<http://schema.org/articleBody>
"If you're a Snapchat user, then you might be interested to know that someone may have\u00A0found a way to save the usernames and phone numbers for 4.6 million accounts. The website SnapchatDB.info allows anyone to simply grab either as a SQL dump or a CSV text file information that the creators claim was acquired through &amp;quot;the recently patched Snapchat exploit&amp;quot;.\r\n\r\nUpdate 1:\u00A0 We've received confirmation from the creators of SnapchatDB saying that the response to the Gibson Security report was not enough. The site is run by a group of security researchers and claim that they have no malicious intent. However, it did have this to say about Snapchat:\r\nSnapchat's response to gibsonsec was simply not enough. When communicated\u00A0privately, Snapchat disregarded the submission and didn't even implement\u00A0rate limiting. Gibsonsec's full disclosure doesn't work as-is anymore. But\u00A0it still does with very minor modifications. Millions of people are\u00A0trusting Snapchat with their private data and if Snapchat doesn't care\u00A0enough to implement something as simple as rate limiting, we think the\u00A0public needs to know how reckless they are.\r\nUpdate 2:\u00A0Developers\u00A0Will Smidlein\u00A0and\u00A0Robbie Trencheny\u00A0say they've\u00A0set up a checker script\u00A0that allows anyone to look to see if their account was included in the leak.\r\n\r\n--\r\n\r\nAlthough claiming that the stolen database was meant to raise awareness of Snapchat's security hole, SnapchatDB's creators say that they've &amp;quot;censored the last two digits of the phone numbers&amp;quot; in an effort to &amp;quot;minimize spam and abuse&amp;quot;. But the alleged generosity has its limits as there's still a possibility that the unfiltered data could be released, affecting millions.\r\n\r\nWe did a quick\u00A0WHOIS lookup\u00A0on SnapchatDB's domain and it was created on December 31. Although the registrant name is protected, the mailing address and contact number is listed as being in Panama. How genuine the information is in this database remains in question -- it has not been authenticated yet by Snapchat. This could certainly all be an elaborate hoax taking advantage of the recent issues the ephemeral messaging service has had.\r\n\r\nWe've reached out to Snapchat and the creators of SnapchatDB for comment and will update if we hear back.\r\n\r\nAs noted in Hacker News, those that attempt to download the database may encounter some difficulties due to traffic congestion or perhaps the files are incomplete. Whatever the issue is, it's unknown how many people are actually receiving the complete and edited dataset.\r\n\r\nIn December, Australia-based Gibson Security published a report highlighting two exploits in Snapchat claiming that hackers could easily gain access to users' personal data. It's said that user's names, aliases, and phone numbers could be gathered through the service's Android and iOS API.\r\n\r\nSnapchat has since responded to the Gibson report, saying:\r\nOur Find Friends feature allows users to upload their address book contacts to Snapchat so that we can display the accounts of Snapchatters who match the phone numbers found in the address book. Adding a phone number to your Snapchat account is optional, but it\u2019s helpful for allowing your friends to find you. We don\u2019t display the phone numbers to other users and we don\u2019t support the ability to look up phone numbers based on someone\u2019s username.\r\n\r\nTheoretically, if someone were able to upload a huge set of phone numbers, like every number in an area code, or every possible number in the U.S., they could create a database of the results and match usernames to phone numbers that way. Over the past year we\u2019ve implemented various safeguards to make it more difficult to do. We recently added additional counter-measures and continue to make improvements to combat spam and abuse.\r\nWhile the purpose of this website is apparently to cause Snapchat to move further in closing its security gap and also to prove the company wrong in its response, one must wonder whether this is the right thing to do -- exposing individual account information in this manner could be considered to be a tad extreme, even something of this magnitude.\r\n\r\nHat-tip to @MadLid\r\n\r\n&amp;amp;nbsp;"^^<http://www.w3.org/2001/XMLSchema#string>
<http://thenextweb.com/insider/2014/01/01/hackers-allegedly-exploit-snapchat-security-hole-leak-4-6m-usernames-phone-numbers-online/?_escaped_fragment_=q2SD3>