Wednesday, July 24, 2024

Critical Account Take over Vulnerability Allows to Hack Your Instagram Account within 10 Minutes

A security researcher reported a critical vulnerability that allows malicious hackers to hack Instagram account and take complete control of your Instagram account within 10 minutes.

Facebook and Instagram are frequently fixing several vulnerabilities discovered by the internal team and also the bugs reported by external independent security researchers.

The social media giant recently increased the bug bounty for critical flaws such as account take over and remote code execution vulnerabilities.

Laxman Muthiyah, an independent security researcher from India recently reported a critical account take over a vulnerability that presented in Facebook-owned Instagram that let an attacker gain the One Time Password (OTP) within 10 minutes and it could have to affect billions of Instagram users.

Bypassing the One Time Password to Hack Instagram

Laxman initially tried to figure out this vulnerability in Instagram with web interface by resetting password to the Instagram account, where Instagram deployed very strong link-based password reset mechanism which is not easy to exploit.

But when he tried the same method in the mobile interface that requires to enter users mobile number in order to send the 6 digit passcode (OTP) for resetting the password.

when users requesting the 6 digit OTP, system randomly generating the passcode from one million code combination and send it to users who need to use the passcode within 10 minutes.

We could change any users password and hack Instagram if we could able to try all the one million passcode combination through brute-force attacks but Instagram limits the request to prevent such attacks.

In order to check the possibility, “Laxman sent around 1000 requests, 250 of them went through and the rest 750 requests were rate limited. Tried another 1000, now many of them got rate limited. So their systems are validating and rate-limiting the requests properly.”

Instagram Failed to Blacklist the IP Request

During his Findings, He was able to send the number of request without getting blocked within a fraction of seconds.

According to his report, “After a few days of continuous testing, I found two things that allowed me to bypass their rate-limiting mechanism.

  1. Race Hazard
  2. IP rotation

This could be achieved by Sending concurrent requests using multiple IPs to send a large number of requests without getting limited.  

Since the passcode will expire within 10 minutes, the attacker needs 5000 IPs to check the 1 million passcode combination to hack Instagram Account.

“It sounds big but that’s actually easy if you use a cloud service provider like Amazon or Google. It would cost around 150 dollars to perform the complete attack of one million codes.” Research said.

Facebook and Instagram security team fixed the issue and rewarded him $30000 as a part of their bounty program.

Recently Facebook revealed that they stored tens of millions of Instagram passwords in plain text including thousand of the Instagram password instead of masking it as a human-readable format.

You can also learn Master in Bug Bounty Course online Bundle to enhance advance level Bug Bounty skills to find the vulnerabilities in web applications.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.


Latest articles

ShadowRoot Ransomware Attacking Organizations With Weaponized PDF Documents

A rudimentary ransomware targets Turkish businesses through phishing emails with ".ru" domain sender addresses....

BreachForumsV1 Database Leaked: Private messages, Emails & IP Exposed

BreachForumsV1, a notorious online platform for facilitating illegal activities, has reportedly suffered a massive...

250 Million Hamster Kombat Players Targeted Via Android And Windows Malware

Despite having simple gameplay, the new Telegram clicker game Hamster Kombat has become very...

Beware Of Malicious Python Packages That Steal Users Sensitive Data

Malicious Python packages uploaded by "dsfsdfds" to PyPI infiltrated user systems by exfiltrating sensitive...

Chinese Hackers Using Shared Framework To Create Multi-Platform Malware

Shared frameworks are often prone to hackers' abuses as they have been built into...

BlueStacks Emulator For Windows Flaw Exposes Millions Of Gamers To Attack

A significant vulnerability was discovered in BlueStacks, the world's fastest Android emulator and cloud...

Google Chrome 127 Released with a fix for 24 Security Vulnerabilities

Google has unveiled the latest version of its Chrome browser, Chrome 127, which is...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles