A vulnerability in the photo messaging app Snapchat allows hackers to inject distributed denial-of-service (DDoS) attacks that momentarily freeze and crash an iPhone device.
According to security researcher Jaime Sanchez, the vulnerability also allows hackers to deliver thousands of messages to users within seconds and cause the device to freeze and ultimately crash, or require a hard reset.
Sanchez revealed that the main reason for the vulnerability is that Snapchat’s security tokens, which are generated every time to validate users identity, do not expire.
Further, this weakness allows hackers to re-use the old tokens either to send out spam from multiple devices to Snapchat users or to direct requests at a single target device.
"The problem is that tokens doesn’t expire," Sanchez added.
"I’ve been using for the attack one token create almost one month ago.
"So, I’m able to use a custom script I’ve created to send snaps to a list of users from several computers at the same time.
In addition, researcher also noted that the targeted iPhone may still be immobilised for a while, even after a particular user restarts their device.
The latest vulnerability is the second breach at Snapchat this year, with the first one involving data of 4.6 million accounts being leaked online.
