Saturday, April 13, 2024

Critical Account Take over Vulnerability Allows to Hack Your Instagram Account within 10 Minutes

A security researcher reported a critical vulnerability that allows malicious hackers to hack Instagram account and take complete control of your Instagram account within 10 minutes.

Facebook and Instagram are frequently fixing several vulnerabilities discovered by the internal team and also the bugs reported by external independent security researchers.

The social media giant recently increased the bug bounty for critical flaws such as account take over and remote code execution vulnerabilities.

Laxman Muthiyah, an independent security researcher from India recently reported a critical account take over a vulnerability that presented in Facebook-owned Instagram that let an attacker gain the One Time Password (OTP) within 10 minutes and it could have to affect billions of Instagram users.

Bypassing the One Time Password to Hack Instagram

Laxman initially tried to figure out this vulnerability in Instagram with web interface by resetting password to the Instagram account, where Instagram deployed very strong link-based password reset mechanism which is not easy to exploit.

But when he tried the same method in the mobile interface that requires to enter users mobile number in order to send the 6 digit passcode (OTP) for resetting the password.

when users requesting the 6 digit OTP, system randomly generating the passcode from one million code combination and send it to users who need to use the passcode within 10 minutes.

We could change any users password and hack Instagram if we could able to try all the one million passcode combination through brute-force attacks but Instagram limits the request to prevent such attacks.

In order to check the possibility, “Laxman sent around 1000 requests, 250 of them went through and the rest 750 requests were rate limited. Tried another 1000, now many of them got rate limited. So their systems are validating and rate-limiting the requests properly.”

Instagram Failed to Blacklist the IP Request

During his Findings, He was able to send the number of request without getting blocked within a fraction of seconds.

According to his report, “After a few days of continuous testing, I found two things that allowed me to bypass their rate-limiting mechanism.

  1. Race Hazard
  2. IP rotation

This could be achieved by Sending concurrent requests using multiple IPs to send a large number of requests without getting limited.  

Since the passcode will expire within 10 minutes, the attacker needs 5000 IPs to check the 1 million passcode combination to hack Instagram Account.

“It sounds big but that’s actually easy if you use a cloud service provider like Amazon or Google. It would cost around 150 dollars to perform the complete attack of one million codes.” Research said.

Facebook and Instagram security team fixed the issue and rewarded him $30000 as a part of their bounty program.

Recently Facebook revealed that they stored tens of millions of Instagram passwords in plain text including thousand of the Instagram password instead of masking it as a human-readable format.

You can also learn Master in Bug Bounty Course online Bundle to enhance advance level Bug Bounty skills to find the vulnerabilities in web applications.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Website

Latest articles

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...

Hackers Employ Deepfake Technology To Impersonate as LastPass CEO

A LastPass employee recently became the target of an attempted fraud involving sophisticated audio...

Sisence Data Breach, CISA Urges To Reset Login Credentials

In response to a recent data breach at Sisense, a provider of data analytics...

DuckDuckGo Launches Privacy Pro: 3-in-1 service With VPN

DuckDuckGo has launched Privacy Pro, a new subscription service that promises to enhance user...

Cyber Attack Surge by 28%:Education Sector at High Risk

In Q1 2024, Check Point Research (CPR) witnessed a notable increase in the average...

Midnight Blizzard’s Microsoft Corporate Email Hack Threatens Federal Agencies: CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive concerning a...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles