My child is being accused of doing some improper things via Snapchat, but he swears that he did not do anything, and he is the type of person who probably would not. The only thing the police are going on is the user account name and the IP address which supposedly connects to my child's iPhone. Is there any way that someone else could have hacked into my child's Snapchat account and did the improper things, or is the IP address conclusive that it is my child's iPhone? My child and the other communicator are in different states.

  • Do you know the IP in question? Is there any doubt about whether the IP was actually used by their device? Is there any question about whether your child used snapchat at all? – thexacre Apr 9 '15 at 3:06
  • Unless the phone's jailbroken, I would think someone physically compromised your Snapchat acc/ iPhone. Not a remote attack but a much more plausible local attack. Or maybe your son actually did do it. – Joseph Apr 9 '15 at 7:29
  • Or perhaps a friend or classmate got access to the device/account or impersonated it from a common access point? I've seen some adults with no passwords leave their devices laying around in common areas... or sharing account credentials (either for a specific service or because they use the same credentials everywhere). Get a lawyer and let them decide when and how to discuss such things with the police. – Dave Feb 8 '16 at 17:46

Snapchat keeps a log of all messages sent and their corresponding IPs, so they can easily tell who sent which message and from where.

If someone compromised the Snapchat account and sent some content from another machine, the IP address would be the one of the machine/phone from where the content was sent, or possibly the address of a proxy/compromised server/anonymization service such as Tor.

If attacker really wanted it to appear as if your child sent the content, he could compromise a machine on your home network and use it as a proxy to send the content (it will appear as coming from your home network connection and would be potential evidence unless you have proof someone else was at home or your child wasn't there when it happened).

In theory he could also compromise the phone itself to send the content directly via the mobile network, but in practice I'm not aware of any iOS exploits for the recent iOS 8.X versons allowing this kind of attack, so the only option would be to make your child install some specifically crafted malware designed to give the attackers remote access to the phone and root privileges (to break into the Snapchat app's sandbox and steal its session token, to be able to impersonate this app). Installing such malware is no easy task and is definitely an unusual procedure, and most importantly requires a jailbroken phone.

| improve this answer | |
  • 2
    "Solid evidence" this is not considered solid. "stupid enough". "No know exploits" depends on the version. -1 – Lucas Kauffman Apr 9 '15 at 6:30
  • 1
    "why wouldn't this be solid?", someone else in the context of OPs question could be one of their child's friends who came for a sleepover and thought it would be a funny prank to mess around on OPs child's snapchat account. Also I think you should revise "your child was stupid enough to be social-engineered into installing malware" as A. social engineering is effective against lots of intelligent people, and B. the question relates to a child who shouldn't ultimately be responsible for their online security (as oppose to their parents). – thexacre Apr 9 '15 at 6:46
  • 2
    You seem to forget the basic principles or jurisprudence, you are required to show your evidence is solid. This is AT BEST circumstantial. – Lucas Kauffman Apr 9 '15 at 7:07
  • "so the only option would be to make your child install some specifically crafted malware" that doesn't seem like the only option "About half of Snapchat’s users are between 13 and 17 years old, raising questions of whether some of the leaked images could be considered child pornography" huffingtonpost.com/2014/10/13/snapchat-hacked_n_5977334.html – thexacre Apr 9 '15 at 7:25
  • @thexacre this would require the child to log into a third-party service (in this case a website) and still won't give them access to the child's phone in order to impersonate him (by posting offending content from the phone's IP). – user42178 Apr 9 '15 at 7:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.