Why can we still crack snapchat photos in 12 lines of Ruby?

Question

Just came across this bit of ruby that can be used to decrypt Snapchat photos taken out of the cache on a phone, apparently adapted from here. To my surprise, it worked without a problem, considering the problems around Snapchat's security which have been well publicized lately (Mostly the stuff around the whole phone number/username leak as far as I recall).

require 'openssl'

ARGV.each do|a, index|
    data = File.open(a, 'r:ASCII-8BIT').read
    c = OpenSSL::Cipher.new('AES-128-ECB')
    c.decrypt
    c.key = 'M02cnQ51Ji97vwT4'
    o = ''.force_encoding('ASCII-8BIT')
    data.bytes.each_slice(16) { |s| o += c.update(s.map(&:chr).join) }
    o += c.final
    File.open('decyphered_' + a , 'w') { |f| f.write(o) }
end

So, my question is, what exactly are they doing wrong here, and what could they be doing better in order to improve the security of their application in this regard rather than what they're doing now, considering that people often send intimate things that were never meant to be shared for longer than 10 seconds only to one person, and also considering the popularity of this app?

tldr/for all those who don't really care to know how computers work but still want to know what is up: Basically, let's say you have 40 million people who use Snapchat, with 16.5 million users sending each other pictures, and each picture in its own tiny locked safe every day. Now, what if you gave those 16.5 million people all the same flimsy, plastic key to open each and every one of these lockboxes to capture the Snapchat media?

Glorfindel

2,3036 gold badges22 silver badges30 bronze badges

asked Mar 3, 2014 at 8:53

4

kiBytes 3,47819 silver badges26 bronze badges · Accepted Answer

This is a serious problem in password-management. The first problem here is the way they managed his key in their source code. SnapChat states that they send the photos encrypted over internet, and it is true after all, but they are using a "pre-shared" key to encrypt this data (badly using also AES in ECB mode) so, every user around the planet has the key to decipher each photo.

The problem here is, how did internet get the key? Piece of cake, they just included it in every app, and somebody just searched for it.

What is this magic encryption key used by any and all Snapchat app?

M02cnQ51Ji97vwT4

You can find this (in the Android app) in a constant string located
in com.snapchat.android.util.AESEncrypt; no digging required, it is
quite literally sitting around waiting to be found by anyone.

On a more positive note (perhaps), in the 3.0.4 (18/08/2013) build
of the Android app, there is - oddly enough - a second key!

1234567891123456

It is a very bad practice to hardcode a password in your source (no matter if it is in your headers or in your binaries), the main problem being anyone could find it with a simple "strings" command into your binary (or by looking in someplace you used to share your code with your friends):

strings binaryFile

Then the malicious user can have a look to each string and check if that is the password he is looking for. So, if your really need to hardcode a password in your code you better hide it, but this will just be "security through obscurity" and the malicious user will end up finding the key (so you better think in a different approach).

What can they do to improve their security? Well they could have generated a key for each photo, or they can pre-share a key between the clients that are going to share a picture, public/private keys; there are plenty of options.

You must log in to answer this question.