4 ms·
Snapchat is notoriously difficult to automate/spam. The goal is to get the X-Snapchat token. The most elegant solution is to find the secret in the binary and
by zelly 6y ago
Snapchat is notoriously difficult to automate/spam.
The goal is to get the X-Snapchat token. The most elegant solution is to find the secret in the binary and reverse the algorithm to generate tokens. Wouldn't it be easier to MITM the endpoint; set up a dummy server (which collects tokens) in front of a proxy that spoofs the DNS and TLS certs (may be easier on rooted Android than iOS).
In my last attempt I gave up and went for dumb UI automation, but it would be cool (and worth good money) to exploit the private API.
- mox1 6y agoCertificate pinning spoils that, no spoofing of certs with pinning. Cert (or hash of) delivered with app. If server cert doesn't match expected value coded into app, someone is messing with something, terminate connection.
- amerine 6y agoJust don’t do something like only trust a specific CA cert. really-really pin to a leaf.
- zelly 6y agoYes that complicates things. But if you can find the cert in the binary's data section, maybe you can patch it with your own.
- __float 6y agoThis probably runs into the same issue mentioned in the article, where the checksums are wrong and you end up in an infinite loop.
- brendonjohn 6y agoAssuming this is for Android, the APK would no longer be signed and would cause all login attempts to fail. Have a read about "SafetyNet Attestion API" for Android.
- IAmLiterallyAB 6y agoYou could patch Android and run it in an emulator. Or patch Snap not to care. Not super familiar, but there should be a way. Client side security can only do so much.
- looperhacks 6y agoYou can't patch Snap to not care because the safetynet process is (roughly) like that: The App asks the Play libraries whether the phone is okay. This is verified (in part) on the Google servers, so the Snap servers can ask Google whether a call came from a non-tampered phone. The client can't do anything about it, except tricking google into believing the phone is not tampered with. Which is notoriously hard, because nobody knows how the process really works.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- wallflower 6y agoMy guess is the X-Snapchat is a one-time use token that changes on a per-call basis and may even been hashed to the actual data being sent in the API call. For example, if Snapchat is sending a pic that has a MD5 hash of X, the token somehow encodes that or other information so you cannot reuse that token. I’m confident the security engineering team at Snap has all kinds of white hat teams to prove and probe the security constantly.
- rvz 6y agoAccording to a old AppSec talk, they used a third-party security company to implement this stuff. They are a customer to a company called ‘Arxan Technologies’ that implements these ‘guards’ in their software. They’re very good at not revealing this, but it came up whilst looking at their private API. These secret keys are there but heavily obfuscated and is nothing more than white-box cryptography which can be bypassed via emulation.
- theincredulousk 6y agoWorked with Arxan before. They are legit - what is described here is the tip of the iceberg. Haven’t even gotten into in-memory instruction and data encryption. If you’re dumping the binary you’re likely not even seeing all of what is executing at runtime
- deleted 6y ago[deleted]