Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Could Have Hacked Any Instagram Account

thezerohack.com

Post reply on HN
Print view View original

41–50 of 138 posts

Re: How I Could Have Hacked Any Instagram Account

#41

Post by shawabawa3 »

pmarreck wrote: post #20
GhostVII wrote: post #12

Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA. Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low…

I have turned off phone 2FA on all services that permit me to do so after getting hacked by someone using that exploit. Typically I use Google 2FA via Authy or Authy itself

you should be aware that Authy can by default be taken over with just your sim card. I believe with the right settings you can disable this behaviour

Re: How I Could Have Hacked Any Instagram Account

#43

Post by sbarre »

filleokus wrote: post #22

I quite recently learnt about “Residential proxies”, for a scraping idea I had. Seems like that can be useful for attacks like this. It’s surprisingly cheap to get access to services which fan out your requests over millions of normal residential IPs, making them (I assume) hard to block. Of course their use can be highly objectionable, as well as how they got the proxies installed in homes of people in the first pla…

This has to be provided by a botnet or some other malware, right?

They claim 30M residential IP addresses.. How would this be done otherwise?

There's no info on the site about "signing up" to be a proxy, just about using them..

Re: How I Could Have Hacked Any Instagram Account

#44

Post by mtrovo »

ikeboy wrote: post #23
degenerate wrote: post #9

I spot-checked some of those IPs in the video, and it appears all of them are on Amazon. So, what does the attacker's stack look like? Is it a bunch of servers running PHP and listening for a connection to run curl? Or Lambda functions configured to proxy the connection attempt to IG? Curious how much effort goes into setting up an attack like this. It's surprising (to me) that so many IPs can be used for so little m…

I've done scraping distributed over many IPs. I used luminati, bought X IPs, ran a bash script to download all IPs to a file, read the file in from python and spit out a new thread for each IP. Just used as a proxy, all activity was controlled by a single server. Re Amazon, I've done that too and the way it works is you start up an EC2 instance that does the work and sends back info. In my case I sent the info to an…

Is this the company that offers a free VPN extension and pays for it selling those people machines bandwidth? I always thought their business model is way too shady to be legal.

Re: How I Could Have Hacked Any Instagram Account

#46

Post by rwmj »

GhostVII wrote: post #12

Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA. Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low…

Also for people who don't have mobile phone signal at home (hello us), it's almost impossible to use these 2FA systems. There are a few systems including the UK government's own "Verify" scheme for submitting tax returns that I quite literally cannot use.

Not that mobile phone 2FA is actually secure. Fraudsters in the UK have discovered that it's possible to take over phone numbers rather easily because that relies on the phone companies' own systems which are (predictably) insecure.

Re: How I Could Have Hacked Any Instagram Account

#47

Post by claviola »

pmarreck wrote: post #20
GhostVII wrote: post #12

Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA. Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low…

I have turned off phone 2FA on all services that permit me to do so after getting hacked by someone using that exploit. Typically I use Google 2FA via Authy or Authy itself

I've been considering getting a second, secret SIM card exclusively for use with services where SMS 2FA is the only option.

Re: How I Could Have Hacked Any Instagram Account

#48

Post by flatiron »

shawabawa3 wrote: post #40
stibba wrote: post #16

Earlier quoted context omitted.

I'm curious too, how would he set up so many machines that do the same thing?

It's very easy to terraform 1000 nano machines on ec2, as he said it wouldn't be expensive at all. In fact, he estimates $150, but for 1000 nano machines for 10 minutes i believe it's under a dollar. Possibly nano machines aren't powerful enough to spam the verify endpoint enough

200 curls can be ran from any ec2 instance. there is literally no overhead.

personally i would spin up a million lambda functions and just see what happens. each one def wouldn't get its own ip but maybe you would have good coverage?

Re: How I Could Have Hacked Any Instagram Account

#49

Post by dylz »

mtrovo wrote: post #44
ikeboy wrote: post #23

Earlier quoted context omitted.

I've done scraping distributed over many IPs. I used luminati, bought X IPs, ran a bash script to download all IPs to a file, read the file in from python and spit out a new thread for each IP. Just used as a proxy, all activity was controlled by a single server. Re Amazon, I've done that too and the way it works is you start up an EC2 instance that does the work and sends back info. In my case I sent the info to an…

Is this the company that offers a free VPN extension and pays for it selling those people machines bandwidth? I always thought their business model is way too shady to be legal.

Yeah. There's been numerous cases of people just grabbing a stolen credit card and getting a botnet to attack sites with.

Re: How I Could Have Hacked Any Instagram Account

#50

Post by ikeboy »

mtrovo wrote: post #44
ikeboy wrote: post #23

Earlier quoted context omitted.

I've done scraping distributed over many IPs. I used luminati, bought X IPs, ran a bash script to download all IPs to a file, read the file in from python and spit out a new thread for each IP. Just used as a proxy, all activity was controlled by a single server. Re Amazon, I've done that too and the way it works is you start up an EC2 instance that does the work and sends back info. In my case I sent the info to an…

Is this the company that offers a free VPN extension and pays for it selling those people machines bandwidth? I always thought their business model is way too shady to be legal.

They sold a majority stake at a valuation of $200MM and it's now a separate company from the one that runs the VPN.
Post reply on HN