Snapchat Phone Number Database Leaked

http://www.snapchatdb.info

by lightcontact • 13 years ago

398 204 13 years ago

aabalkan• 13 years ago

It's taking too much time to download each file even they're 40 MB. I wish they put it on as torrent in the first place.

Regarding the leak, yeah, that actually happens when you focus on the product but security and reliability of your system. Snapchat, Whatsapp and many others are hacked numerous times and yet it still happens.

belluchan3• 13 years ago

I do not wish they would torrent this. People, think about it. Personal, private phone numbers. Why would you want this information? Seriously the comments here make me sad for humanity right now.

awwducks• 13 years ago

Agreed. I get that a lot of these responses may be knee-jerk, but that doesn't excuse it.

xtirpation• 13 years ago

Torrent or not, I want to see if any of my less tech-savvy friends are on the list so I can warn them even though I don't use Snapchat myself. It's much easier to convince them there's a real problem if I can say "Look, I can get your phone number and username from the Internet just like that" rather than explaining theoretical reasons why they're vulnerable.

TylerE2• 13 years ago

Phone numbers are hardly private information.

babby2• 13 years ago

Why would you want this information? Hacker News Hacker

rosser• 13 years ago

Why would you want this information?

Perhaps to see if one's own number is among those leaked?

NicoJuicy• 13 years ago

leaking this data to the public could do more for us then ignoring it ;-)

smtddr5• 13 years ago

>The company was too reluctant at patching the exploit until they knew it was too late

Did they give Snapchat enough time to fix this before releasing this data?

NOTE: I've heavily edited this comment because when I first read the website I thought snapchat ignored the people who found an exploit but re-reading, it's no longer clear to me that releasing this data is not pure malice.

NOTE2: The link from couchdive's comment makes this more interesting - http://www.zdnet.com/researchers-publish-snapchat-code-allow... - but still, the webpage hosting the data said the exploit was fixed, so it wasn't ignored, so... I don't know what the purpose of releasing this data was.

belluchan3• 13 years ago

Why would you donate to these people? Because they're hurting Snapchat users? What is wrong with the people posting in this thread like this is some kind of good thing? Real people can be hurt by this.

w-ll2• 13 years ago

Maybe no one would ever send him snaps. Either Way I find it more disturbing that an address he claims to own [1] is on this list [2]

1. https://news.ycombinator.com/user?id=smtddr

2. https://github.com/mikispag/bitiodine/blob/master/classifier...

couchdive3• 13 years ago

For more info. http://www.zdnet.com/researchers-publish-snapchat-code-allow...

pedalpete• 13 years ago

What does snapchatdb hope to accomplish by allowing people to download the db. Just showing and proving that you've hacked the database should be enough to get the company to respond. They're probably not hurting snapchat as much as the potential damage to the people who's phone numbers and usernames are being dowloaded.

obstacle1• 13 years ago

Wasn't there a story posted right here on HN like a week ago where some people notified snapchat of the vuln. and provided evidence, but Snapchat told them to basically f* off?

I'm not savvy enough to have the link at hand but I vividly remember that happening.

jkelsey3• 13 years ago

Just a quick Google search: http://guardianlv.com/2013/12/snapchat-ignores-possible-hack...

couchdive3• 13 years ago

Yes 6 days ago. The exploit was brought to snapchats attention since August and ignored and denied, so says the articles related to this.

jared314• 13 years ago

Previous Discussions:

https://news.ycombinator.com/item?id=6962329 (6 days ago)

https://news.ycombinator.com/item?id=6970036 (4 days ago)

mlyang• 13 years ago

according to the snapchatdb page, they've blurred the last two numbers of the phone numbers so as to not cause complete damage.

belluchan3• 13 years ago

Looks like they are using WhoIsGuard to protect the domain whois information. The terms of WhoIsGuard[1] include not violating the privacy of others:

defame, abuse, harass, threaten or otherwise violate the legal rights (such as rights of privacy and publicity) of others;

I've sent WhoIsGuard an email. Hopefully they'll revoke service. Shame on the people that published this private information. They aren't hurting just Snapchat. Revealing personal information like this can cause real problems for people.

[1] http://www.whoisguard.com/legal-tos.asp

jkelsey3• 13 years ago

Hrm... it's New Years Eve and people have taken off early, and I suspect that WhoIsGuard doesn't have round the clock support coverage. Disclaimer: pure speculation, but I think its fair to say the timing was strategic.

sneak• 13 years ago

Shame on the people that published this private information.

That would be Snapchat.

Stop trying to censor stuff that's already out there.

http://en.wikipedia.org/wiki/Streisand_effect

rdl2• 13 years ago

Actually in this case the absolute best thing would be for Snapchat, Inc. to go full court press against snapchatdb.info, as what is actually important here is to communicate both the "snapchat security is a lie" message, and "companies which flagrantly suck and then piss on those who report vulnerabilities responsibly will suffer" message, rather than the actual snapchat phone/username db. Streisand will help that more than "go to this site which is really slow and download a huge file which you can't easily use to find your own number or that of your friends" (without a minimum of "how to use a computer" skill).

throwaway420• 13 years ago

The website clearly states that the last 2 digits of the phone numbers are censored. You're free to do what you think is right, but in this case you're the one who is trying to get somebody's private information published.

md224• 13 years ago

The website clearly states that the last 2 digits of the phone numbers are censored.

They also say:

Feel free to contact us to ask for the uncensored database. Under certain circumstances, we may agree to release it.

which is, in my opinion, kind of messed up. (Unless I'm missing a reason why that would be helpful in any way.)

verroq• 13 years ago

If you think they registered using their real name and address then you are the delusional one.

pccampbell• 13 years ago

This seems super reckless.

untog• 13 years ago

Not at all surprised. Anyone that used the app would be suspicious of the backend behind it. Should have taken that $3bn while you had the chance.

jkelsey3• 13 years ago

Still too early to make those types of statements. I think it mostly depends on how much the media plays this up.

X43• 13 years ago

we are kind of the media.. and reddit is too.. I also believe that they made a fatal error by not selling everything for $3bn then jumping aboard. To not have anything to do with the "soon to come security issues". I mean they could have mentioned it and downplay it as they did just recently. I don't think that the new owner would take security more serious than them.

For us it was really really good that he rejected the offer! Because otherwise we would see the trade market crash $3bn, guess who would have to pay loss.. we..

well, if he saw that coming, which I doubt, he would be a hero.

myko• 13 years ago

Not to mention I don't think most of snapchats target audience even cares about this issue. My 20 year old sister certainly doesn't.

ja272• 13 years ago

Unless it's changed recently, the phone number is user-supplied and I'm not sure if it's verified at all. They do claim that the phone number "will be stored as unique mathematical representations (or 'hashes')..." rather than plaintext, but I imagine if you know it's a non-salted phone number that's been hashed, it's pretty easy to brute force. But were they lying about hashing the phone numbers? I guess it doesn't matter if they hashed the phone numbers if they're going to expose an unlimited query API that can be brute-forced like this.

boxy2• 13 years ago

jaz27: Why is your comment grey?

Did they really claim phone numbers are hashed? If so, why has nobody else touched on this subject?

stouset• 13 years ago

Salts, in a cryptographic context, are considered to be public. Salting does not mitigate a brute force attack against a limited search space.

elwell4• 13 years ago

Or the $4bn. http://www.theverge.com/2013/11/15/5106950/google-snapchat-4...

nadaviv• 13 years ago

For those who haven't noticed that, they are censoring the last two digits of the phone numbers:

For now, we have censored the last two digits of the phone numbers in order to minimize spam and abuse. Feel free to contact us to ask for the uncensored database. Under certain circumstances, we may agree to release it.

mercora• 13 years ago

google password recovery may helps then ... ;P

fletchowns• 13 years ago

a.k.a. pay us some $ for it

eigenvalue• 13 years ago

Since they give a bitcoin address, it's more likely that they want BTC. But yeah, same idea.

bookface• 13 years ago

These comments are disgusting. Why are you all trying to download the data? Why are many of you trying to distribute it?

protomyth• 13 years ago

I would imagine some of the people wanting to download the data are snapchat users who are trying to find out if they (or people they know) have data is in the file. No clue on the distribute part.

CamperBob2• 13 years ago

Why should General Clapper have all the fun?

cooper12• 13 years ago

For now, we have censored the last two digits of the phone numbers in order to minimize spam and abuse. Feel free to contact us to ask for the uncensored database. Under certain circumstances, we may agree to release it.

At least they had the tact to omit the complete phone numbers, but agreeing to release them under certain conditions just seems malicious.

couchdive3• 13 years ago

The exploit was brought to snapchats attention. Snapchat said impossible! DB is posted as proof.

stakecounter• 13 years ago

For now, we have censored the last two digits of the phone numbers in order to minimize spam and abuse. Feel free to contact us to ask for the uncensored database. Under certain circumstances, we may agree to release it.

Why not just release the usernames and leave out the phone numbers?

pikachu_is_cool• 13 years ago

Is there a torrent for this? I want to see if my phone number has been compromised to I can take measures to change it.

mofity3• 13 years ago

yes me to

Istof• 13 years ago

CSV: https://mega.co.nz/#!dcUhWabJ!dgiGrQCbRm6RqWCssewbmWzfV48B_B...

SQL: https://mega.co.nz/#!QJklSRJA!WrVeARPvcYgyKI3KENiPu0A6hlRCLf...

chmars2• 13 years ago

You could apparently check via https://dazzlepod.com/snapchat/ if you trust them.

jrockway• 13 years ago

I have list of all US phone numbers:

    000-000-0000
    000-000-0001
    ...

nswanberg• 13 years ago

Yes, this is strange on all fronts. As far as I know names and land numbers are still published in phone books, and a phone number isn't generally a very interesting bit of information to have. And to the extent this information is sensitive, why be so eager to spread it (beyond being a teenager and getting a thrill)?

wahnfrieden3• 13 years ago

Do you agree that many people are more public online behind the anonymity of a username, compared with their name as listed in public phone books?

hkmurakami• 13 years ago

1. You can remove your phone number from phone books.

2. Cell numbers aren't published in those books, which this affects.

2. Land lines these days are somewhat separate from our lives. It's relatively easy to ignore. Getting phishing texts (say, faking our banks, since some -- including myself -- have some bank alerts texted to us) to our cellphones could be quite harmful. If you send a million texts pretending to be Chase, and say 50% of the numbers are legit cell phone numbers, and 20% of people have chase accounts, and 0.1% of people fall for the phishing attempt, then you get 1/10,000 people getting phished. That's 100 people out of a million affected monetarily, and 500,000 people getting annoyed by the spam.

Obviously this is back of the envelope, but this is one reason it could matter.

edit: a comment thread below mentions that the bottom two digits are hidden at this moment but will be revealed for interested parties. That really smells like the numbers will be sold to spam/phishing operations.

wahnfrieden3• 13 years ago

Do you have the list of all US phone numbers tied to Snapchat usernames? If not this is entirely irrelevant.

code_duck• 13 years ago

Cool... Someone else has a database of phone numbers associated with their snapchat usernames, previously assumed to be private, which is what this story is actually about.

mwally• 13 years ago

They start with 200-200-0000.

MichaelGG• 13 years ago

The "first" NPA is 201, and from there the first assigned NXXes are 200, 202 and so on. 201-201 is unavailable. (According to the latest LERG update I have.)

ebahnx• 13 years ago

Is this a hoax? Has anyone attempted to verify the data with at least some spot checks?

mofity3• 13 years ago

could someone please post a torrent of this spreading the information as much as possible it will become less important and more known

rdl2• 13 years ago

Possibly they shouldn't have pissed on the people who notified them of the vulnerability, and on the journalists who broke the story?

(aside from not being vulnerable to this in the first place, but that actually is a lot to ask. I still can't believe anyone relied on the Snapchat model of security more so than any other app, although from an ease of use, non-security perspective, sure, it's reasonable.)

gibsonsecurity• 13 years ago

For the record we don't know about SnapchatDB.

But it was a matter of time until this happened, the exploit still works with minor modifications, you just have to be smart about it.

taternuts• 13 years ago

is this a result of an actual hack, or just someone who used the snapchat username->phone number to get 4.6?

GigabyteCoin• 13 years ago

Is anyone out there thinking that perhaps a larger social network might have had some hand in this?

The first thing that came to mind was "oh boy, I'll bet this made Zuck's new years eve!"

mofity3• 13 years ago

has anyone fully download the list yet

stefan_kendall• 13 years ago

This is only useful in wide-net fishing attacks, most of which I'm guessing no one here would fall for.

Anyone interested in you particularly will quickly get your phone number, email address, facebook profile, social security number, or whatever they want if they're determined enough.

Even then, I'm not sure what information this database really provides that could be used to gain some fraudulent or exploitive benefit.

pa5tabear• 13 years ago

Can you really quickly get a social security number?

thirsteh• 13 years ago

"I'm glad to let you know that you qualify for X healthcare coverage. Can I just have your social security number and we'll send over the confirmation documents?"

Yes, people fall for this kind of stuff all the time.

X43• 13 years ago

ehrm in sweden, yes.. those people are so mad that they allow a reverse search!!! I made payment gateways for companies there and was surprised by that.

What's really sad is that, if all those phone numbers were already public, I guess nobody would have cared to create something like SnapChat in the first place..

kvb• 13 years ago

In many cases it's much easier than you'd expect. See e.g. http://www.heinz.cmu.edu/~acquisti/ssnstudy/ (TL;DR: "we show that it is possible to predict individual SSNs simply from publicly available data").

antimatter152• 13 years ago

The top comment on Reddit r/netsec's corresponding coverage has mirrors on Mega.co.nz for the files [1]

I couldn't find my own data in the set, and actually it seems like lots of entire area codes are missing.

Assuming `cat schat.csv | uniq | cut -c1-4 | wc -l` is the proper command, there are only 76 of 322 [2] US area codes represented.

It appears there are two Canadian area codes represented in the database: 867 and 204. There are also 248 US area codes which are not represented in the database. Assuming a relatively uniform distribution of phone numbers in the US (which is not at all a safe assumption), the average US snapchat user has better odds of not being in the list than being in it. Sampling from the set of my snapchat friends who are not in my area code, 3 of 13 can be found in the database.

If your phone number is in any of these states, you're not in the database: Alaska Delaware Hawaii Kansas Maryland Mississippi Missouri Montana Nebraska Nevada New Hampshire New Mexico North Carolina North Dakota Oklahoma Oregon Rhode Island Utah Vermont West Virginia Wyoming

[1] http://www.reddit.com/r/netsec/comments/1u4xss/snapchat_phon...

[2] I'm matching a regex against this list http://en.wikipedia.org/wiki/List_of_North_American_Numberin...

fudged71• 13 years ago

The only Canadian area codes are for Manitoba and the Far North. Not so bad :)

bcj• 13 years ago

On the grand scale yes. For those of us in Manitoba (or presumably, the far north), there's not too much solace in that fact.

dbarlett• 13 years ago

I think you meant

  cat schat.csv | cut -c1-4 | uniq | wc -l

antimatter152• 13 years ago

Oops. That's actually what I ran but I typed the wrong command I to the text box.

chmars2• 13 years ago

It had never occurred to me that cell phone operators would use area codes. In my small home country, there is basically one 'area code' per cell phone operator. First lesson learnt in 2014! :)

jimminy• 13 years ago

In my experience in the US, the carriers/operators have an area code or two, but it's in the local area code rather than regional area code.

10-digit example: XXX - YYY - zzzz

The leaked data area codes are represented by the regional/XXX block and the carriers are in the local/YYY block in the 10-digit example.

techsupporter• 13 years ago

All phone numbers in the North American Numbering Plan (NANP) are allocated first as area codes by region and then by prefix for smaller locations. Some states, like Wyoming, have a single area code (307) while metro areas, like Houston, can have multiple area codes (713, 281, 832, 346) all covering the same physical place. This is a holdover of calling party pays so that a caller will know where a given phone number "lives." This distinction has become less visible with the advent of local number portability and nationwide mobile roaming.

(The NANP covers Canada, the Northern Mariana Islands, the United States, and a large list of island nations in the North American area.)

arrrg• 13 years ago

That doesn’t just apply to small countries. I was also unaware that mobile phone numbers could have area codes and I’m from Germany (where each mobile operator has one three digit code – but even that is becoming meaningless with legally required number portability from operator to operator).

eli6• 13 years ago

In many countries the caller pays for the cellular airtime. You have to know how much your call is going to cost before you dial it, so a new area code is needed. In the US, the cell phone user pays for the airtime even for calls they receive, so a new area code was never needed.

mgulaid• 13 years ago

Here is a video of guy hacking SnapChat and finding out Mark Zuckberg's logging info like phone#, email. The video was posted on Dec 26th. How come they did not fix this..

https://www.youtube.com/watch?v=JEWugKX98P0

mfreeman451• 13 years ago

1.805.250.1351

21echoes3• 13 years ago

How come they did not fix this..

How would you fix it? The app needs to know if your phone contacts are on snapchat, and if they are, what their usernames are. In other words, the API needs to exist.

frik• 13 years ago

Snapchat devs explained how to create the database on Dez 27th:

  Theoretically, if someone were able to upload a huge set 
  of phone numbers, like every number in an area code, or 
  every possible number in the U.S., they could create a 
  database of the results and match usernames to phone 
  numbers that way.

http://blog.snapchat.com/post/71353347590/finding-friends-wi...

omg

cupcake-unicorn• 13 years ago

Um..yeah..I just noticed that. That's REALLY embarrassing for them.

dahlberg• 13 years ago

It's also worth noting that some states have partial coverage. For example, all the area codes in Massachusetts are missing from the list, with the exception of "857" and "617" (both Boston area codes) but the latter is incorrectly labeled as "Southern Michigan".

whalesalad• 13 years ago

Bummer that Hawaii is not in the DB. For once I was actually hoping to see my data leaked somewhere aside from the Adobe incident. Dangit.

frasierman• 13 years ago

Threw together a quick script to check if you're affected... http://robbiet.us/snapchat/

Groxx• 13 years ago

Thanks for this, I was just wondering if mine was in here.

wahnfrieden3• 13 years ago

Ha, what. Your site says I'm leaked but gives a totally wrong phone #.

neom• 13 years ago

My number is present.

_RPM3• 13 years ago

Did he just stop his HTTP server? I get no response.

_RPM3• 13 years ago

Did he just turn of his HTTP server? I get no response.

cdcarter• 13 years ago

So the primary use for this database would be phishing, right? Or some attempt at building a reverse cell phone number lookup database, assuming people have reused usernames? My normal username was taken when I signed up for snapchat, but I suppose you could use this to get quite a few cell number -> instagram or twitter pairings?

billsix• 13 years ago

I wonder if this will adversely affect their revenue

_RPM3• 13 years ago

What is the point of the areacodes table they provide. It has no relation to the recors table. Also, I found my username in their.

raingrove• 13 years ago

If you have a SF Bay Area phone number, it's probably in there.

cenhyperion2• 13 years ago

Just like to remind everyone that snapchat was aware of this exploit and dismissive in regards to it.

http://www.theverge.com/2013/12/27/5249304/snapchat-dismisse...

rsync• 13 years ago

Heckuvajob, Brownie.

hkiely• 13 years ago

It looks like they only bothered with most populated area codes.

elnate• 13 years ago

As a casual user, can someone explain the implications for me? They seem to have my username and phone number combo; can they use these for nefarious purposes?

alaskamiller• 13 years ago

If you're not a hot underage teen girl, then prob not. But now it blows up the spot for where a lot of teens are hanging out. Now it's another step to getting to you if some creep wants to. Or take it to a grander scale, it creates a viable link of who a person and their digital mask is.

That's kind of the thing about privacy. It's kind of slipping away, but if you don't care that it is then it's prob cause it doesn't matter to you yet.

Sami_Lehtinen• 13 years ago

If you're playing anonymous, you surely would also use burner phones and not your main phone for that purpose. Same applies to identities, profiles and hardware, any IDs, network connection and so on.

Because if I do have an alias, which is doing very shady things. I would make it pretty sure, it's not going to be that easy to get it. When doing stuff like that you want to be sure that there's "shared nothing" approach. So if they hack your systems, your primary system won't contain any information referring to the shady side and vise versa.

patio11• 13 years ago

Among other things, it means that the cell phones of people who have predictable user names are now very easy to discover. I don't use SnapChat, but if I did I would be patio11 on it. My cell is fairly closely guarded. You could imagine some people with similar situations who'd be at higher risk of misuse, because of a higher public profile, higher perceived payoff for contacting, notoriety, or demographic interest to people with poor impulse control.

scaramanga• 13 years ago

CSV: magnet:?xt=urn:btih:bab9548c3770188c70d27ded9b22348f5b979713&dn=Snapch at+database+CSV&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80 &tr=udp%3A%2F%2Ftracker.publicbt.com%3A80&tr=udp%3A%2F%2Ftrack er.istole.it%3A6969&tr=udp%3A%2F%2Ftracker.ccc.de%3A80&tr=udp% 3A%2F%2Fopen.demonii.com%3A1337

SQL: magnet:? xt=urn:btih:f7b1cec6280edb8169d63550ba2dfb224df7810d&dn=Snapch at+database+SQL&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80 &tr=udp%3A%2F%2Ftracker.publicbt.com%3A80&tr=udp%3A%2F%2Ftrack er.istole.it%3A6969&tr=udp%3A%2F%2Ftracker.ccc.de%3A80&tr=udp% 3A%2F%2Fopen.demonii.com%3A1337

Both: magnet:? xt=urn:btih:fae9c0a8b2eee2f9cc31c713f21a4cda4083612b&dn=Snapch at+Database+CSV+%26amp%3B+SQL&tr=udp%3A%2F%2Ftracker.openbitto rrent.com%3A80&tr=udp%3A%2F%2Ftracker.publicbt.com%3A80&tr=udp %3A%2F%2Ftracker.istole.it%3A6969&tr=udp%3A%2F%2Ftracker.ccc.d e%3A80&tr=udp%3A%2F%2Fopen.demonii.com%3A1337

kamimeow• 13 years ago

That's crazy how some personnal infos, once leaked, become a public/underground data leaving no real way to repair. (I m thinking about leaks of other infos with an expiracy, or tier revoking, like oauth tokens)

samstave2• 13 years ago

BLockchain roll-backs of leaked info?

/I have no idea what I am talking about :-)

telnet44• 13 years ago

actually these links are bullshit. only PARTIAL NUMBERS. I have over 80 million US nembers myself and 20 million cellphones. I sell numbers cheap. Hit me up through LeadPro.net cheers!

vikp2• 13 years ago

I made a site to check if you are affected by this leak: http://www.snapcheck.org . Happy new year, everyone (although on a bad note...)

xixixao• 13 years ago

This would be perfect for completing the database .)

vikp2• 13 years ago

I just open sourced the code: https://github.com/VikParuchuri/snapcheck . Can verify, nothing tricky going on.

OedipusRex• 13 years ago

This is what a sample looks like

"31755501XX","username","Indianapolis"

The XXs hide the last two digits of every number. The list is also massively incomplete.

akosner• 13 years ago

I have a theory. Last week there was a big story about how Facebook was “dead and buried” because teens didn’t want to be on a service that their parents had moved into. Now, when it comes to security, the parents care a lot more than the kids. Could Snapchat be playing fast and loose with the security of their user data as a way of scaring away the grownups?

This would be a clever ploy but for one damning fact. A large share of Snapchat’s users are minor children. Could anyone, from the CEO of Snapchat to the perpetrators of SnapchatDB really think that risking the broadcasting of the phone numbers of 12-year-old girls and boys is a risk worth taking?

For more, see: http://www.forbes.com/sites/anthonykosner/2014/01/01/4-6-mil...

Ryel2• 13 years ago

I HAVE a theory that a (not so)clever writer for Forbes is plugging his story by planting misguided theories everywhere UPON which I plan to plant my theories on his planted theories on snapchat CEO "rumor" theories.

Crito2• 13 years ago

I have a theory that Mark Zuckerburg, fearing the demise of facebook, had his ninja assassins infiltrate SnapChat and compromised their security, hoping to drive teenagers back into the arms of facebook.

Why is my theory any less loony than yours?

Ryel2• 13 years ago

Is it not odd that Snapchat has 5+ open job listings on their website, none of which include security?

disclosure• 13 years ago

Check if your Snapchat account is leaked in the SnapchatDB release: https://dazzlepod.com/snapchat/

schappim• 13 years ago

I wonder if this is real: "65039076XX","larrypage","Mountain View"

jlgaddis2• 13 years ago

Download links were broken for me so I've mirrored them here (converted from zip to bzip2):

CSV: http://evilrouters.net/schat.csv.bz2

SQL: http://evilrouters.net/schat.sql.bz2

kevinjones• 13 years ago

Or just use port 8080 to bypass their Varnish server:

http://www.snapchatdb.info:8080/schat.csv.zip http://www.snapchatdb.info:8080/schat.sql.zip

JacobIrwin• 13 years ago

8080s aren't working, but jlgaddis's downloads are...

quantumpotato_• 13 years ago

503 on download links

jlgaddis2• 13 years ago

NB: "For now, we have censored the last two digits of the phone numbers in order to minimize spam and abuse. Feel free to contact us to ask for the uncensored database. Under certain circumstances, we may agree to release it."

notastartup• 13 years ago

How long until somebody releases an updated snapchat database linking pinterest profile pictures? I mean if you chose a very unique username, and went to http://pinterest.com/username, you'd be able to discover what they possibly look like. It doesn't end there, their email address is probably username@gmail.com too. simply googling the username results in connecting their twitter? facebook? myspace? linkedin? full name, more pictures, your friends, your interests, your likes. All in all, I would have to say, this can be potentially a far bigger loss of privacy than just your Snapchat account.

Damn that 3 billion dollar looks good about now.

ateevchopra• 13 years ago

They censored the last two digits of the phone numbers. And if you goto google's password recovery option, it shows you the last three numbers of a someone's phone number. Just saying.

lucb1e3• 13 years ago

Why do you even share your phone number with Google?

jodrellblank• 13 years ago

http://www.google.com/landing/2step/

bierko• 13 years ago

For some reason, all of the 617 area codes are labeled as "Southern Michigan", but 617 is for Boston/Cambridge.

aheilbut• 13 years ago

I guess I'm dating myself, but didn't we used to call that the phone book?

riffraff• 13 years ago

at some point people started thinking that mobile phones somehow need to be more personal than land lines.

In the specific case though, it's as if you had already asked to be removed from the phone book (implicitly trusting the company), and then your number was published anyway.

lucb1e3• 13 years ago

Fuck, misclicked downvote (wanted to upvote). Really great how HN does not allow changing votes at least once. Sorry for that, but yeah good point.

Nowadays one or a few phone numbers are unique to you, which makes it linkable to other things. Linkability is something that breaks privacy, so if you don't want your full name to be known somewhere, it is important to be able to keep things separate. When your phone number goes public (e.g. resumé and snapchat), that anonymity is broken.

lostlogin• 13 years ago

Someone always does it for me, so here is a compensation up vote. I agree, a few mins of vote changing grace wod be nice.

eli6• 13 years ago

Setting aside the privacy of cell versus landline numbers, the phone book never had anything analogous to a Snapchat user name.

asnyder• 13 years ago

Yeah, it had your actual name AND your address.

sschueller• 13 years ago

I still don't understand why you would turn down $3 billion. How will you ever make money with snapchat and how is it not a fad that will eventually die?

jpalomaki• 13 years ago

Was it 3bn cash or 3bn with some conditions? Maybe they have already made enough money (or are confident they will) and now want to get their name into history by building great company.

sleepyhead• 13 years ago

At the end of the day it is 3bn for an app that sends and shows photos for 10 seconds.

meerita• 13 years ago

I feel good i didn't get into the Snapchat train before.

lightercontact• 13 years ago

SnapchatDB here: Our hosting account has been suspended. For further contact please use: snapchatdb@Safe-mail.net, or the original Bitmessage address (BM-2cTPMALzgYTkM8A96g2iwTjGHQUuNSwamp)

You can confirm my identity by messaging the original Bitmessage address which was captured by http://www.reddit.com/r/netsec/comments/1u4xss/snapchat_phon...

elwell4• 13 years ago

redirects to localhost for me...

nighthawk24• 13 years ago

I knew I shouldn't have signed up for Snapchat, never freaking used it, and now my phone number-username identity has been leaked.

nhangen• 13 years ago

What I want to know is what kind of asshole it takes to do things like this?

Great, Snapchat isn't secure, and they probably didn't give a damn when notified of the vulnerability (not surprising, given their cavalier attitudes), but why expose their audience in order to prove a point?

Not cool man.

nitrogen3• 13 years ago

Probably because someone else would have, or already has, and kept it secret instead. What you don't know can hurt you.

convoe• 13 years ago

The database and download exclusively on convoe: http://convoe.com/topic/127/introducing-snapchat-database

plausibility• 13 years ago

"exclusively" - as opposed to those torrents, the mega mirrors and personal mirrors provided by reddit and hn members, right?

elwell4• 13 years ago

"This account has been suspended."

Ate2• 13 years ago

how do I check my data?

ufmace• 13 years ago

Anyone else tried putting together some stats from the info?

                     name                     | areacode | count  
	----------------------------------------------+----------+--------
	 Chicago Suburbs                              | 815      | 215953
	 Eastern Los Angeles                          | 909      | 215855
	 San Fernando Valley                          | 818      | 205544
	 Southern California                          | 951      | 200008
	 Los Angeles                                  | 310      | 196183
	 Northern Chicago Suburbs                     | 847      | 195925
	 Denver-Boulder                               | 720      | 188285
	 Downtown Los Angeles                         | 323      | 168565
	 New York City                                | 347      | 166374
	 New York City                                | 917      | 165420
	 Fort Lauderdale                              | 954      | 153522
	 Northern New York                            | 315      | 147447
	 Buffalo                                      | 716      | 144939
	 Southern Illinois                            | 618      | 144280
	 Boulder-Denver                               | 303      | 139265
	 Southern Michigan                            | 617      | 138821
	 Northeastern New York State                  | 518      | 138043
	 Champaign-Urbana                             | 217      | 135837
	 Oakland                                      | 510      | 130531
	 Miami                                        | 786      | 117906
	 Westchester County, NY                       | 914      | 116632
	 Western and Northern Colorado                | 970      | 115378
	 San Francisco                                | 415      | 108883
	 Miami                                        | 305      | 104415
	 Southeastern Colorado                        | 719      | 102932
	 Manhattan                                    | 646      |  96646
	 Mountain View                                | 650      |  94430
	 Chicago                                      | 312      |  70709
	 Southwest Connecticut                        | 203      |  60629
	 Bronx, Queens, Brooklyn                      | 718      |  51086
	 Boston                                       | 857      |  41857
	 Central Arizona                              | 480      |  35631
	 South Carolina                               | 864      |  33034
	 Eastern Ohio                                 | 330      |  32721
	 Arkansas                                     | 870      |  28940
	 Idaho                                        | 208      |  26827
	 Southeastern Virginia                        | 757      |  21170
	 Los Angeles                                  | 213      |  13705
	 Southeastern Ohio                            | 740      |  11597
	 Eastern San Francisco                        | 209      |  11356
	 Seattle                                      | 206      |  10623
	 Fort Lauderdale                              | 754      |  10131
	 Maine                                        | 207      |  10126
	 Northern Louisiana                           | 318      |   9842
	 Indianapolis                                 | 317      |   8151
	 Northwestern Arkansas                        | 479      |   7300
	 Manitoba                                     | 204      |   7211
	 Minnesota                                    | 320      |   7162
	 Southeastern Michigan incl. Ann Arbor        | 734      |   7077
	 Eastern part of Southern New Jersey          | 609      |   6952
	 Pennsylvania                                 | 484      |   6314
	 Manhattan                                    | 212      |   3970
	 Pennsylvania                                 | 610      |   3930
	 Southern New York State                      | 607      |   3437
	 Central Florida                              | 321      |   3258
	 New York City                                | 929      |   2651
	 Florida                                      | 863      |   2642
	 Southeastern California                      | 760      |   2523
	 Southwestern Wisconsin                       | 608      |   2217
	 Central Texas                                | 325      |   1542
	 Central Georgia                              | 478      |   1396
	 Western Central Alabama                      | 205      |    825
	 Eastern Kentucky                             | 606      |    565
	 DuPage County, Illinois                      | 331      |    512
	 Eastern part of central New Jersey           | 732      |    507
	 South Dakota                                 | 605      |    375
	 Knoxville, Tennessee                         | 865      |    263
	 Southwestern Connecticut                     | 475      |    253
	 Eastern Iowa                                 | 319      |    198
	 Georgia                                      | 470      |    163
	 Minneapolis                                  | 612      |    103
	 San Fernando Valley, LA                      | 747      |     84
	 Canadian territories in the Arctic far north | 867      |     31
	 Washington DC                                | 202      |      3
	 Georgia                                      | 762      |      2
	 Dallas                                       | 469      |      1

I wonder where they were getting the numbers to search by from. From how they described the vulnerability, I would have thought they would just iterate through all possible phone numbers. If they're doing that, it's strange how there's exactly 1 number for the dallas area code.

hackdoman2• 13 years ago

www(dot)mediafire(dot)com/download/73t434w3h55x5z4/Snapchat.zip

that is the whole file

hackdoman2• 13 years ago

www.mediafire.com/download/73t434w3h55x5z4/Snapchat.zip

real files right here

noclip• 13 years ago

You mean to say a company that encrypts users' messages in ECB mode with a fixed key hard-coded into the binary and which was publicly disclosed almost a year ago and hasn't been changed isn't responsible with user data?

boxy2• 13 years ago

I am interested in knowing if anyone who had deleted their SnapChat account, preferably months ago, was listed in that database.

Snapchat Phone Number Database Leaked

Related Stories