How I Could Have Hacked Any Instagram Account • Hacker News Board

Re: How I Could Have Hacked Any Instagram Account

#21

Post by jumbopapa » Thu, Jul 18, 2019, 3:10 PM UTC

penagwin wrote: post #5

np_tedious wrote: post #3

Earlier quoted context omitted.

Fat fingers happen, so I could see allowing maybe 3 attempts from a usability and convenience standpoint. Beyond that, definitely should regenerate / resend. This is to confirm you own that phone number. It's not hard to get another

Yeah for sure, a few attempts isn't a problem IMO, even only say 6 digits there's too many permutations. > I have used 1000 different machines (to achieve concurrency easily) and IPs to send 200k requests (that’s 20 percent of total one million probability) in my tests. I'm just surprised nobody looked at a dashboard and said "huh this account is getting 200k requests", surely that should be raising red flags?

I'm surprised that it's limited to just numbers. Introducing letters and symbols would significantly increase the number of permutations and decrease the odds of a successful brute force attack.

I think my bank uses letter is text-based 2FA.

Re: How I Could Have Hacked Any Instagram Account

#22

Post by filleokus » Thu, Jul 18, 2019, 3:20 PM UTC

I quite recently learnt about “Residential proxies”, for a scraping idea I had. Seems like that can be useful for attacks like this.

It’s surprisingly cheap to get access to services which fan out your requests over millions of normal residential IPs, making them (I assume) hard to block.

Of course their use can be highly objectionable, as well as how they got the proxies installed in homes of people in the first place (semi-malware?)

E.g https://oxylabs.io/pricing/residential-proxy-pool

Re: How I Could Have Hacked Any Instagram Account

#23

Post by ikeboy » Thu, Jul 18, 2019, 3:20 PM UTC

degenerate wrote: post #9

I spot-checked some of those IPs in the video, and it appears all of them are on Amazon. So, what does the attacker's stack look like? Is it a bunch of servers running PHP and listening for a connection to run curl? Or Lambda functions configured to proxy the connection attempt to IG? Curious how much effort goes into setting up an attack like this. It's surprising (to me) that so many IPs can be used for so little m…

I've done scraping distributed over many IPs. I used luminati, bought X IPs, ran a bash script to download all IPs to a file, read the file in from python and spit out a new thread for each IP. Just used as a proxy, all activity was controlled by a single server.

Re Amazon, I've done that too and the way it works is you start up an EC2 instance that does the work and sends back info. In my case I sent the info to an S3 bucket and then pulled all the info from that bucket elsewhere once all the machines finished. Ultimately you pay for what you use, and if you only use an hour across a ton of machines and use the cheapest machine it's pretty cheap.

FYI: luminati will give you unlimited bandwidth for like $1/IP/month.

Re: How I Could Have Hacked Any Instagram Account

#24

Post by jumbopapa » Thu, Jul 18, 2019, 3:22 PM UTC

fortran77 wrote: post #7

That's some hole! Imagine if this were used to get access to a celebrity's IG account. A lot of "damage" to a celebrity brand could have been done.

A UF Air Force Recruiting page was compromised on FB last week and was posting a bunch of racist stuff.

Re: How I Could Have Hacked Any Instagram Account

#25

Post by ttsda » Thu, Jul 18, 2019, 3:24 PM UTC

stibba wrote: post #16

degenerate wrote: post #9

I spot-checked some of those IPs in the video, and it appears all of them are on Amazon. So, what does the attacker's stack look like? Is it a bunch of servers running PHP and listening for a connection to run curl? Or Lambda functions configured to proxy the connection attempt to IG? Curious how much effort goes into setting up an attack like this. It's surprising (to me) that so many IPs can be used for so little m…

I'm curious too, how would he set up so many machines that do the same thing?

The author said in the post comments that he used 1000 EC2 instances.

Re: How I Could Have Hacked Any Instagram Account

#26

Post by CPLX » Thu, Jul 18, 2019, 3:31 PM UTC

GhostVII wrote: post #12

Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA. Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low…

> Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange.

Seems to me that the main mistake was not rate limiting per account right? If you get 200k password requests for a single user something is severely wrong.

Or maybe they did and it didn't work, he makes reference to a race condition in the original post but doesn't elaborate.

Re: How I Could Have Hacked Any Instagram Account

#27

Post by floatingatoll » Thu, Jul 18, 2019, 3:33 PM UTC

someexgamedev wrote: post #11

Is this reset mechanism conceptually flawed? Even with one attempt before invalidating the code, you have a 1:999,999 shot of stealing someone's account by lotto. Not bad odds for an automated process. It's like every account on Instagram has an alternative six digit password.

Sony was using 8 characters of alphanumeric at one point. They reduced it to 6 digits. It turns out that the chance of guessing six digits successfully given one or two tries only is low enough to satisfy human beings when it comes to “annoyance versus protection”, especially when codes expire after a couple attempts.

Re: How I Could Have Hacked Any Instagram Account

#28

Post by [deleted] » Thu, Jul 18, 2019, 3:35 PM UTC

someexgamedev wrote: post #11

Is this reset mechanism conceptually flawed? Even with one attempt before invalidating the code, you have a 1:999,999 shot of stealing someone's account by lotto. Not bad odds for an automated process. It's like every account on Instagram has an alternative six digit password.

[deleted]

Re: How I Could Have Hacked Any Instagram Account

#29

Post by CPLX » Thu, Jul 18, 2019, 3:37 PM UTC

filleokus wrote: post #22

I quite recently learnt about “Residential proxies”, for a scraping idea I had. Seems like that can be useful for attacks like this. It’s surprisingly cheap to get access to services which fan out your requests over millions of normal residential IPs, making them (I assume) hard to block. Of course their use can be highly objectionable, as well as how they got the proxies installed in homes of people in the first pla…

This page was amusing to me: https://oxylabs.io/solutions/ad-verification

This is a euphemism right? Like what they're really saying is that this service would make it possible to fake ad traffic right?

Re: How I Could Have Hacked Any Instagram Account

#30

Post by 55555 » Thu, Jul 18, 2019, 3:45 PM UTC

CPLX wrote: post #29

filleokus wrote: post #22

I quite recently learnt about “Residential proxies”, for a scraping idea I had. Seems like that can be useful for attacks like this. It’s surprisingly cheap to get access to services which fan out your requests over millions of normal residential IPs, making them (I assume) hard to block. Of course their use can be highly objectionable, as well as how they got the proxies installed in homes of people in the first pla…

This page was amusing to me: https://oxylabs.io/solutions/ad-verification This is a euphemism right? Like what they're really saying is that this service would make it possible to fake ad traffic right?

lol... The first sentence below definitely doesn't belong. The second outlines the legitimate use case.

> Hackers and fraudsters use various schemes to fake ad traffic and, as a result, a vast number of ads are never seen by real people. Therefore, more and more companies use proxies to detect fraud, improve ad performance, and check advertisers’ landing pages anonymously.