Friday, March 29, 2024

Critical Account Take over Vulnerability Allows to Hack Your Instagram Account within 10 Minutes

A security researcher reported a critical vulnerability that allows malicious hackers to hack Instagram account and take complete control of your Instagram account within 10 minutes.

Facebook and Instagram are frequently fixing several vulnerabilities discovered by the internal team and also the bugs reported by external independent security researchers.

The social media giant recently increased the bug bounty for critical flaws such as account take over and remote code execution vulnerabilities.

Laxman Muthiyah, an independent security researcher from India recently reported a critical account take over a vulnerability that presented in Facebook-owned Instagram that let an attacker gain the One Time Password (OTP) within 10 minutes and it could have to affect billions of Instagram users.

Bypassing the One Time Password to Hack Instagram

Laxman initially tried to figure out this vulnerability in Instagram with web interface by resetting password to the Instagram account, where Instagram deployed very strong link-based password reset mechanism which is not easy to exploit.

But when he tried the same method in the mobile interface that requires to enter users mobile number in order to send the 6 digit passcode (OTP) for resetting the password.

when users requesting the 6 digit OTP, system randomly generating the passcode from one million code combination and send it to users who need to use the passcode within 10 minutes.

We could change any users password and hack Instagram if we could able to try all the one million passcode combination through brute-force attacks but Instagram limits the request to prevent such attacks.

In order to check the possibility, “Laxman sent around 1000 requests, 250 of them went through and the rest 750 requests were rate limited. Tried another 1000, now many of them got rate limited. So their systems are validating and rate-limiting the requests properly.”

Instagram Failed to Blacklist the IP Request

During his Findings, He was able to send the number of request without getting blocked within a fraction of seconds.

According to his report, “After a few days of continuous testing, I found two things that allowed me to bypass their rate-limiting mechanism.

  1. Race Hazard
  2. IP rotation

This could be achieved by Sending concurrent requests using multiple IPs to send a large number of requests without getting limited.  

Since the passcode will expire within 10 minutes, the attacker needs 5000 IPs to check the 1 million passcode combination to hack Instagram Account.

“It sounds big but that’s actually easy if you use a cloud service provider like Amazon or Google. It would cost around 150 dollars to perform the complete attack of one million codes.” Research said.

Facebook and Instagram security team fixed the issue and rewarded him $30000 as a part of their bounty program.

Recently Facebook revealed that they stored tens of millions of Instagram passwords in plain text including thousand of the Instagram password instead of masking it as a human-readable format.

You can also learn Master in Bug Bounty Course online Bundle to enhance advance level Bug Bounty skills to find the vulnerabilities in web applications.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles