Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Could Have Hacked Any Instagram Account

thezerohack.com

Post reply on HN
Print view View original

51–60 of 138 posts

Re: How I Could Have Hacked Any Instagram Account

#51

Post by hwstack »

CPLX wrote: post #26
GhostVII wrote: post #12

Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA. Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low…

> Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Seems to me that the main mistake was not rate limiting per account right? If you get 200k password requests for a single user something is severely wrong. Or maybe they did and it didn't work, he makes reference to a race condition in the original post but doesn't elaborate.

He didn't really explain it, but I think what was going on is the rate limiting is done per account, and the race condition was a way to circumvent that. He has to make all the requests very quickly because the first thing all the requests are doing is determining if new requests for this account should be ignored. All the requests are received around the same time, they all make this check and decide they are valid requests, then they all report that an attempt was made for that account (locking it).

The rate limiting for IPs is probably global (not related to the reset endpoint).

Re: How I Could Have Hacked Any Instagram Account

#52

Post by Chris_Chambers »

Having all the text below the headline and above the fold be a giant text-only ad indistinguishable from the content is really stupid. I couldn’t even swipe right to go back to write this comment because it somehow hijacked the implicit mobile back button. This site is a cancerous pile of shit.

Re: How I Could Have Hacked Any Instagram Account

#53

Post by filleokus »

sbarre wrote: post #43
filleokus wrote: post #22

I quite recently learnt about “Residential proxies”, for a scraping idea I had. Seems like that can be useful for attacks like this. It’s surprisingly cheap to get access to services which fan out your requests over millions of normal residential IPs, making them (I assume) hard to block. Of course their use can be highly objectionable, as well as how they got the proxies installed in homes of people in the first pla…

This has to be provided by a botnet or some other malware, right? They claim 30M residential IP addresses.. How would this be done otherwise? There's no info on the site about "signing up" to be a proxy, just about using them..

There are several of these providers, and the only one I noticed saying how they acquired the IP's was Luminati [0]. I didn't look too carefully on all of them though.

> When these application vendors integrate the Luminati SDK, their users are offered the alternative to not watch these video ads in return for opting in to the Luminati network.

https://luminati.io/faq#lum-peers-join.

Re: How I Could Have Hacked Any Instagram Account

#54

Post by oarsinsync »

pmarreck wrote: post #20
GhostVII wrote: post #12

Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA. Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low…

I have turned off phone 2FA on all services that permit me to do so after getting hacked by someone using that exploit. Typically I use Google 2FA via Authy or Authy itself

> Google 2FA via Authy

"Google 2FA" is TOTP, an open standard, not a Google produced solution.

https://tools.ietf.org/html/rfc6238

Re: How I Could Have Hacked Any Instagram Account

#56

Post by raws »

floatingatoll wrote: post #27
someexgamedev wrote: post #11

Is this reset mechanism conceptually flawed? Even with one attempt before invalidating the code, you have a 1:999,999 shot of stealing someone's account by lotto. Not bad odds for an automated process. It's like every account on Instagram has an alternative six digit password.

Sony was using 8 characters of alphanumeric at one point. They reduced it to 6 digits. It turns out that the chance of guessing six digits successfully given one or two tries only is low enough to satisfy human beings when it comes to “annoyance versus protection”, especially when codes expire after a couple attempts.

Yeah that is if they limit attempts and put code expiry in place which instagram did not have and as well it's missing warning systems for users as well as a temporary locking mechanism for such a feature if fraud is detected by the user. Those limits are more important to personalities than a lambda user.

Re: How I Could Have Hacked Any Instagram Account

#58

Post by yardstick »

hwstack wrote: post #51
CPLX wrote: post #26

Earlier quoted context omitted.

> Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Seems to me that the main mistake was not rate limiting per account right? If you get 200k password requests for a single user something is severely wrong. Or maybe they did and it didn't work, he makes reference to a race condition in the original post but doesn't elaborate.

He didn't really explain it, but I think what was going on is the rate limiting is done per account, and the race condition was a way to circumvent that. He has to make all the requests very quickly because the first thing all the requests are doing is determining if new requests for this account should be ignored. All the requests are received around the same time, they all make this check and decide they are valid…

I think you are dead on, yeah it’s the quick rate of large numbers of requests that avoid the per-account rate limiting. Curious how they resolved this— run all authentication requests for a given user serially and in a consolidated fashion at some point. Exclusive lock the relevant db record before checking the code and recording the failure?

Re: How I Could Have Hacked Any Instagram Account

#59

Post by ISL »

rolltiide wrote: post #57

"WE have decided to reward you $30,000" should be "Because the market has decided that hacking top tier instagram accounts is worth a low seven figures, here is your $1,000,000 payout to save you the time, effort and liability of monetizing this yourself"

There's one key omission in that list -- time, effort, liability, and prison.
Post reply on HN