How I Could Have Hacked Any Instagram Account

Post by CPLX » Thu, Jul 18, 2019, 3:50 PM UTC

55555 wrote: post #30

CPLX wrote: post #29

Earlier quoted context omitted.

This page was amusing to me: https://oxylabs.io/solutions/ad-verification This is a euphemism right? Like what they're really saying is that this service would make it possible to fake ad traffic right?

lol... The first sentence below definitely doesn't belong. The second outlines the legitimate use case. > Hackers and fraudsters use various schemes to fake ad traffic and, as a result, a vast number of ads are never seen by real people. Therefore, more and more companies use proxies to detect fraud, improve ad performance, and check advertisers’ landing pages anonymously.

Post by notduncansmith » Thu, Jul 18, 2019, 3:51 PM UTC

ikeboy wrote: post #23

degenerate wrote: post #9

I spot-checked some of those IPs in the video, and it appears all of them are on Amazon. So, what does the attacker's stack look like? Is it a bunch of servers running PHP and listening for a connection to run curl? Or Lambda functions configured to proxy the connection attempt to IG? Curious how much effort goes into setting up an attack like this. It's surprising (to me) that so many IPs can be used for so little m…

I've done scraping distributed over many IPs. I used luminati, bought X IPs, ran a bash script to download all IPs to a file, read the file in from python and spit out a new thread for each IP. Just used as a proxy, all activity was controlled by a single server. Re Amazon, I've done that too and the way it works is you start up an EC2 instance that does the work and sends back info. In my case I sent the info to an…

Post by penagwin » Thu, Jul 18, 2019, 3:57 PM UTC

kristiandupont wrote: post #6

penagwin wrote: post #5

Earlier quoted context omitted.

Yeah for sure, a few attempts isn't a problem IMO, even only say 6 digits there's too many permutations. > I have used 1000 different machines (to achieve concurrency easily) and IPs to send 200k requests (that’s 20 percent of total one million probability) in my tests. I'm just surprised nobody looked at a dashboard and said "huh this account is getting 200k requests", surely that should be raising red flags?

How many requests does IG handle per second? I am not even going to guess a number but I am sure 1000 specific requests would drown in that. So you would need a dashboard that specifically visualizes this kind of thing. Do that and you are now protecting yourself in one type of scenario. But there are endless other scenarios that you still wouldn't see.

Post by ummonk » Thu, Jul 18, 2019, 4:06 PM UTC

dahfizz wrote: post #34

GhostVII wrote: post #12

Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA. Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low…

> Why wouldn't Instagram just allow a fixed number of tries (some low limit, like 25) from any IP before invalidating the code? This could makes it very easy to perform a DOS attack against a user. You could constantly send failed attempts and make it impossible for the user to type in the real code before you invalidate it.

Post by ldoughty » Thu, Jul 18, 2019, 4:10 PM UTC

laumars wrote: post #19

stibba wrote: post #16

Earlier quoted context omitted.

I'm curious too, how would he set up so many machines that do the same thing?

He's probably lambda rather than EC2 or even docker but I'd be interested to know the details too.