195 matches found
When a sextortion victim fights back
When Katie Yates suddenly started receiving nude photos of her friend, Natalie Claus, over on Snapchat, she instantly recognized that Claus had just become a victim of a sextortion attack. She also knew how Claus should respond. This happened in December 2019 when Claus was a sophomore. Both were...
Malicious code in snapchat-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0bf56ac542e7ed96b3691742a2e3316caeb4e7d516f39f5086cb9972694738c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6187 Malicious code in snapchat-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0bf56ac542e7ed96b3691742a2e3316caeb4e7d516f39f5086cb9972694738c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-2924 Malicious code in express-4.x-passport-snapchat-example (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d0ca6535a564c08a2ffa5c45fb5ec728ccbdb49e6b49c6dcea0320b08f6bae7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Snap-Scraper - Snap Scraper Enables Users To Download Media Uploaded To Snapchat's Snap Map Using A Set Of Latitude And Longitude Coordinates
Snap Scraper is an open source intelligence tool which enables users to download media uploaded to Snapchat's Snap Map using a set of latitude and longitiude co-ordinates. This project is in no way affiliated with, authorized, maintained, sponsored or endorsed by Snap inc. or any of its affiliate...
How to delete your Snapchat account
Snapchat is an instant messaging app popular with youngsters that allows users to send pictures and videos that are only viewable for short periods. But while hundreds of millions of daily active users consume and create content with Snapchat, not everyone is pleased with the mobile app. One of t...
Another Hacker Arrested for 2020 Twitter Hack and Massive Bitcoin Scam
A U.K. citizen has been arrested in the Spanish town of Estepona over his alleged involvement in the July 2020 hack of Twitter, resulting in the compromise of 130 high-profile accounts. Joseph O'Connor, 22, has been charged with intentionally accessing a computer without authorization and obtaini...
Snapchat: CSRF when unlocking lenses leads to lenses being forcefully installed without user interaction
Hi, The url below allows a user to unlock a particular lens. Once they have opened the URL on their phone, Snapchat opens up and prompts the user to unlock this lens. https://www.snapchat.com/unlock/?type=SNAPCODE&uuid=6ff5a565fca249a1948b1963ee2881b4&metadata=01 By changing the value of type in...
Snapchat: Improper Authentication - any user can login as other user with otp/logout & otp/login
'/scauth/otp/droid/logout' request contains userid parameter. Usually it is equal to current user userid, but if an attacker passes userid of victim account he can login as victim. I will demonstrate the problem on two accounts. Victim: ███ Attacker: ██████████ - Attacker perform a usuall login t...
Snapchat: Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.io
Researcher found valid jFrog credentials which were committed to a public Github repository of a Snap employee. This allowed access to internal Snap libraries/artifacts along with the ability to push updates to existing artifacts as well...
Snapchat: CreatorID leaked from public content posted to SnapMaps
TL;DR - the Snap Map media responses unnecessarily return a creatorId. The creator's Snap username cannot be immediately derived from creatorId, but users can use the creatorId to correlate multiple public snaps with that creator. The impact is limited by the fact that all Our Story Snaps that...
Socialscan - Check Email Address And Username Availability On Online Platforms With 100% Accuracy
socialscan offers accurate and fast checks for email address and username usage on online platforms. Given an email address or username, socialscan returns whether it is available, taken or invalid on online platforms. Features that differentiate socialscan from similar tools e.g. knowem.com,...
Snapchat: Bypass Rate Limits on app.snapchat.com API Endpoint via X-Forwarded-For Header
An attacker can bypass the rate limiting in place at app.snapchat.com by setting the X-Forwarded-For header to 127.0.0.1 in POST requests to app.snapchat.com/storieseverywhere/downloadsms and several other endpoints. This bypasses the controls in place for this endpoint, which appears to have...
How to Control the Privacy of Your Facebook, Instagram, Twitter, and Snapchat Posts
Whether it's Facebook, Instagram, Twitter, or Snapchat, lock down who can see what you're up to...
Snapchat: Access to multiple production Grafana dashboards
@damian89 found a production Grafana instance which displayed confidential metrics inside various dashboards. While fuzzing patterns of certain snapchat related projects, I was able to find an instance of Grafana which was accessible by a guest user. That instance contained hundreds of production...
Student uses Snapchat’s gender filter to bust pervert cop
By Uzair Amir The cop thought he was talking to an underage girl but it was a grown-up man using Snapchat’s gender filter. A 20-year old student from California’s San Francisco Bay Area used the much-criticized gender-swapping filter of Snapchat to catch a 40-year old police officer. According to...
Snapchat Employees Reportedly Spied on Private Snaps
Baltimore ransomware, a Trump golf hack, and more of the week's top security news...
Snapchat Privacy Blunder Piques Concerns About Insider Threats
Snap, the company behind the popular Snapchat social media app, has found itself in hot water after a recent report revealed that Snap employees were abusing their access to private user data – which includes location data, saved Snaps and phone numbers. According to a Thursday Motherboard report...
Snapchat: Server-Side Request Forgery using Javascript allows to exfill data from Google Metadata
Hey there, I was looking at your ads site with @daeken, we found some weird behavior in the import function of the creative app. Here are the steps: POC - Login to https://business.snapchat.com/ - Go to creative library - New Creative - Under "Topsnap Media", click on "Create" - Click on any of t...
