Snapchat hack

Khannie

Well, my son got an unusual mail off snapchat there last night. Apparently someone had logged into his snapchat account from an IP in the US and they flagged it as unusual in an email to him. I did a reverse DNS and port scan on the IP this morning and it has squid installed (so obviously the login didn't originate from there).

We're somewhat at a loss as to how his account was breached though. His password is short (9 characters) but isn't something you'd find on a password list (or indeed one that could be easily generated by hashcat with a dictionary).

For it to be brute forced you'd reasonably require the encrypted password or some level of access to his phone (possible?) or this computer (highly unlikely). He does use the password in other places (important ones have been changed).

Any thoughts on how this might have happened?

syklops

A rogue or compromised wireless access point which your son used?

Edit: You don't look old enough to have a son who uses snapchat.

dalta5billion

Did he login via a third party app, such as those that "save" snapchats?

Logged in via a commercial WiFi company proxying through the US?

Alternatively Snapchat themselves may have a breach.

Khannie

syklops wrote: »

A rogue or compromised wireless access point which your son used?

Hmmmm. Possibly. He does use any wifi he can get his hands on.

syklops wrote: »

Edit: You don't look old enough to have a son who uses snapchat.

I'll take that as a compliment rather than a statement about my parenting. Yeah, he's plenty old for snapchat.

dalta5billion wrote: »

Did he login via a third party app, such as those that "save" snapchats?

You know...I bet this is it. I'll check with him later.

dalta5billion wrote: »

Logged in via a commercial WiFi company proxying through the US?

Unlikely.

dalta5billion wrote: »

Alternatively Snapchat themselves may have a breach.

Possible, but it also seems unlikely.

syklops

dalta5billion wrote: »

Did he login via a third party app, such as those that "save" snapchats?

Thats problably it.

Blowfish

syklops wrote: »

Thats problably it.

Indeed. There are a myriad of permission checkers for all mobile OS variants so it's an easy enough one to confirm too.

Khannie

Blowfish wrote: »

Indeed. There are a myriad of permission checkers for all mobile OS variants so it's an easy enough one to confirm too.

It wouldn't show up in a permissions check actually. Internet access would be all that's required to rob the username and password.

Khannie

OK....This happened a second time.

He had factory reset the phone, installed a very limited set of apps (none of which he gave his snapchat password to) and changed his snapchat password.

He got a mail from snapchat saying his account had been accessed by an IP in the US again. Again this IP has squid running (the previous one still has it) so obviously someone is trying to break into his account.

Honestly, to me this smells like a breach within snapchat at this point. I am wide open to other theories though.

Khannie

*bump*

surpy

i doubt its specific to your son

http://www.bbc.com/news/technology-29410366

Khannie

Yeah, I had seen that, but it says "but the site has said it was not the victim of a hack". To me this stinks of a breach. Two passwords in two weeks.

surpy

http://nakedsecurity.sophos.com/2014/10/01/snapchat-says-fat-spam-is-not-its-fault/

Snapchat says it has emailed many of the compromised users to let them know their account has been hacked.

its a broad "hack" but it does seem they are confident its not on their side

We have seen evidence that hackers who have access to a trove of credentials leaked from other websites, have started using them to gain access to Snapchat accounts. In many instances, our defences have notified the user that their account has been compromised. We recommend using a unique and complex password to access your Snapchat account.

surpy

i'm guessing a stolen DB of passwords / phone numbers from another site is being sold a few times and checked if any of the login data matches to snapchat

Khannie

That's fair enough for the first instance, but not for the second. He had changed the password and was only using it with gmail (now with 2FA) and snapchat so unless they had a hash to attack, or were brute forcing it (which snapchat should not allow) it stinks of a breach on their side to me. If I knew someone who worked in snapchat I'd kick it up the food chain in there.

surpy

Sorry , thought you said the second one was just an attempt.
Maybe tweet them?

Rucking_Fetard

Thousands of Snapchat images may have been hacked via a third-party image-saving service