4 ms·

I have been following with their API changes since it's major update in early 2013, and anyone could have exploited the phone lookup function easily, because ev

by kaivi 13y ago

I have been following with their API changes since it's major update in early 2013, and anyone could have exploited the phone lookup function easily, because everything is there in the open. I was surprised by how easy it was to decompile the Android app: public static boolean NEEDS_FUCKED_UP_NEXUS_422_SETTINGS() Timber.d("Looks like camprevs gon hide dis shit", new Object[0]); There really is no way for the Snapchat team to completely prevent others from reversing their API. A client is the endpoint after all. In order to make things difficult for hackers, they could do the following: 1. Implement a custom protocol over TCP/IP, kind of what Skype does. 2. Obfuscate the hell out of it and everything else. 3. Roll out new updates with both APIs. 4. After a reasonable amount of time, break backwards-compatibility on server side.

gibsonsecurity 13y ago
Hahahaha, I don't think making it harder to reverse would be any better, it would probably motivate people even more (deobfuscation is too much fun and fairly easy!). They should really just focus on improving what they have and pushing clients towards a safer protocol slowly. Snaps being stolen will always happen, but I do like the approach Instagram took to preventing spammers (getInstagramString(), it stopped everyone until they adapted!).
- kaivi 13y ago
  Yep, but at least that would be fun, don't you agree? I also wonder why didn't anybody set up a Snapchat bot yet: it could successfully impersonate multiple humans by forwarding snaps between pairs of unsuspecting users, gathering a lot of data that way.
  - gibsonsecurity 13y ago
    Definitely, lol. That's a pretty sneaky idea, I'm sure its possible with all the clients now available!
  - rmccue 13y ago
    Actually, I know of one set up by a friend: snaproulettebot. You send a snap, and it sends you a random one back later from another user. Being called "snaproulettebot" makes it pretty obvious what it is, but you could do it in a more opaque way.
- way66 13y ago
  Could you explain what is the getInstagramString()? Thanks!

by kaivi 13y ago

gibsonsecurity 13y ago

Hahahaha, I don't think making it harder to reverse would be any better, it would probably motivate people even more (deobfuscation is too much fun and fairly easy!). They should really just focus on improving what they have and pushing clients towards a safer protocol slowly. Snaps being stolen will always happen, but I do like the approach Instagram took to preventing spammers (getInstagramString(), it stopped everyone until they adapted!).

kaivi 13y ago
Yep, but at least that would be fun, don't you agree? I also wonder why didn't anybody set up a Snapchat bot yet: it could successfully impersonate multiple humans by forwarding snaps between pairs of unsuspecting users, gathering a lot of data that way.
- gibsonsecurity 13y ago
  Definitely, lol. That's a pretty sneaky idea, I'm sure its possible with all the clients now available!
- rmccue 13y ago
  Actually, I know of one set up by a friend: snaproulettebot. You send a snap, and it sends you a random one back later from another user. Being called "snaproulettebot" makes it pretty obvious what it is, but you could do it in a more opaque way.
way66 13y ago
Could you explain what is the getInstagramString()? Thanks!