7 ms·
Show HN: Snapception – Intercept all snapchats received over the network
- elwell 12y ago> Intercept and decrypt all snapchats received over your network Somewhat misleading in light of: > Anyway, for Snapception to intercept your snapchats, you must be connected to the computer via a proxy and have installed its CA Interesting, nevertheless, because it exposes that: > they use one, hardcoded key for all video and image encryption
- ChuckMcM 12y agoTheir point was, I believe, that you could store copies of all snaps sent to you without anything on your device which snapchat could "check" to see if it was being interfered with.
- asdfaoeu 12y agoSo? Everyone should know that. Just get a camera?
- Pengwin 12y agoThis has been reality for more than a year. In fact, i've been running a bot based off https://github.com/JorgenPhi/php-snapchat https://github.com/JorgenPhi/php-snapchat for the past 11 months. it has over 5000 friends, and its popularity puts me to shame :(
- Perseids 12y agoThey could use certificate pinning [1] (and really, there is no reason for an app author not do so, except for the additional work) which would thwart all man-in-the-middle attacks. The end-point is still open through the analog gap (photograph of the screen) and custom clients, though. [1] https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning#Android https://www.owasp.org/index.php/Certificate_and_Public_Key_P...
- deleted 12y ago[deleted]
- elwell 12y agoTechnically a misuse of the -ception meme.
- tghw 12y agoInterception? Seems like a reasonable use to me.
- quarterto 12y agoThe -ception suffix is typically used for nested abstraction; for example running a virtual machine within a virtual machine could be referred to as VMception. This is in reference to the 2010 movie Inception, a major device of which is the use of nested dreams, or /a dream(?: within a dream)*/.
- devindotcom 12y agoA popular use, as you say, since 2010. But more popularly in use for centuries in words like perception, exception, deception, contraception, etc.
- thebradbain 12y agoAs the developer, I was going for combining "Snapchat" with "Interception", and "Snapception" was the result. I wasn't even thinking of Inception at the time, an oversight on my part.
- eastbayjake 12y agoIntersnaption?
- devindotcom 12y agoI too thought of Intersnaption.
- willvarfar 12y agoSnapper? Snagchat?
- primitivesuave 12y agoConnecting via a proxy and installing a CA means this is more of a tool for a snooping parent to intercept the snapchats of their kids while they are at home, rather than a scary-looking tool for intercepting the general stream of snaps (as it is made out to be).
- chrissnell 12y agoNot necessarily. If you control the gateway, it's possible to transparently redirect outbound connections into your proxy. I used to do this back in the 90s to force our employees browsers through an ad-blocking proxy. Depending on your user base (kids?), it could be as simple as setting up an open wifi access point in a place where all other APs are password-locked. Edit: I just realized that this proxy requires the device users to load a CA cert. That makes things a little more difficult but still not impossible. Through creative social/software engineering, you might be able to persuade the users of your rogue access point to load the CA cert "in order to use this free service".
- brazzledazzle 12y agoYes, but they would be clued in because the SSL certificate wouldn't be valid unless they trust your CA.
- downandout 12y agoThat's pretty trivial for parents. "Hey pumpkin, I need to borrow your phone for a second". That said this is something that maybe 0.1% of parents could or would set up.
- chrissnell 12y agoGood point, but it's an interesting idea. An open-source home firewall that's designed with features/sniffers that lets parents keep an eye on their kids' online usage.
- philangist 12y agohttps://github.com/thebradbain/snapception/blob/master/snapception/decrypt_snap.rb#L17 https://github.com/thebradbain/snapception/blob/master/snapc... Oh lordy. I wonder if they eval() arbitrary input from users as well.
- thebradbain 12y agoDeveloper here — I think I recognized I had written some hastily written code in the bottom of my repo. Please, feel free to submit a pull request.
- philangist 12y agoI think maybe I should've been more clear. I was referring to Snapchat's horrible security policies in that comment, it was not a criticism of your code.
- thebradbain 12y agoDon't worry about it. I made a system call using process.call() and thought maybe that's what you were referring to.
- nkozyra 12y agoWhat other bad practices should we be looking for ;)
- spacemanmatt 12y agoStandard disclaimer applies: Code is dangerous, yo. ;)
- droopybuns 12y agoSnapchat's supposed valuation at $10b while they appear to be completely inattentive to the security of their product is hard to reconcile.
- kmfrk 12y agoWhat's also really sad is that the FTC is actually on their case, but they're evidently in no capacity to throw their weight around enough to put a stop to this.
- icelancer 12y agoIt is? Startups are taught to move fast and break things. Security usually requires to be thoughtful and not intentionally ruin stuff. Runs counter to the whole new modern movement.
- wellboy 12y agoYes this applies when you haven't raised funding yet, maybe if you've just raised your A Series, but not if you're a billion dollar company.
- wellboy 12y agoYes this applies when you haven't raised funding yet, maybe if you've just raised your A Series, but not if you're a billion dollar company. Of course there are always security holes, but they should really not be that gaping.
- logn 12y agoTheir selling point is that the snaps are ephemeral. I don't think anyone's expecting fool-proof security, but the overall impression is that the privacy aspect is all just marketing hype. It's not that big of a deal but then again it's not a big deal to switch to the next messenger app either.
- lotsofmangos 12y agoI didn't think that facebook policy was industry policy. Besides I always though that sounded like a bad idea as an aim, it is more just an observation of one of the common consequences of moving fast, which probably should be looked at and reduced by having some extra members of staff dedicated to breaking less things, so that moving fast doesn't get too expensive.
- never_snapped 12y agoWhere did the key come from? Leaked by the application or something else? ..edit, found out they hard coded the string as constant in the app, smh.
- _RPM 12y agoMan, I was hoping it was written in C, or at least C++, not Python.
- jeffreyrogers 12y agoOut of curiosity, how come? Python runs on pretty much any platform you'd want to use and is much easier to develop in than C/C++.
- nkozyra 12y agoWould certainly be overkill given the purpose it serves. A clean scripting language makes much more sense here for general consumption.
- Nursie 12y agoAs a die-hard C programmer. For tools and toys that are not performance sensitive, python is great. It's a lot more expressive and requires a lot less boilerplate code. I've re-written projects from C->Python before and had them work with 30% the number of LoC. I've re-written projects from Python->C before and had a 10-fold speed increase. Right tool for the right job and all that...
- snappieT 12y agolol1 @ using a single key to decrypt everything; lol2 @ not using certificate pinning
- timr 12y agoReally seems like more of a snapanopticon than a snapception.
- tomfitz 12y agoSnapchat use ECB as the cipher mode of operation: https://github.com/thebradbain/snapception/blob/781ebb13cd7ee75cb56c744a94fa3945e764dd7a/snapception/decrypt_snap.rb#L15 https://github.com/thebradbain/snapception/blob/781ebb13cd7e... To see why this is a problem, see the ECB-encrypted Tux image on http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electronic_codebook_.28ECB.29 http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#... Oops.
- teraflop 12y agoTo be fair, that demo only works on an uncompressed bitmap image with large areas of solid color. It relies on the fact that identical input blocks encrypt to identical outputs, leading to visible repeating patterns. In a format like JPEG, which has an entropy-coding stage and all kinds of internal headers, the chance of encountering two identical blocks in a file is miniscule. Of course ECB is still a very bad choice, because there are plenty of other ways to attack it. But recovering Snapchat images without the key would not be nearly as trivial as that example might suggest.
- Nursie 12y agoI don't know a lot about the specifics of JPG file format, but... with a complex file format you can probably make some educated guesses about the content of some of the blocks and perhaps start building up a sort of dictionary... ? Yeah, ECB is BAD.
- yk 12y agoTo the extend that AES is a good random number generator, only if you have a complete dictionary of all blocks. Simply because a random number generator should produce independent output even if you only have a small perturbation in the input. That is, there should be no relation between a completely white block and an one where one of the pixels has a value of 0xfffeff.
- Nursie 12y ago
- exabrial 12y agoDoesn't seem to work. It's catching traffic but the snaps directory is empty.
- enimodas 12y agoBut snapchat updated its encryption just a couple of days ago: https://github.com/programa-stic/snapchat-decrypt https://github.com/programa-stic/snapchat-decrypt You will need the android id of the phone, which I don't think you can easily get as a man in the middle?
- thebradbain 12y agoOoh, I didn't even to think to test it on Android phones. This method works on iOS devices, however.
- ne0n 12y agoWhat do the android ids look like? I'm assuming it's just a number, but I don't know how big. The page you linked to says the key is md5(android_id + "seems legit..."). It seems to me like this could potentially be brute forced to find the android_id using a captured encrypted image.
- e12e 12y agoExcept for versions 2.2, it appears to be a random 64bit integer: http://developer.android.com/reference/android/provider/Settings.Secure.html#ANDROID_ID http://developer.android.com/reference/android/provider/Sett... That would take some time to brute force I guess. Especially if the only way to check each guess is to try and decrypt and look for a valid (part of an) image header.
- e12e 12y agoWell, that's for the encryption key of the images stored on the device. But if you can MITM the connection, then you can get the images as they come from snapchat to the device? And either the device have to send the id up, so the server can encrypt the images with a shared secret (perhaps the id is sent when the app is installed?) -- or the images are sent, encrypted with a different key, then re-encrypted for storage on the device?
- deleted 12y ago[deleted]
- rohanpai 12y agoIf you can man in the middle traffic, aren't all authentication cookies compromised anyway? Wouldn't any service then be subject to "interception"?
- devindotcom 12y agoNot with proper encryption, I believe? In this case you can get someone else's supposedly private snaps if they're on your network, because the key is the same as the one for decrypting your snaps.
- Nursie 12y agoCorrect. Properly set up TLS should protect you regardless of MITMs. The issue comes if someone can get you to accept their CA. In both this case and for MITM attacks on TLS. At that point it's game over.
- ankushio 12y agoI can't get this to work on my iPhone. When I visit mitm.it from my phone, or any other device, it redirects me to grit.io. How do I install the CA. I have the proxy up and running on my Macbook pro.
- joelanders 12y agoThere are trusted software client things (Spotify, Netflix, etc.) that seem to work well enough. Snapchat should be able to do better.
- ris 12y agoTotally different incentive. Spotify only needs protection that's enough of a pain the the ass to make it easier to just get the content from somewhere else or perhaps just pay the $n.99 for it. Snapchat is full of (supposedly private) information that is not available anywhere else. Attackers will be far more determined.
- joelanders 12y agoSee links for a bit of reading about how hard it is to break DRM on Spotify or Netflix. They're doing a lot more than Snapchat. The difference between "you just need to reverse engineer the HTTP API to make a 3rd-party client" and "you need to run IDA Pro and PANDA and whatever else" is significant. The latter exploit would have far less reach. [1] http://moyix.blogspot.de/2014/07/breaking-spotify-drm-with-panda.html http://moyix.blogspot.de/2014/07/breaking-spotify-drm-with-p... [2] https://www.usenix.org/node/182951 https://www.usenix.org/node/182951
- johnsoft 12y agoI read through the Spotify article, and if I understood it correctly, you don't need to run QEMU+PANDA to get at the unencrypted stream. That was just the method the author chose to analyze the running code. He tracked every memory read and write made by the CPU, and looked for byte distributions that looked like encrypted data, and found the decryption function at address 00719b84. He then located that code inside the Spotify binary, at 0x0042e2ed. Once you know that, you don't need to repeat the initial analysis every time. You can just set up a hook to record all the data that flows through that function after it's decrypted.
- joelanders 12y ago
- superuser2 12y agoThe only "news" here is that you can MITM HTTPs when you own a trusted CA. Of course you can break Snapchat if you can get users to install your CA cert. Snapchat is no different from every other application in that respect.
- scope 12y agoquick heads up, on http://bradba.in http://bradba.in under Technical skills > Web Frameworks you've put Node --- Node is NOT a framework it's a platform