Hackers can crash Snapchat users through denial-of-service attacks

Snapchat users are now more vulnerable than ever according to security researchers.

Only a month after the details of 4.6 million Snapchat accounts were precariously exposed on the internet, security researchers have found yet another potentially dangerous exploit.

Telefónica employee and cyber-security researcher Jaime Sanchez has discovered a method to cause denial-of-service (DoS) attacks via the popular photo sharing application. Hackers can exploit this and send thousands of messages to users within seconds, causing the victim’s phone to crash.

The cyber-security consultant said tokens are generated every time a user sends a photo or a video. The flaw within the app would allow these tokens to be regenerated, causing a DoS attack if enough messages are sent. This could then be used by spammers to send messages in mass quantities to numerous users, or for cyber-attacks on desired individuals.

The research concluded iPhones were more prone to attacks, crashing immediately after a DoS attack via the app. Meanwhile, Android users could experience a reduced performance on their device rather than a crashed phone.

Sanchez has since failed to report the vulnerability to the company, citing Snapchat's poor cooperation with security researchers. He claims the company could have avoided the database breach, but instead released an update for the app well after the breach occurred.

“They (researchers) warned Snapchat about issues - about the possible dump of database - and Snapchat didn't care.”

Snapchat is a photo messaging application which allows users to send photos, videos and drawings for a specified time decided by the sender.  Since its launch in 2011, Facebook and Google have reportedly offered to buy the company for $3bn and $4bn respectively, which were both rejected by CEO Evan Spiegel. As of September 2013, more than 400 million “snaps” were sent daily.

Source: The Age | Image via CNET

Report a problem with article
Previous Story

Samsung posts yet another Galaxy S5 teaser, this time with flat icons

Next Story

Microsoft asks people to "Do1Thing" for Safer Internet Day 2014

4 Comments

How does this "crash the phone"?
We can quickly agree, that the phone will need to get more data than usual, however I expect the phone apps to limit the number of posts it will grab from the server and then only display these?

ofc. it is "Denial of Service", by the means of denying the user from seeing the posts from the users friends, however they really screwed up their platform if it just grabs everything, up to the state where it runs out of allocated memory or run into buffer overflows.

Kenman said,
How does this "crash the phone"?
We can quickly agree, that the phone will need to get more data than usual, however I expect the phone apps to limit the number of posts it will grab from the server and then only display these?

ofc. it is "Denial of Service", by the means of denying the user from seeing the posts from the users friends, however they really screwed up their platform if it just grabs everything, up to the state where it runs out of allocated memory or run into buffer overflows.

Through a bug... Whatever it is we'd have to read more on the original article, but sending just headers of a network packet that require a lot of processing and only take a small size on the wire would do it.

Crashes it because you're receiving so much data that you don't have enough RAM to store the excess data.
Each time you get a new message, you get a push notification which takes up RAM, if you were to get 10,000 push notifications for example and say they are (this is guess work, I have no idea how much RAM each takes up) 1KB each, that'd be 10000KB or 10MB RAM usage on just the data itself, then on top of that you've got extra RAM used by displaying those messages and showing them in a list... So quickly you can cause the amount of RAM on a limited device (all apple products) to be exceeded and thus a DoS exploit is born.

Commenting is disabled on this article.