10 ms·
Snapchat - GibSec Full Disclosure
- objclxt 13y agoWhat's interesting to me is how the passage of time seems to have affected how Snapchat responded to this. About twelve months ago I found a very similar vulnerability in SnapChat that could be used to provide a cellphone number for any given username (it was probably slightly more serious than what Gibson found, it was far easier to exploit). Anyway, I ended up guessing Evan Spiegel's e-mail address along with a few other SnapChat staff and got in touch with them. They responded in twenty four hours, patched it, and we had a brief chat about how I ended up finding it in the first place. This was back when the API was still running on Google App Engine (...maybe it still is, although that would be surprising). I got the impression it was held together with string, but they engaged with me and it got fixed. I would be interested to know how GibSec engaged with Snapchat, because their experience seems very different to mine, and yet the vulnerabilities are very, very similar.
- argonaut 13y agoAccording to my interview with them a few months ago, they're still running a Java stack on Google App Engine. It bears noting that GAE is good enough for Khan Academy too.
- objclxt 13y agoOh, I'm sure technically it's good enough, it just seemed surprising from a cost perspective. It seems at the scale they're at it would be cheaper to run their own. But then again, perhaps given the money going in cost isn't something Snapchat have to worry about.
- a_olt 13y agoGibSec say in their disclosure that SnapChat still uses GAE, and argue that this will make attacks easier/faster due to the server being unlikely to bottleneck.
- j_s 13y agoI thought it was just another snapchat api reverse engineering 'til I got to http://gibsonsec.org/snapchat/fulldisclosure/#obligatory-exploit-pocs http://gibsonsec.org/snapchat/fulldisclosure/#obligatory-exp...
- hamburglar 13y agoIt still seems a little overwrought. Given a phone number, you can determine whether or not that number is associated with a snapchat account, and you can get their username. Seems like a pretty mild disclosure (I'm having a hard time imagining any serious abuses of this information -- someone now knows your phone number and that you're a snapchat user, so I guess they can target some SMS spam at you if it's somehow interesting to them to target snapchat users...shrug). But it's a disclosure, nonetheless, and snapchat oughta fix it. Let's just keep things in perspective. Also, it's laughable how wrongly GibSec estimated how long it would take to scan the entire snapchat userbase with this technique. "Let's see, they have 8e6 users and we can scan 6666 phone numbers per minute, so we can scan their entire userbase in 8e6/(6666 x 60) = 20 hours." Wrong: you aren't scanning 6666 users per minute, you're scanning 6666 phone numbers per minute, most of which are going to be misses. You're off by several orders of magnitude.
- gibsonsecurity 13y agoSorry about that - I thought it was clear from the context of those off-the-cuff estimations that it was 6666 numbers (since that was based off of how many numbers you could scan, not users). We've added some clarification just to be sure, thanks.
- hamburglar 13y agoJust checked and you still have this completely broken paragraph: "Given user_base = 8,000,000, and a numbers crunchable per minute (ncpm) of approximately 6666, we can assume that it would take approximately 20 hours for one $10 virtual server to eat through and find every user's phone number (hours = user_base / (ncpm*60)). At our worst case of ncpm = 5000, it would take approximately 26.6 hours." Look at it this way: If they only had 5000 users, would you estimate the time to find all their phone numbers at 1 minute? No.
- optymizer1 13y agoI hate to be that guy, but what's the big deal? Where's the full disclosure? It looks like they're just documenting the API, which is not really disclosing much. Anyone can fire up burpsuite proxy and inspect HTTP requests and responses from their phone. Now onto their PoC. So they don't have rate limiting on some API requests. That's pretty dumb for a service with a public API, but in my experience, most websites don't limit requests rate, because it's always a "let's toughen up security" after-thought. I remember GAE having some anti-DDoS measures, so they may be relying on that while growing the business. The bulk registering of user accounts is more serious though and could be easily fixed (to some extent) with a captcha. This may be worthy of a tweet, maybe. Instead, Gibson listed all of SnapChat's APIs, even though most of them were irrelevant to the PoC, and slapped 'Full Disclosure' on it. This is high-school level security researching. We were finding the same 'exploits' in high school. You could probably find these with any service that's only starting out. Glad to see that's the best Gibson could do. If I were Snapchat, I'd fix the two issues and then thank Gibson for spending the time to create an API page for SnapChat.
- a_olt 13y agoYou are disregarding the fact that the vast majority of attacks ARE, in fact, this simple. And your post also fails to mention what is central to Gibson's disclosure, namely the instructions for finding the phone-numbers of SnapChat users. So your post sounds really biased.
- mike_hearn 13y agoThat's not an "exploit", that's just how all these services work. For a large service there really isn't a good way to implement private set intersection as would be required for this - all the techniques that might work are deep into academic-paper-only territory, forget about finding a convenient open source implementation lying around on github, let alone a mature one. The other one, bulk registration of accounts, is also not an exploit using any conventional definition of the word. I spent years fighting bulk account signup abuse at Google. When we failed it was not an exploit in our system, because that implies you can provide some kind of cast-iron security guarantees on par with cryptography; you can't, all you can do is rate limit and try to detect bogus accounts. It's like finding a way to send spam and calling it an exploit. The poor crypto is disappointing but hardly unique: the field of crypto in general has given people poor tools to work with. Things like NaCL are barely known where as lower level primitives are supported out of the box by basically every OS/platform out there, with little or no guidance on the best way to use them.
- uptown 13y agoOn the subject of Snapchat - does anyone really believe that they don't permanently retain a copy of the images on their server?
- zxcdw 13y agoI doubt they want to store underage titpics.
- circa 13y agoi was going to say the same thing. hahah
- JasonFruit 13y agoShouldn't that be spelled with an 'x' or 'z' in it somewhere? I don't think you're maximizing the flippancy available to you.
- sp332 13y agoIt's not flippant. There have been criminal charges brought against people sharing photos of topless underage kids obtained via Snapchat. This is not something Snapchat wants to have lying around. http://arstechnica.com/gadgets/2013/11/ten-boys-arrested-for-child-porn-distribution-connected-to-snapchat/ http://arstechnica.com/gadgets/2013/11/ten-boys-arrested-for...
- JasonFruit 13y agoI meant the terminology used, not the point made.
- DanBC 13y agoWhy is that flippant? Do the staff of Snapchat understand their legal situation? What do the laws of wherever their servers are say about transient storage (for caching, serving, etc) of images of nude under age people?
- 13y ago
- tptacek 13y agoECB encryption. No MAC. Brand new system. Tell me again how developers should be building their own crypto?
- yalogin 13y agoThis seems like a choice made by some one who knows what they are doing. They are using AES-CBC for the actual conversation but for media they chose ECB. Of course having the media deleted on the client is their main selling point and they chose to use ECB there!
- sdevlin 13y agoMore importantly, all encryption keys are either fixed or stored directly alongside ciphertext. The cryptography in this system seems to be 100% cosmetic, so I'm not sure things like ECB mode or absence of MAC really matter. EDITED for clarity.
- pencilo 13y agoThe key is a constant in the application, while ECB is embarrassing the mode can't help you here. But if it makes you feel better you can upload arbitrary bytes to Snapchat, encrypt it with your own not-stupid method.
- rohanpai 13y agoWhat are the alternatives to EBC? Why not use CBC?
- mukyu 13y ago>1 (note: it's still encrypted prior to gzipping). why
- deleted 13y ago[deleted]