{"id":33284,"date":"2014-02-12T17:17:50","date_gmt":"2014-02-13T01:17:50","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=33284"},"modified":"2025-08-07T23:38:48","modified_gmt":"2025-08-08T06:38:48","slug":"snapchat-security-flaw","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/snapchat-security-flaw\/","title":{"rendered":"Crash & Burn: Snapchat Security Flaws Strike Again"},"content":{"rendered":"

Snapchat, the photo-sharing app that lets users send and receive photos that disappear after being viewed, has come under its fair share of fire recently. In January, the company was criticized for ignoring a security flaw that allowed 4.6 million user names and phone numbers<\/a> to be leaked to the public. This month, another security flaw has been discovered. This time, the flaw allows for hackers to flood a single Snapchat account with thousands of messages\u2014freezing the device and forcing a reboot.<\/p>\n

The type of attack described above is referred to as a denial-of-service attack.<\/em> These types of attacks consist of efforts by cybercriminals to temporarily or indefinitely interrupt a service\u2014in this case, that service is Snapchat.<\/p>\n

When a user sends a message through Snapchat, a unique code made up of letters and numbers (called a token) is generated to verify their identity. These tokens are supposed to change for each sent message, however, researchers have discovered that hackers may be able to reuse old tokens to send massive amounts of new messages in a very short period of time. This flaw in the Snapchat security architecture could be exploited by hackers looking to send mass quantities of messages to numerous users or to launch an attack on a specific individual. It should be noted here that this attack can only be executed on users who have chosen to add the attacker to their Snapchat list of friends.<\/p>\n

So, what do cybercriminals have to gain by putting a halt on your favorite selfie app, only to have you boot it back up again once you restart your phone? The jury\u2019s still out on that one, as this attack hasn\u2019t yet been practiced en masse. In fact, this vulnerability was only just discovered by a security researcher<\/a> eager to demonstrate the potential weaknesses in the Snapchat app, not because of an actual reported attack.<\/p>\n

After ignoring warnings from security professionals<\/a> in December, it appears as though the photo-sharing app hasn\u2019t earned itself the best reputation among experts in the field. Jaime Sanchez, the security researcher who discovered this latest weakness, says he did not contact Snapchat about the vulnerability because he claims<\/a> the Los Angeles-based startup has no respect for the cyber security research community.<\/p>\n

Tips to Avoid A Denial-of-Service Attack<\/h2>\n

Whether or not cybercriminals do in fact have a desire to exploit this bug, Snapchat would be wise to take notice, and so would you. Here are some tips to help you avoid a denial-of-service attack on your device:<\/p>\n