The truth behind Snapchat “hack”

Well, it’s happened again. Another security breach, more embarrassing photos and films leaked all over the Web. Throw in privacy issues and possible child pornography charges and Cyber Security Awareness Month is getting off to a really bad start…or at least, to put a more positive spin on it, hopefully making people more aware.

“Snappening,” as its been called, which was revealed over the past weekend, is a breach involving users of a web site called SnapSaved.com and consists of approx. 90,000 photo’s and 9,000 videos  shared by as many as 200,000 Snapchat users.

SnapSaved.com, as you can probably tell by the description is a web service that allowed users to covertly save incoming message. The service did this by using your login credentials to access Snapchat’s servers and then store the images permanently on the SnapSaved servers.

Video

Staying Safe on Snapchat

Hackers managed to access the SnapSaved.com web site and steal the content that users had been storing there. While most of the content is reported to be of every day life there is of course some content that is more personal and inappropriate for viewing by anyone that it was not specifically meant for.

It’s important to understand that the hack was not on Snapchat’s servers.

It’s important to understand that the hack was not on Snapchat’s servers. Snapchat has built a growing and loyal user base on the promise that anything sent over its network disappears after a set period of time, typically a matter of seconds. This obviously promotes users sending material they would not send over other services and can possibly lead to people being a little more daring than they should be. You can read Snapchat’s reaction to these issues here.

The breach brings home the message that whatever you post online may well end up online forever and could be seen by people that it was not intended for. In fact recently we highlighted the potential issues that Snapchat users may have if someone decides to take a copy of something that was not intended to live beyond a few seconds. You can view the video for this here.

 

Here are some quick steps you can take:

  • Consider which third-party apps you and your family use. Clearly many of these apps have more vulnerability and less oversight than the actual services themselves. For the two bigger services, Facebook and Twitter, you can check: With Twitter, click on your profile image and select “Settings” and “Apps” to revoke access to applications you no longer use or do not trust. And for Facebook, in a browser, click the lock icon on the upper right corner and do a “Privacy Checkup” to review “Your Apps”. AVG PrivacyFix allows easy access to the privacy settings of major networks, you can download it here.
  • Review your Security Settings on all your programs. Consider who you are sharing information with, and who has access. Do you know whom your child has friended? Clearly there are trust and privacy issues here as well between you and your loved ones, but a healthy discussion is certainly not a step over the line.
  • Consider what content is being shared. It’s a matter of education that this content could be made public and may have value to hackers. This can be discussed with children in the same way you might discuss the danger in posting vacation plans or financial info.

 

We all need to be more vigilant in keeping our families, our businesses and ourselves safe and cyber-secure. And some the best tools we have are education, communication, and awareness.

SA-CORE-2014-005 – Drupal core – SQL injection

Description

Drupal 7 includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks.

A vulnerability in this API allows an attacker to send specially crafted requests resulting in arbitrary SQL execution. Depending on the content of the requests this can lead to privilege escalation, arbitrary PHP execution, or other attacks.

This vulnerability can be exploited by anonymous users.

CVE identifier(s) issued

  • CVE-2014-3704

Versions affected

  • Drupal core 7.x versions prior to 7.32.

Solution

Install the latest version:

If you are unable to update to Drupal 7.32 you can apply this patch to Drupal’s database.inc file to fix the vulnerability until such time as you are able to completely upgrade to Drupal 7.32.

Also see the Drupal core project page.

Reported by

  • Stefan Horst

Fixed by

Coordinated by

Contact and More Information

We’ve prepared a FAQ on this release. Read more at https://www.drupal.org/node/2357241.

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: 

CVE-2014-6453

Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2014-6467, CVE-2014-6545, and CVE-2014-6560.

CVE-2014-6456

Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

CVE-2014-6452

Unspecified vulnerability in the SQLJ component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2014-4298, CVE-2014-4299, CVE-2014-4300, CVE-2014-6454, and CVE-2014-6542.

CVE-2014-4298

Unspecified vulnerability in the SQLJ component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2014-4299, CVE-2014-4300, CVE-2014-6452, CVE-2014-6454, and CVE-2014-6542.

CVE-2014-4299

Unspecified vulnerability in the SQLJ component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2014-4298, CVE-2014-4300, CVE-2014-6452, CVE-2014-6454, and CVE-2014-6542.

CVE-2014-4296

Unspecified vulnerability in the JPublisher component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2014-4290, CVE-2014-4291, CVE-2014-4292, CVE-2014-4293, CVE-2014-4297, CVE-2014-4301, CVE-2014-4310, and CVE-2014-6547.

CVE-2014-4300

Unspecified vulnerability in the SQLJ component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2014-4298, CVE-2014-4299, CVE-2014-6452, CVE-2014-6454, and CVE-2014-6542.