Sunday, January 05, 2014

The Snapchat Leak

This was first published on the O'Reilly Radar
The number of Snapchat users by area code.
The number of Snapchat users by geographic location. Users are predominately located in New York, San Francisco and the surrounding greater New York and Bay Areas. 
While the site crumbled quickly under the weight of so many people trying to get to the leaked data—and has now been suspended—there isn't really such a thing as putting the genie back in the bottle on the Internet. Just before Christmas the Australian based Gibson Security published a report highlighting two exploits in the Snapchat API claiming that hackers could easily gain access to users’ personal data. Snapchat dismissed the report, responding that,

Theoretically, if someone were able to upload a huge set of phone numbers, like every number in an area code, or every possible number in the U.S., they could create a database of the results and match usernames to phone numbers that way.

Adding that they had various "safeguards" in place to make it difficult to do that. However it seems likely that—despite being explicitly mentioned in the initial report four months previously—none of these safeguards included rate limiting requests to their server, because someone seems to have taken them up on their offer.

Data Release

Earlier today the creators of the now defunct SnapchatDB site released 4.6 million records—both as an SQL dump and as a CSV file. With an estimated 8 million users (May, 2013) of the app this represents around half the Snapchat user base. Each record consists of a Snapchat user name, a geographical location for the user, and partially anonymised phone number—the last two digits of the phone number having been obscured. While Gibson Security's find_friends exploit has been patched by Snapchat, minor variations on the exploit are reported to still function, and if this data did come from the exploit—or a minor variation on it—uncovered by Gibson, then the dataset published by SnapchatDB is only part of the data the hackers now hold. In addition to the data already released they would have the full phone number of each user, and as well as the user name they should also have the—perhaps more revealing—screen name.

Data Analysis

Taking an initial look at the data, there are no international numbers in the leaked database. All entries are US numbers, with the bulk of the users from—as you might expect—the greater New York, San Francisco and Bay areas. However I'd assume that the absence of international numbers is  an indication of laziness rather than due to any technical limitation. For US based hackers it would be easy to iterate rapidly through the fairly predictable US number space, while "foreign" numbers formats might present more of a challenge when writing a script to exploit the hole in Snapchat's security. Only 76 of the 322 area codes in the United States appear in the leaked database, alongside another two Canadian area codes, mapping to 67 discrete geographic locations—although not all the area codes and locations match suggesting that perhaps the locations aren't derived directly from the area code data. Despite some initial scepticism about the provenance of the data I've confirmed that this is a real data set. A quick trawl through the data has got multiple hits amongst my own friend group, including some I didn't know were on Snapchat—sorry guys. Since the last two digits were obscured in the leaked dataset the partial phone number string might—and frequently does—generate multiple matches amongst the 4.6 million records against a comparison number. I compared the several hundred US phone numbers amongst my own contacts against the database—you might want to do that yourself—and generated several spurious hits where the returned user names didn't really seem to map in any way to my contact. That said, as I already mentioned, I found several of my own friends amongst the leaked records, although I only knew it was them for sure because I knew both their phone number and typical choices of user names.

Conclusions

As it stands therefore this data release is not—yet—critical, although it is certainly concerning, and for some individuals it might well be unfortunate. However if the SnapchatDB creators choose to release their full dataset things might well get a lot more interesting. If the full data set was released to the public, or obtained by a malicious third party, then the username, geographic location, phone number, and screen name—which might, for a lot of people, be their actual full name—would be available. This eventuality would be bad enough. However taking this data and cross-correlating it with another large corpus of data, say from Twitter or Gravatar, by trying to find matching user or real names on those services—people tend to reuse usernames on multiple services after all—you might end up with a much larger aggregated data set including email addresses, photographs, and personal information. While there would be enough false positives—if matching solely against user names—that you'd have a interesting data cleaning task afterwards, it wouldn't be impossible. Possibly not even that difficult. I'm not interested in doing that correlation myself. But others will.

119 comments:

  1. Great work man i would like to congratulate you on this effort http://mrleakdetection.com/

    ReplyDelete
  2. It’s an interesting approach. I commonly see unexceptional views on the subject but yours it’s written in a pretty unusual fashion. Surely, I will revisit your website for additional information. snapscore kopen

    ReplyDelete
  3. When your website or blog goes live for the first time, it is exciting. That is until you realize no one but you and your.Recover my hacked snapchat account

    ReplyDelete
  4. I am impressed by the information that you have on this blog. It shows how well you understand this subject.
    data analytics course
    data science course
    big data course in malaysia
    360DigiTMG
    big data analytics training in malaysia

    ReplyDelete
  5. Excellent post.I want to thank you for this informative read, I really appreciate sharing this great post.Keep up your work
    data science course
    360DigiTMG

    ReplyDelete
  6. can you want to remove your account SO READ THIS ARTICLE IT,S HELP you alot
    Delete Snapchat Account

    ReplyDelete
  7. Here it about precision of comprehension and to be inventive. smm panel

    ReplyDelete
  8. Great job! I would like to say that this is a well-written article as we are seen here. This article is very useful and I got so much information about it. Thanks for sharing this article here. can you make money on Snapchat

    ReplyDelete
  9. Anonymous8:14 am

    I will truly value the essayist's decision for picking this magnificent article fitting to my matter.Here is profound depiction about the article matter which helped me more.
    data analytics course

    ReplyDelete
  10. I think I have never watched such online diaries ever that has absolute things with all nuances which I need. So thoughtfully update this ever for us.
    difference between analysis and analytics

    ReplyDelete
  11. I see some amazingly important and kept up to length of your strength searching for in your on the site
    data science course

    ReplyDelete
  12. Somebody Sometimes with visits your blog normally and prescribed it as far as I can tell to peruse too.
    iot training in delhi

    ReplyDelete
  13. Extremely overall quite fascinating post. I was searching for this sort of data and delighted in perusing this one. Continue posting. A debt of gratitude is in order for sharing.Best data analytics course in Hyderabad

    ReplyDelete
  14. I see some amazingly important and kept up to length of your strength searching for in your on the site
    hrdf contribution

    ReplyDelete
  15. Snapchat is an engaging and fun way to remain in touch friends by look at this website sharing countless crazy images and videos. The images can vary either being taken at school, at the mall or even the bathroom.

    ReplyDelete
  16. Extremely overall quite fascinating post. I was searching for this sort of data and delighted in perusing this one. Continue posting. A debt of gratitude is in order for sharing.data science course in Hyderabad

    ReplyDelete
  17. Anyway regardless of all the (not very great) measurements I actually think it is as yet a smart thought for business to utilize social media only not similarly that a ton of SMM experts are today, Why? Since it's obviously not working in the manner they guarantee it does. tt video download

    ReplyDelete
  18. https://www.buy-snapscore.com/ to purchase snapscore

    ReplyDelete
  19. Stunning! Such an astonishing and supportive post this is. I incredibly love it. It's so acceptable thus wonderful. I am simply astounded.
    masters in artificial intelligence

    ReplyDelete
  20. It is the intent to provide valuable information and best practices, including an understanding of the regulatory process.
    Digital Marketing Courses in Hyderabad With Placements

    ReplyDelete
  21. Yet, on the off chance that there is a deferral, at that point the snap can not, at this point be seen. look at this

    ReplyDelete
  22. Thanks For sharing a nice post about Course.It is very helpful and useful for us.data science courses

    ReplyDelete
  23. Hello, I have browsed most of your posts. This post is probably where I got the most useful information for my research. Thanks for posting, maybe we can see more on this. Are you aware of any other websites on this subject?
    snapchat points generator

    ReplyDelete
  24. keep up the good work. this is an Ossam post. This is to helpful, i have read here all post. i am impressed. thank you. this is our site please visit to know more information
    data science training

    ReplyDelete
  25. I need to communicate my deference of your composing aptitude and capacity to make perusers read from the earliest starting point as far as possible. I might want to peruse more up to date presents and on share my musings with you.
    https://360digitmg.com/course/certification-program-on-big-data-with-hadoop-spark

    ReplyDelete
  26. I utilized Google and YouTube to bring each snippet of data that I could to begin with snapchat lastly downloaded the application from play store. As I investigated the application symbol it streaked me back into the early long periods of the 21st century when I began utilizing Facebook and everybody around was eager to make new companions and offer pictures and recordings. SMM Panel

    ReplyDelete
  27. I just got to this astounding site in the no so distant past. I was really caught with the bit of assets you have here. Huge approval for making such superb blog page!
    data scientist training

    ReplyDelete
  28. That is the reason the photographs can't stay labeled up yet they end up related with the separate individual on the Facebook for eternity. Consequently, there can be no limitation towards sharing of any different kinds of substance whatsoever. Resurge Tablets Uk

    ReplyDelete
  29. However, this may not be the case with training artificial intelligence because all we need is a simple program, which reverses or erases the imprinted data sets, which are incorrect. data science course in india

    ReplyDelete
  30. Nonetheless, as a rule, objections identified with working conditions are secured. check out your url

    ReplyDelete
  31. Basically all social media stages give the usefulness to tweak the interface and consolidate your own marking.smm panel

    ReplyDelete
  32. Very informative content and intresting blog.Data science course in Thiruvananthapuram

    ReplyDelete
  33. I am glad to discover this page. I have to thank you for the time I spent on this especially great reading !! I really liked each part and also bookmarked you for new information on your site.
    Data Science Training in Chennai

    ReplyDelete
  34. Thanks for posting the best information and the blog is very informative.Data science course in Faridabad

    ReplyDelete
  35. Thank you for excellent article.You made an article that is interesting.
    data science course in noida

    ReplyDelete
  36. will get you some site traffic, but it is only restricted to the audience who already know and need your business. More effort than that is required to achieve significant success. try this out

    ReplyDelete
  37. Very awesome!!! When I searched for this I found this website at the top of all blogs in search engines.
    Digital Marketing Training Institutes in Hyderabad

    ReplyDelete
  38. Thanks for posting the best information and the blog is very helpful.Data science course in Varanasi

    ReplyDelete

  39. Thank you so much for sharing this article. I really love it. This is a very nice one and gives in-depth information. I am really happy with the quality and presentation of the article. I’d really like to appreciate the efforts you get with writing this post. Thanks for sharing.
    website: Matka Result

    ReplyDelete
  40. Watch movies online sa-movie.com, watch new movies, series Netflix HD 4K, watch free movies on your mobile phone, Tablet, watch movies on the web. ดูหนังออนไลน์


    SEE4K Watch movies, watch movies, free series, load without interruption, sharp images in HD FullHD 4k, all matters, all tastes, see anywhere, anytime, on mobile phones, tablets, computers. ดูหนังใหม่


    GangManga read manga, read manga, read manga online for free, fast loading, clear images in HD quality, all titles, anywhere, anytime, on mobile, tablet, computer. อ่านการ์ตูน


    Watch live football live24th, watch football online, link to watch live football, watch football for free. ผลบอลสดa

    ReplyDelete
  41. samudra slot merupakan situs judi slot online terpercaya Indonesia yang menyediakan permainan slot games terlengkap bet kecil jackpot besar sangat mudah menang free spin dan bigwin online 24 Jam.

    ReplyDelete


  42. I really want to appreciate the way to write this
    omni-channel
    ivrs
    ip-pbx

    ReplyDelete
  43. During the last century ,CBD Cannabis has been called a "marihuna", a term that precedes negative connotations

    ReplyDelete
  44. I just would like to give a huge thumbs up for the great info you have here on this post. Thanks for sharing with us. Are you looking for Escort Services in Ahmedabad and Call Girls in Ahmedabad
    Click For More Information Hire Call Girls Ahmedabad

    ReplyDelete
  45. Play in Thailand We are on top Of the country in the popular GGpoker game

    ReplyDelete
  46. Our Data Science course in Hyderabad will also help in seeking the highest paid job as we assist individuals for career advancement and transformation. We carefully curate the course curriculum to ensure that the individual is taught the advanced concepts of data science. This helps them in solving any challenge that occurs. Along with that, we also make students work on real case studies and use-cases derived. data science course in hyderabad

    ReplyDelete
  47. it is not the most popular on this list, but fans do love its benefits ดูบอลฟรี . One of these is that no sign up is required, but you can sign up for free to get some convenient options. For instance, it provides intelligent content recommendations and a calendar for you to set up reminders. That way, you never miss your favorite live content. If you do miss it, though, you can always pull it up on Duball24hrs.com recordings.

    ReplyDelete
  48. เราคือผู้นำด้านเกมพนันออนไลน์ Major168 เราคือผู้ให้บริการ คาสิโนออนไลน์ ที่ได้รับรองว่าดีที่สุดในประเทศไทย มีค่ายเกมส์ให้เล่นมากมาย Sagaming, Sexy bacarat, Dreamgame, Ebet, Wm casino, Vivo gaming ไม่ผ่านเอเย่นต์ ระบบปลอดภัยมีทีมงานดูแลตลอด 24ชม.

    SAGAME88 แหล่งรวมเกมส์พนันออนไลน์ คาสิโนสด บาคาร่า กำถั่ว คาสิโนออนไลน์ ไฮโล รูเล็ต รับเครดิตฟรีเล่นได้ทุกเกมส์ โบนัสสมาชิกใหม่เพียบ พร้อมระบบฝากถอนออโต้ 10วิ เรามีทุกค่ายเกมส์ให้คุณเลือกเดิมพัน SA Game Sexy bacarat Dreamgame WM Casino VIVO Gaming Ebet เล่นได้ทุกเกมส์

    Our website ufabet provides betting services in the system of Auto Deposit-Withdrawal. Our members are not only in Thailand. Online football betting UEFA Bet market And this makes a guarantee that Ufabet168 is another reliable football betting website

    ufa through the website UFABET1688 a web gambling online , one that integrated all the bets from online casinos , online casino , online , and also have a game a lot more to be chosen to play such games.


    ReplyDelete

  49. I am really happy to say it’s an interesting post to read . I learn new information from your article , you are doing a great job . Keep it up

    Devops Training in Hyderabad

    Hadoop Training in Hyderabad

    Python Training in Hyderabad

    Tableau Training in Hyderabad

    Selenium Training in Hyderabad

    ReplyDelete
  50. Very awesome!!! When I searched for this I found this website at the top of all blogs in search engines.

    Best Data Science courses in Hyderabad

    ReplyDelete
  51. Because our ufabet website system is an automatic deposit system. Therefore having to bother customers who transfer money to Do not save your account number as a favorite. Always fill in to transfer by yourself. Because the system may change the deposit account It is very important that customers view the transfer balance every time.

    ReplyDelete
  52. I think I have never seen such blogs before that have completed things with all the details which I want. So kindly update this ever for us.

    business analytics course

    ReplyDelete
  53. I am looking for this informative post thanks for share it. We have an online store of liposuction Instruments. We are offering worldwide free shipping on every order.
    General Suction Cannulas
    Cannulas & Injectors
    Cell Friendly Injectors
    Harvesting Cannulas
    Specialty Cannulas

    ReplyDelete
  54. We are very thankful for share this informative post. Buy real leather jackets, Motogp Leather Suits & Motogp Leather Jackets with worldwide free shipping.
    Motogp Leather Suits
    Motogp Leather Jacket
    Sheepskin Jackets
    Shearling Jacket

    ReplyDelete
  55. It is the intent to provide valuable information and best practices, including an understanding of the regulatory process.

    best data science institute in hyderabad

    ReplyDelete
  56. everyone can buy targeted telegram members from adsmember and
    Buy Telegram Post Views will helps you to increase your impression!

    ReplyDelete
  57. Recommend how to play the game The most popular card game in the planet, but for anybody looking for fun with card video games. Get ready to go with prominent sites from around the world. Ready to give you the task And online gambling poker tournaments In addition, it features a bonus. เล่น poker เว็บไหนดี, given to the racers of ours that are ready to battle in a significant tournament worth having fun with information from real professionals from the fundamental competition with a good deal of experience We offer chip exchange services for players. All over Thailand is able to line of us and notify Games you wish to play instantly.

    ReplyDelete
  58. The Epson Printer Error 0XE8 error may begin due to Windows system file loss. If you have the bad system file records, it may be a different cause for this error. Visit blog for comple solution.

    Follow Our Web: Epson Printer Error 0XE8

    ReplyDelete
  59. It is extremely nice to see the greatest details presented in an easy and understanding manner.
    business analytics course

    ReplyDelete

  60. Nice post. I used to be checking constantly this blog and I am impressed! Extremely useful info particularly the ultimate section 🙂 I take care of such information a lot. I was seeking this certain information for a long time. Thank you and best of luck.
    online classes advantages and disadvantages essay

    ReplyDelete
  61. Nice information Visit our store jackets

    ReplyDelete
  62. Nice information Visit our store jackets

    ReplyDelete
  63. Nice information Visit our store jackets

    ReplyDelete
  64. Very Nice Information
    Thanks for Sharing with us

    ReplyDelete
  65. I would want to explain you how I could locate my wife's dreams and how my achievement may be repeated. Everything began when it was time for me to locate a spouse and to establish a family. Family and friends were already quite angry at the strain. Finally I found an amazing site that enabled me to acquire authentic legit mail order brides . There are a large number of females on this website, where everybody will discover their perfect. I found a really clever and gorgeous girl for me. You won't leave without a second half) I suggest this site to anyone, and I advise everyone!

    ReplyDelete
  66. Fantastic beat ! I wish to apprentice even as you amend your web site, how can i subscribe for
    a blog web site? The account helped me a appropriate deal. I have been a little bit acquainted of this your broadcast offered brilliant clear concept. ยูฟ่าสล็อต

    ReplyDelete
  67. If you are looking for mrsa nursing assignment help, then you are at right stop. We offer you the best academic writing services including the help you need to create a nursing assignment. Check our website for more information.

    ReplyDelete
  68. Connect Dubai Fun Club for premium Dubai Escorts and entertainment services. You can easily find the best call girls in Dubai on our website

    ReplyDelete
  69. HDhub4u Tamil creates HD along with a high-quality print of newly launched films to this is customers. This particular site is famous for offering Telugu flicks on the very next day of the release of films. hdhub4u has been building a name for themselves since the website's begging in season 2017.

    ReplyDelete
  70. Fantastic article I ought to say and thanks to the info. Instruction is absolutely a sticky topic. But remains one of the top issues of the time. I love your article and look forward to more.
    Data Science Course in Bangalore

    ReplyDelete
  71. Its always nice and i feel honored reading your Blog . thesis writing help singapore

    ReplyDelete
  72. WatchCartoonOnline has its server located inside European nations. It offers worldwide businesses inconspicuously English-talking nations, aside from the US, UK, and Australia, to administer several examples. The internet website has been thought of to face individual time that continues on for an interesting span.

    ReplyDelete
  73. Nice post! This is a very nice blog that I will definitively come back to more times this year! Thanks for informative post.
    business analytics course




    ReplyDelete
  74. A penalty APR may apply when your payment is more than 60 days late or you've had a returned payment. Penalty APRs are typically higher than your purchase APR. However, your issuer is required to review your account at least every six months to determine if your APR can be lowered after a good payment history.
    fishyfacts4u.com
    fishyfacts4u.com
    fishyfacts4u.com
    fishyfacts4u.com
    fishyfacts4u.com
    fishyfacts4u.com
    fishyfacts4u.com
    fishyfacts4u.com
    fishyfacts4u.com
    fishyfacts4u.com

    ReplyDelete
  75. Zyro website builder, an easy solution for your web building projects. While being relatively new in the business, Zyro already has made a name for itself for being an innovative and simple way to build a great-looking website with relative ease.
    emagazinehub.com
    emagazinehub.com
    emagazinehub.com
    emagazinehub.com
    emagazinehub.com
    emagazinehub.com
    emagazinehub.com
    emagazinehub.com
    emagazinehub.com
    emagazinehub.com

    ReplyDelete
  76. Very nice post. Thanks for sharing.If you want to translate Chinese written passport into English then you should hire Chinese to English translation from Singapore translators.Here,well versed team of translators deliver you error free translation at budget friendly price.

    ReplyDelete


  77. Thanks for your nice post I really like it and appreciate it. Assignment help pro offer you
    Assignment help to Canadian students at good price . Try our best writing services to get excellent marks in academics.

    ReplyDelete
  78. The Chase Sapphire Preferred Card can make a lot of sense if you're seeking your first travel credit card. The annual fee is relatively low compared with other travel cards and pays for itself with the sign-up bonus.

    inewshunter.com
    inewshunter.com
    inewshunter.com
    inewshunter.com
    inewshunter.com
    inewshunter.com
    inewshunter.com
    inewshunter.com
    inewshunter.com
    inewshunter.com

    ReplyDelete
  79. And ultimately, "the honest taxpayer is paying for that evasion and avoidance," says Steven Balsam, accounting professor at Temple University's Fox School of Business in Pennsylvania.

    juicyfactor.com
    juicyfactor.com
    juicyfactor.com
    juicyfactor.com
    juicyfactor.com
    juicyfactor.com
    juicyfactor.com
    juicyfactor.com
    juicyfactor.com
    juicyfactor.com

    ReplyDelete
  80. To receive a child tax credit, you'll have to file a federal tax return. Those who receive advance payments in 2021 will also need to file a 2022 federal tax return to reconcile the amount they received with the amount they were due.

    localnewsbuzz.com
    localnewsbuzz.com
    localnewsbuzz.com
    localnewsbuzz.com
    localnewsbuzz.com
    localnewsbuzz.com
    localnewsbuzz.com
    localnewsbuzz.com
    localnewsbuzz.com
    localnewsbuzz.com

    ReplyDelete
  81. Taking Assignment Help Online to meet deadlines is the most common reason. If you are also a late runner you can understand how it feels like when you are on the verge of missing a deadline. We suggest such students divide assignment tasks into smaller chunks and then work on them slightly every day to avoid the last-minute hassle.

    ReplyDelete
  82. Thank you quite much for discussing this type of helpful informative article. Will certainly stored and reevaluate your Website.
    Data Analytics Course in Bangalore

    ReplyDelete
  83. Get our online Homework Help if you are finding it hard to complete your assignments with extreme accuracy and within the deadline. We have a team of professionals who can help you write exclusive and authentic content from scratch.

    ReplyDelete
  84. Data is very important to us and we should save our data from hackers because they can use it for wrong purpose. So, we should follow good tips and ensure our safety. Cheap dissertation writing service.

    ReplyDelete
  85. Very wonderful informative article. I appreciated looking at your article. Very wonderful reveal. I would like to twit this on my followers. Many thanks! .
    Data Analytics training in Bangalore

    ReplyDelete
  86. You can make a short video by holding the round-formed record symbol, and one can snap a picture by tapping the telephone screen. In addition, you can add illustrations, emoticons, shadings or text, etc. https://sites.google.com/view/instagramfollowersbuy/

    ReplyDelete
  87. Nice to be seeing your site once again, it's been weeks for me. This article which ive been waited for so long. I need this guide to complete my mission inside the school, and it's same issue together along with your essay. Thanks, pleasant share.
    Data Science training in Bangalore

    ReplyDelete
  88. Fantastic article I ought to say and thanks to the info. Instruction is absolutely a sticky topic. But remains one of the top issues of the time. I love your article and look forward to more.
    Data Science Course in Bangalore

    ReplyDelete
  89. Thank you quite much for discussing this type of helpful informative article. Will certainly stored and reevaluate your Website.
    Data Analytics Course in Bangalore

    ReplyDelete
  90. The kilt represents Celtic Pride; we here at Scottish Kilt Collection are proud to be a leading supplier of kilts for men and women all around the world.
    Tactical Kilt

    ReplyDelete
  91. Nice to be seeing your site once again, it's been weeks for me. This article which ive been waited for so long. I need this guide to complete my mission inside the school, and it's same issue together along with your essay. Thanks, pleasant share.
    Data Science training in Bangalore

    ReplyDelete
  92. Tremendous blog quite easy to grasp the subject since the content is very simple to understand. Obviously, this helps the participants to engage themselves in to the subject without much difficulty. Hope you further educate the readers in the same manner and keep sharing the content as always you do.

    data science course in faridabad

    ReplyDelete
  93. Very wonderful informative article. I appreciated looking at your article. Very wonderful reveal. I would like to twit this on my followers. Many thanks! .
    Data Analytics training in Bangalore

    ReplyDelete
  94. Thanks for Sharing this Valuable Information with us: this is very useful for me. Keep it Up. Trending Blogs India 2021, Most Popular Blog Topics India 2021, Trending Topics in India 2021
    Visit here - india and china latest news

    ReplyDelete
  95. B3 Bomber Jacket For Sale - Free Shipping and Best Deal
    Men consistently partial to skins and hides due to the fact the start of timethey utilized it to insure by themselves and safeguard them by your cold temperatures.
    Now shearling coats, Real Leather Bomber Jackets, Buy Harley Davidson Leather Motorcycle Jackets holds probably the best legacy , masculinity along with ruggedness to get a guys outer wear.

    ReplyDelete