back to article Saucy Snapchat addicts EXPOSED: Exploit code to poke holes goes wild

Four months ago Gibson Security, a group of freelance vulnerability researchers, notified Snapchat that it had found serious flaws in the image-flinging service's security and privacy systems. Having heard nothing back, the group has now released the details and some exploit code to back up its claims. "Given that it's been …


This topic is closed for new posts.
  1. Vociferous

    Snapchat was how I found out I'm still innocent.

    Despite all my years on the internets I honestly did not understand why anyone would want self-destructing photos. It took me way too long to understand that it's a service designed to let highschool girls post photos of their tits without risking that they get featured on some teen porn site.

    1. Tom 7 Silver badge

      Re: Snapchat was how I found out I'm still innocent.

      Its not designed to do that - its sold as that but its designed to take money off people for a 'service' that can never work.

      Schools should be pointing out to kids just how this doesn’t work.

      1. Anonymous Coward
        Anonymous Coward

        Re: Snapchat was how I found out I'm still innocent.

        Schools should be explaining security and the possible downsides of posting stuff to any social media website, as well as the impossibility of ensuring that what goes on Snapchat really disappears. Because then in future employers will know that the idiots who post their drunken binges on Facebook either weren't paying attention in class, or really are dysfunctional narcissists.

        1. Peter2 Silver badge

          Re: Snapchat was how I found out I'm still innocent.

          Narcissism has been removed from the DSM because it's now to difficult to diagnose because the majority of the population could be diagnosed as narcissists.

          I'm not joking, google it.

        2. Don Jefe

          Re: Snapchat was how I found out I'm still innocent.

          Schools have a very difficult time explaining things like this to kids. Remember, the adults who manage your life are the enemy. They're old, don't understand how today's world works. They're stupid, if they knew what they were talking about they wouldn't be teaching, etc...

          The 'young adult' age bracket is so highly prized because kids that age are really beginning to assert their individuality. Because of this they're extremely susceptible to marketing. They haven't yet had enough experience to realize that they are being aggressively targeted. They truly think they're the first ones to figure this stuff out. If some brand/thing/fad 'speaks' to them it's because that brand/thing/fad understands them.

          They'll look back and say 'god damn' I was stupid, and in most cases it won't matter, it's part of being a kid. One of the first steps in actually being an adult, not adult aged, but an actual adult is admitting you don't know shit. Most of these kids will get there, then one day they'll be 'old' and those stupid kids today are just throwing their lives away but they won't listen. Then they'll get a little older and just say fuck it, it doesn't matter. Then they'll have about 20 years to enjoy it :)

          1. Tom 13

            Re: Schools have a very difficult time explaining things like this to kids.

            Before schools can explain it, they first have to know it themselves.

            You can dance around it, but fundamentally this is a moral consideration. And we've made it nearly impossible for a society as a whole to make moral judgements. Especially about things involving sex/naughty bits.

    2. Michael Thibault

      Re: Snapchat was how I found out I'm still innocent.

      ... it's a service designed to let people post risqué photos of their bits while lowering—but not completely eliminating—the risk that the photos see lots of eyeballs. Else, where's the titillation, that frisson?


      In any case, twits with their bits should not act on a belief that the magic conjured on the internet is perfect, and will keep them safe and sound. The charm of Snapchat will likely wear off very quickly when (or each time) the guy behind the curtain is exposed.

    3. Destroy All Monsters Silver badge

      Re: Snapchat was how I found out I'm still innocent.

      > 2013

      > Still innocent


    4. Amorous Cowherder

      Re: Snapchat was how I found out I'm still innocent.

      Really? Sounds like a demographic that could do with some lessons in self-respect!

  2. frank ly

    "titillating titbits"

    I see what you did there ( and a hacker could see what she did too.)

  3. Martin 47

    Its main use seems to be for food 'porn' in this household.

  4. Darryl

    I wonder how long tech companies are going to keep up this "LA LA LA LA LA I CAN'T HEAR YOU!!" approach to dealing with (or not dealing with) security experts telling them "Hey, guys, there's a big Effing* hole in your system"

    (*From Effing Forest - Just finished my Christmas copy of Raising Steam.)

    1. Anonymous Coward
      Anonymous Coward

      @Darryl - "I wonder how long"

      Until litigation is likely to be much more expensive than designing secure systems. Why do you think business in the US wants "tort reform" - i.e. prevent ordinary people from suing them?

    2. User4574

      For as long as they can blame the evil hackers every time they get caught with their pants down because they leave the door open.

      No one expects these companies to have air-tight security, clever people will find new attacks. We do expect them to learn from mistakes and not keep repeating them ad nauseam.

    3. Crazy Operations Guy

      Something tells me that they knew about it and was put in there for the feds to catch criminals, etc.

    4. Don Jefe

      That's part of running a business. You're going to have to take risks or you'll be out of business faster than if you had no product at all. You absolutely cannot go running around responding to every third party comment, that's not a viable way to run a business, in any industry. The business will survive or perish based on what you determine is a serious risk and what isn't.

  5. Varg

    Load of rubbish

    What's stopping the recipient from taking a picture of their phone displaying the "temporary image" with another device (a camera or another phone)? A fundamentally flawed idea at best; ridiculous valuations.

    1. Anonymous Coward
      Anonymous Coward

      Re: Load of rubbish

      The point is that the people who invent these things, and the people who invest in them, seem to have a complete lack of imagination. They assume that, having thought of a use case, everybody will follow it slavishly.

      In the past this was excusable because things were being done for the first time, e.g. the many holes in email. But it seems that many software company founders have no idea of the history of their own industry.

      1. Eddy Ito

        Re: Load of rubbish

        But it seems that many software company founders have no idea of the history of their own industry.

        If you'll pardon a graybeard for saying it but it isn't really surprising when you consider how old these founders are. Consider that email and compact discs have been around longer than Mark Zuckerberg. Besides the only industry specific history that they've ever read was likely "Netscape Time".

        1. Anonymous Coward
          Anonymous Coward

          Re: Load of rubbish

          I too would be a greybeard if growing a beard didn't make me look like Captain Birdseye.

          What is surprising to me is that people emerge from computer science courses with no understanding of security whatsoever, whereas nowadays they wouldn't graduate in, say, physics or chemistry, without some notion of safe practice in experiments.

      2. OsamaBinLogin

        Re: Load of rubbish

        BTDT. You come up with a few good ideas, then you think you're a genius, you're smarter than everybody in the world, and you act that way. But you're not. If you're lucky, you make a few mill before it starts to run down. If you're very lucky, you become Zuck. If not, you crash and burn from your arrogance.

    2. Crazy Operations Guy

      Re: Load of rubbish

      Or just take a screenshot.

      I wouldn't be surprised if there was someone out there that disassembled the Snapchat client and replicated all its features but rather than deleting the photo, it just saves it somewhere. There is no way for a remote server to verify that the client hasn't been modified (See: Trusting Trust).

      1. Adam 1

        Re: Load of rubbish

        Or since we are talking android, press power and volume down at the same time.

    3. A J Stiles

      Re: Load of rubbish


      The self-destructing message cassette I invented aged 8 suffered from roughly the same flaw.

  6. Anonymous Coward
    Anonymous Coward

    more stupidity..

    working for a giant consultancy company, I was involved in a healthcare product that made a big deal of the fact that patient records could not be printscreened from the application, and that images expired so they were secure. Of course if you ran the client in a VM, you could still screenshot it. If you pointed a cameraphone at the monitor you'd stil get a reasonable picture. Utterly brainless.

  7. Yet Another Anonymous coward Silver badge

    Think of the children

    Growing up to become politicians

    Imagine if camera phones had been around 20years ago, you now wouldn't be able to open your email without the risk of seeing some image of Cameron or Boris putting their wedding tackle somewhere 'hilarious' .

    T' internet will collapse from the horror

  8. Missing Semicolon Silver badge


    " Over the past yearweek we’ve implemented various safeguards to make it more difficult to do"

  9. Rambler

    I DO like the 'reply' from makers men

    Over the past year we’ve implemented various safeguards to make it more difficult to do

    so they are effectively saying the vuln IS real, and it works, they are working to make it more difficult NOT to stop it

    and the reality of someone actually falling for the BS of a 10 second picture ...................

    seems like the old adage of ONE born every minute will need to be revised to a significantly larger figure :o(

    1. Tom 13


      I had the same thought. Their reply is proof the vulnerability is real and they either don't have the clue or the money to fix it.

      So who is running the pool on how long it is until 4chan exploits this, just to make some teenage girls/guys cry?

      1. Don Jefe

        Re: @Rambler

        The existence of a vulnerability is not, by itself, a valid reason to correct it. That's the worst sort of business management. You've got the assess the risk by your own criteria and decide if it's worth fixing.

  10. chappers

    SnapChat has been SnapHacked

    and someone has done it

  11. picktechnologies

    good articles

    Makes some interesting reading

This topic is closed for new posts.

Biting the hand that feeds IT © 1998–2021