11–20 of 138 posts
It's like every account on Instagram has an alternative six digit password.
Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low limit, like 25) from any IP before invalidating the code? I don't really see a scenario where it makes sense to have per-IP rate limiting here. I guess they are probably just using the rate limiting features which are built in to whatever framework Instagram is using for their API.
I would be interested in starting to try some of these programs, but a bit scared I'd be doing something illegal... Where is the line?
Could someone explain how this person is allowed to do that type of testing (sending 200,000 requests)? How would Facebook know he is a white hat and not a black hat? I would be interested in starting to try some of these programs, but a bit scared I'd be doing something illegal... Where is the line?
Could someone explain how this person is allowed to do that type of testing (sending 200,000 requests)? How would Facebook know he is a white hat and not a black hat? I would be interested in starting to try some of these programs, but a bit scared I'd be doing something illegal... Where is the line?
I spot-checked some of those IPs in the video, and it appears all of them are on Amazon. So, what does the attacker's stack look like? Is it a bunch of servers running PHP and listening for a connection to run curl? Or Lambda functions configured to proxy the connection attempt to IG? Curious how much effort goes into setting up an attack like this. It's surprising (to me) that so many IPs can be used for so little m…
Could someone explain how this person is allowed to do that type of testing (sending 200,000 requests)? How would Facebook know he is a white hat and not a black hat? I would be interested in starting to try some of these programs, but a bit scared I'd be doing something illegal... Where is the line?
I spot-checked some of those IPs in the video, and it appears all of them are on Amazon. So, what does the attacker's stack look like? Is it a bunch of servers running PHP and listening for a connection to run curl? Or Lambda functions configured to proxy the connection attempt to IG? Curious how much effort goes into setting up an attack like this. It's surprising (to me) that so many IPs can be used for so little m…
I'm curious too, how would he set up so many machines that do the same thing?
I spot-checked some of those IPs in the video, and it appears all of them are on Amazon. So, what does the attacker's stack look like? Is it a bunch of servers running PHP and listening for a connection to run curl? Or Lambda functions configured to proxy the connection attempt to IG? Curious how much effort goes into setting up an attack like this. It's surprising (to me) that so many IPs can be used for so little m…
I'm curious too, how would he set up so many machines that do the same thing?
Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA. Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low…