7 ms·

This is an awesome write-up; I’m shocked at the level of effort that went into Snap’s obfuscation process. It implies that are entire teams of engineers out the

This is an awesome write-up; I’m shocked at the level of effort that went into Snap’s obfuscation process. It implies that are entire teams of engineers out there whose sole job it is to play cat&mouse with reverse engineers and nothing more. Another comment mentioned that this effort is outsourced, so not only are there teams, but entire companies dedicated to this! What a blast that must be... though the immense amount of [invested|wasted] (take your pick depending on cynicism) effort spent on this game makes me a little sad. All of these brilliant minds just... cosplaying Sisyphus?

zebraflask 6y ago
I can't help but wonder if it's more of a "a little from Column A, a little from Column B" scenario. There's no doubt they have skilled security staff, but - as a company overall - they also grew very quickly. How much of that obfuscation is intentional and how much might just be old code from a few years ago that nobody got around to removing? Before it was passed through obfuscation.
- 3eed 6y ago
  The vast majority of these obfuscations (maybe except for the scratch arguments one) are done as LLVM passes, so it's done post-code writing, writing code like this would be unreadable and unmaintainable.
- xuki 6y ago
  I'd say they make it a priority to keep people from tampering with their code, and maybe maintaining the platform's integrity. They even ban people who use tweak on jailbroken iPhone/Android. I found these articles about avoid Snapchat detection a while ago, it's a cat and mouse game. https://aeonlucid.com/Snapchat-detection-on-Android/ https://aeonlucid.com/Snapchat-detection-on-Android/ https://aeonlucid.com/Snapchat-detection-on-iOS/ https://aeonlucid.com/Snapchat-detection-on-iOS/
deleted 6y ago
[deleted]
dylz 6y ago
> It implies that are entire teams of engineers out there whose sole job it is to play cat&mouse with reverse engineers and nothing more Do you think the same thing of anti-spam teams too? This is pretty much just anti-spam/anti-abuse.
- tekknik 6y ago
  Personally I don’t see these as the same. These attempts to prevent RE are mostly moot as the machine needs to interpret the code, so therefore it must be valid code and some of this either bloats the binary or decreases performance. The user pays for these inefficiencies (and are therefore user hostile) and in the case of battery powered devices incur additional costs through premature battery wear.
  - dylz 6y ago
    Snap is not usually something the user scrolls through all day (akin to FB/Insta infinite scroll); it's typically send a message or nude/recieve a message or nude and then backgrounded. There is a rare case where people watch clickbait ads for hours but that's usually plugged in laying in bed with nothing better to do
    - tekknik 6y ago
      I very much beg to differ. Spend some time around the younger generations and you’ll see that you will have a hard time getting them to look away long enough to realize you’re even there.
      - dylz 6y ago
        I am one of them - Snap is generally not a "browse forever nonstop" engagement tool that's typical and standard behaviour for TikTok/FB/IG, it's actually somewhat used as a messaging tool (not that it precludes an excessively high volume of messages and groupchats)
        6y ago
elevenoh 6y ago
>What a blast that must be... though the immense amount of [invested|wasted] (take your pick depending on cynicism) effort spent on this game makes me a little sad. All of these brilliant minds just... cosplaying Sisyphus? And we wonder why such a high % of tech workers have a deep discontent & are desperately searching for meaning.
- draw_down 6y ago
  Dang, really? I think this sounds like fun! I would totally work on something like this. It doesn’t seem sad at all, to me. Lighten up!
- meowface 6y ago
  I would find that a very fulfilling and meaningful project, personally. I'd actually consider it way more fulfilling than working on the core product, which likely mostly involves trying to think of and implement clever ways to expose users to ads and sponsored content, and otherwise try to directly and indirectly monetize users. Here, the goal is to prevent phishers, fraudsters, scammers, spammers, catfish, impersonators, malware spreaders, etc. from running amok in a somewhat unprecedented way by tricking users en masse into thinking they're really receiving photos/videos in real-time, using automated tooling. My understanding is this heavy degree of obfuscation (combined with other anti-tampering tactics) has gone a very long way to mitigate a huge amount of abuse. From talking to people who've tried to bypass these mechanisms to do unauthorized and potentially risky things (like send things from a custom client in a way that could allow for mass automation), they describe this as an essentially intractable hurdle from their perspective. Of course, it isn't in actuality, but it is for most people when compared to lots of other social media apps, and I expect Snap to change things around not long after OP releases part 2. Cat-and-mouse never ends.
  - deanCommie 6y ago
    > Here, the goal is to prevent phishers, fraudsters, scammers, spammers, catfish, impersonators, malware spreaders, etc. from running amok in a somewhat unprecedented way by tricking users en masse into thinking they're really receiving photos/videos in real-time, using automated tooling. My understanding is this heavy degree of obfuscation (combined with other anti-tampering tactics) has gone a very long way to mitigate a huge amount of abuse. Which is STILL in the service of trying to expose users to ads and sponsored content. I find it sad that people in our industry are so easily distracted by the technical challenge du jour without looking at the bigger picture of what their work is in service of, which was OP's point.
DyslexicAtheist 6y ago
> though the immense amount of [invested|wasted] (take your pick depending on cynicism) effort spent on this game makes me a little sad that's an odd position to take. You seem to be ignoring the philosophy behind the cat&mouse game that is RE (and Security Engineering in general). What you call cosplaying Sisyphus is to me one of the most rewarding aspects of Tech. Breaking things especially is fun when somebody has made an effort to lock things down (and maybe even claimed it's "unhackable"). This is an area where you're still paid to solve puzzles and where taking the long-view matters. RE is complex and hard but exactly because of this it's one of the most rewarding things in all of CompSci.
- Leszek 6y ago
  I assume OP meant the securing side, not the RE side.
theincredulousk 6y ago
There are commercial products that largely automate these techniques through metadata. See Arxan.
pixelrevision 6y ago
Snap spent an awful lot of money on the facial recognition tech they acquired. I’d imagine the investment was somewhat worth it even it only slowed down competitors time to market.

zebraflask 6y ago

I can't help but wonder if it's more of a "a little from Column A, a little from Column B" scenario. There's no doubt they have skilled security staff, but - as a company overall - they also grew very quickly. How much of that obfuscation is intentional and how much might just be old code from a few years ago that nobody got around to removing? Before it was passed through obfuscation.

3eed 6y ago
The vast majority of these obfuscations (maybe except for the scratch arguments one) are done as LLVM passes, so it's done post-code writing, writing code like this would be unreadable and unmaintainable.
xuki 6y ago
I'd say they make it a priority to keep people from tampering with their code, and maybe maintaining the platform's integrity. They even ban people who use tweak on jailbroken iPhone/Android. I found these articles about avoid Snapchat detection a while ago, it's a cat and mouse game. https://aeonlucid.com/Snapchat-detection-on-Android/ https://aeonlucid.com/Snapchat-detection-on-Android/ https://aeonlucid.com/Snapchat-detection-on-iOS/ https://aeonlucid.com/Snapchat-detection-on-iOS/

deleted 6y ago

[deleted]

dylz 6y ago

> It implies that are entire teams of engineers out there whose sole job it is to play cat&mouse with reverse engineers and nothing more Do you think the same thing of anti-spam teams too? This is pretty much just anti-spam/anti-abuse.

tekknik 6y ago
Personally I don’t see these as the same. These attempts to prevent RE are mostly moot as the machine needs to interpret the code, so therefore it must be valid code and some of this either bloats the binary or decreases performance. The user pays for these inefficiencies (and are therefore user hostile) and in the case of battery powered devices incur additional costs through premature battery wear.
- dylz 6y ago
  Snap is not usually something the user scrolls through all day (akin to FB/Insta infinite scroll); it's typically send a message or nude/recieve a message or nude and then backgrounded. There is a rare case where people watch clickbait ads for hours but that's usually plugged in laying in bed with nothing better to do
  - tekknik 6y ago
    I very much beg to differ. Spend some time around the younger generations and you’ll see that you will have a hard time getting them to look away long enough to realize you’re even there.
    - dylz 6y ago
      I am one of them - Snap is generally not a "browse forever nonstop" engagement tool that's typical and standard behaviour for TikTok/FB/IG, it's actually somewhat used as a messaging tool (not that it precludes an excessively high volume of messages and groupchats)
      - 6y ago

elevenoh 6y ago

>What a blast that must be... though the immense amount of [invested|wasted] (take your pick depending on cynicism) effort spent on this game makes me a little sad. All of these brilliant minds just... cosplaying Sisyphus? And we wonder why such a high % of tech workers have a deep discontent & are desperately searching for meaning.

draw_down 6y ago
Dang, really? I think this sounds like fun! I would totally work on something like this. It doesn’t seem sad at all, to me. Lighten up!
meowface 6y ago
I would find that a very fulfilling and meaningful project, personally. I'd actually consider it way more fulfilling than working on the core product, which likely mostly involves trying to think of and implement clever ways to expose users to ads and sponsored content, and otherwise try to directly and indirectly monetize users. Here, the goal is to prevent phishers, fraudsters, scammers, spammers, catfish, impersonators, malware spreaders, etc. from running amok in a somewhat unprecedented way by tricking users en masse into thinking they're really receiving photos/videos in real-time, using automated tooling. My understanding is this heavy degree of obfuscation (combined with other anti-tampering tactics) has gone a very long way to mitigate a huge amount of abuse. From talking to people who've tried to bypass these mechanisms to do unauthorized and potentially risky things (like send things from a custom client in a way that could allow for mass automation), they describe this as an essentially intractable hurdle from their perspective. Of course, it isn't in actuality, but it is for most people when compared to lots of other social media apps, and I expect Snap to change things around not long after OP releases part 2. Cat-and-mouse never ends.
- deanCommie 6y ago
  > Here, the goal is to prevent phishers, fraudsters, scammers, spammers, catfish, impersonators, malware spreaders, etc. from running amok in a somewhat unprecedented way by tricking users en masse into thinking they're really receiving photos/videos in real-time, using automated tooling. My understanding is this heavy degree of obfuscation (combined with other anti-tampering tactics) has gone a very long way to mitigate a huge amount of abuse. Which is STILL in the service of trying to expose users to ads and sponsored content. I find it sad that people in our industry are so easily distracted by the technical challenge du jour without looking at the bigger picture of what their work is in service of, which was OP's point.

DyslexicAtheist 6y ago

> though the immense amount of [invested|wasted] (take your pick depending on cynicism) effort spent on this game makes me a little sad that's an odd position to take. You seem to be ignoring the philosophy behind the cat&mouse game that is RE (and Security Engineering in general). What you call cosplaying Sisyphus is to me one of the most rewarding aspects of Tech. Breaking things especially is fun when somebody has made an effort to lock things down (and maybe even claimed it's "unhackable"). This is an area where you're still paid to solve puzzles and where taking the long-view matters. RE is complex and hard but exactly because of this it's one of the most rewarding things in all of CompSci.

Leszek 6y ago
I assume OP meant the securing side, not the RE side.

theincredulousk 6y ago

There are commercial products that largely automate these techniques through metadata. See Arxan.

pixelrevision 6y ago

Snap spent an awful lot of money on the facial recognition tech they acquired. I’d imagine the investment was somewhat worth it even it only slowed down competitors time to market.