Got hacked: Snapchat knew there was a problem but ignored it

SnapChat, a popular private messaging app, acknowledged on 2 January that it has been hacked. The user names and mobile numbers of nearly 4.6 million users were put online as a result. An anonymous group called Snapchat DB had posted the usernames and phone numbers of on New Year’s Eve, days after the startup brushed off warnings that its app still contained security loopholes. For the uninitiated, Snapchat is a application that allows users to send private messages that last for ten seconds. Users can send photos, videos or messages. Snapchat says that it does not save the snaps on its servers. On 27 December, Snapchat had written this blog post saying that a security group had posted about a possible attack via the Find Friends feature on the app which allows users to upload their contacts to Snapchat. Snapchat had dismissed the claims saying that the attack was possible but they had beefed up their security. The blogpost read, [caption id=“attachment_1320855” align=“alignleft” width=“380”] Snapchat logo in this fie photo. AFP[/caption] “This week, on Christmas Eve, a security group posted documentation for our private API. This documentation included an allegation regarding a possible attack by which one could compile a database of Snapchat usernames and phone numbers. Our Find Friends feature allows users to upload their address book contacts to Snapchat so that we can display the accounts of Snapchatters who match the phone numbers found in the address book. Theoretically, if someone were able to upload a huge set of phone numbers, like every number in an area code, or every possible number in the US, they could create a database of the results and match usernames to phone numbers that way. Over the past year we’ve implemented various safeguards to make it more difficult to do. We recently added additional counter-measures and continue to make improvements to combat spam and abuse.” Three days later, on 31st December, it was reported that the application had been hacked and that a group called Snapchat DB had posted the names and details online. Yesterday Snapchat put out a blogpost acknowledging the hacking but they did not apologise over the same. Instead it also pointed out that the concerns over a potential hacking had been raised as early as August 2013. Snapchat wrote, When we first built Snapchat, we had a difficult time finding other friends that were using the service. We wanted a way to find friends in our address book that were also using Snapchat – so we created Find Friends. Find Friends is an optional service that asks Snapchatters to enter their phone number so that their friends can find their username. This means that if you enter your phone number into Find Friends, someone who has your phone number in his or her address book can find your username. A security group first published a report about potential Find Friends abuse in August 2013. Shortly thereafter, we implemented practices like rate limiting aimed at addressing these concerns. On Christmas Eve, that same group publicly documented our API, making it easier for individuals to abuse our service and violate our Terms of Use. Snapchat has now said that they will release an updated version of the app which will allow users to opt out of appearing in the Find Friends feature. It has also promised better security in the future. It is particularly disappointing is that Snapchat has chosen not to apologise to its users for the hacking. The fact remains that the app and its creators were aware that such a hacking could take place and did nothing about it. The concerns were flagged off twice, in August and again in December and yet they did nothing to stop the hacking. For an app that was been voted as one of the top apps of 2013, for which Mark Zuckerberg wanted to pay close to $3 billion, the year 2014 could not have got off to a worse start.