you can't even ask what your colleague from another building is currently working on. I'd imagine they'd be very displeased with this leak, and somebody probably got fired.

snehesht 8y ago

https://twitter.com/x0rz/status/1026735377955086337 https://twitter.com/x0rz/status/1026735377955086337

xevb3k 8y ago

I’m confused, did they somehow just include the source code in the app bundle? As a resource perhaps? Or can source code leak into the app through some other vector?

akerro 8y ago
Once I was hacking an android app to get free coupons. After some investigation I found out they decided to generate the same coupon for n-customers, the coupons were changed every day, the coupon was based on MD5 or SHA1 of generated deterministic value (based on customer ID and date). There were 32k possible coupons per day. App was checking if the account and coupon is valid on their server, but it was always valid as they used the same algorithms in the app and on server... The core of the application was written in C#, launched by Mono on Android. Java was compiled correctly with ProGuard (code obfuscator), but C# code was compiled in debug mode. C# in debug mode keeps variable/class/method names as they are in source code, leaves comments in the binary, binary file is bigger and slower. You can decompile it to compilable source code, literally. I managed to get incorrectly protected secret key (they used GPG to encrypt JWT to server lol), later I managed RE of their API, make my own app with identical UI and working coupons. This allowed me to get free coupons every day for next almost 2 years. There were several updates in Google Play since then, but they haven't changed the logic or anything, the app is still in debug mode and anyone can use it. What is interesting, they have also app for iOS which is not in debug mode. Consistency is the key. After I stopped using their services, I checked their ToS that you have to accept before registering and they prohibit app decompilation, but I never registered and never before read ToS, so it's OK for me ;) I wanted to report the problem but they have literally no contact information, I spent a few hours trying to find their contact details, Twitter is dead since 2014, no contact@ email, no contact form on website... nothing. Lesson for you: check if your apps are correctly compiled and secrets protected, there are tools for it. In my previous company we had a Jenkins job to test it before release.
- SmellyGeekBoy 8y ago
  This sounds like fraud, is it wise to be admitting to this publicly?

Raphmedia 8y ago

Did anyone here take a look at the source? Anything we should be worried about?

chedabob 8y ago
It wasn't very exciting. It was only a tiny fraction of the whole source. Some UI controls, some headers for the lens engine and their job system.
- Roland0ull 8y ago
  So this is not quite a big deal. Others do share the code for free to go in wide open.
- deleted 8y ago
  [deleted]
ythn 8y ago
I wish we could see why such a seemingly simple app is 300 MB.

ythl 8y ago

On a side note, does anyone know why the app is 300 MB? Seems excessive for what is essentially a photo viewer.

curiousgal 8y ago

https://twitter.com/i5aaaald/status/1025563719877709825 https://twitter.com/i5aaaald/status/1025563719877709825 > The problem is that we tried to communicate with you but to no avail. The source code has been published on Github and I will publish it again until we get a response.

dylz 8y ago
Ah, it's an extortion attempt. Sad.
- Rjevski 8y ago
  Couldn't have happened to a nicer company.
  - Gigablah 8y ago
    This says more about you than the company.

deleted 8y ago

[deleted]

apostacy 8y ago

This is a case of the Streisand Effect[1] in action. If anyone is really curious, it is called Source-SnapChat and it is all over Github. Github is going to have to mass delete these mirrors, and prevent anyone from re-commiting it anywhere. Snapchat sending DMCAs is not going to be enough. [1]: https://en.wikipedia.org/wiki/Streisand_effect https://en.wikipedia.org/wiki/Streisand_effect

nathancahill 8y ago
When specific repos are blacklisted on GitHub, they have a system that automatically flags uploaded forks. Not sure if/why they haven't blacklisted this codebase yet.

mediocrejoker 8y ago

No explanation on _how_ a bad iOS update leaked source code? Can't imagine Apple is too happy to be blamed for this with no details.

cnowacek 8y ago
I'm guessing that somehow a chunk of their source code got marked as "copy to the bundle" from within the project's build phase. One scenario I could think of this happening is a bug in a custom build script that was intended to copy other resources (images, sounds, etc.) to the bundle and copied an unintended directory containing the leaked source code as well.

driverdan 8y ago

If you're interested in it you can find other repos by searching Github for Source-SnapChat and Source-SCCamera.

welder 8y ago

I find it strange their app is all Objective-C and no Swift.

stefanfisk 8y ago
AFAIK neither does Spotify. Swift is nicer in a lot of ways, but it is still not as safe a bet as objc for large projects.

burger_moon 8y ago

Is it weird that all of their methods start with SC? I guess we do that a little bit for the product I work on but it's also just one product in a much larger company and part of an entire platform. Snap is just snap.

bradenb 8y ago
This is pretty common for Objective-C, I believe.

Bromskloss 8y ago

Well, what is the verdict? Was there anything interesting in the source code? Does having it publicly available matter at all?