Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Could Have Hacked Any Instagram Account

thezerohack.com

Post reply on HN
Print view View original

91–100 of 138 posts

Re: How I Could Have Hacked Any Instagram Account

#91

Post by ttsda »

zrobotics wrote: post #38
CPLX wrote: post #26

Earlier quoted context omitted.

> Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Seems to me that the main mistake was not rate limiting per account right? If you get 200k password requests for a single user something is severely wrong. Or maybe they did and it didn't work, he makes reference to a race condition in the original post but doesn't elaborate.

Likely this is to prevent malicious attempts to block access to an account- I can definitely imagine someone trying to block a popular account by abusing the password reset mechanism. Imagine attempting to reset a password of a popular account by spamming the p/W reset mechanism, if the limit is per-account instead of per-IP then you could fairly easily deny access to any account.

How would you be denying access? The block is only by the password reset system, if you know the password you can still access your account.

Re: How I Could Have Hacked Any Instagram Account

#93

Post by mncolinlee »

GhostVII wrote: post #12

Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA. Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low…

The first type of attack that should come to mind with SMS-based 2FA is SIM cloning. Identity question answers can be purchased off the dark web from previous leaks. Also, social engineering is notoriously effective against several of the top carriers, who lack effective identity validation. Lives have been ruined.

Re: How I Could Have Hacked Any Instagram Account

#94

Post by FDSGSG »

tptacek wrote: post #79
rolltiide wrote: post #57

"WE have decided to reward you $30,000" should be "Because the market has decided that hacking top tier instagram accounts is worth a low seven figures, here is your $1,000,000 payout to save you the time, effort and liability of monetizing this yourself"

I don't see any evidence that the market has given a 5-figure value, let alone a 7 figure value, to temporary access to an Instagram account.

Instagram names regularly sell for 5-figure prices on swapd/ogusers. You wouldn't want to go after active accounts.

Re: How I Could Have Hacked Any Instagram Account

#95

Post by jen729w »

spullara wrote: post #82
rwmj wrote: post #46

Earlier quoted context omitted.

Also for people who don't have mobile phone signal at home (hello us), it's almost impossible to use these 2FA systems. There are a few systems including the UK government's own "Verify" scheme for submitting tax returns that I quite literally cannot use. Not that mobile phone 2FA is actually secure. Fraudsters in the UK have discovered that it's possible to take over phone numbers rather easily because that relies o…

A lot of carriers support wifi calling. You should see if yours done and turn it on.

I still don’t think an actual SMS would be received.

SMS is old-school. That thing is going via the tower or it’s not going at all.

(This is just a hunch. Happy to be told I’m wrong!)

Re: How I Could Have Hacked Any Instagram Account

#97

Post by wiml »

jen729w wrote: post #95
spullara wrote: post #82

Earlier quoted context omitted.

A lot of carriers support wifi calling. You should see if yours done and turn it on.

I still don’t think an actual SMS would be received. SMS is old-school. That thing is going via the tower or it’s not going at all. (This is just a hunch. Happy to be told I’m wrong!)

My understanding is that "WiFi Calling" involves having your phone set up an IPsec tunnel (authenticated by your SIM) with your carrier, and then transferring essentially the same packets over that as would be transferred to the cell tower. I think that includes SMS traffic along with everything else.

(IIRC, the 3G and LTE versions of the tunnel carry traffic at different layers of the protocol stack, but in both cases being able to handle SMS and similar non-Internet features is part of the goal. As is being able to handoff between wifi and cellular transports in the middle of a call — I have no idea how well that works in practice.)

Re: How I Could Have Hacked Any Instagram Account

#98

Post by tptacek »

FDSGSG wrote: post #94
tptacek wrote: post #79

Earlier quoted context omitted.

I don't see any evidence that the market has given a 5-figure value, let alone a 7 figure value, to temporary access to an Instagram account.

Instagram names regularly sell for 5-figure prices on swapd/ogusers. You wouldn't want to go after active accounts.

And? How much are you going to pay for a script that lets you steal inactive Instagram accounts that you will then go on to sell on a grey market? You're not going to do it yourself, because when (not if) it's discovered how this happened, there will be an investigation, and you'll get caught, lose all the money you "earned" in legal fees, and (bypassing a login screen is textbook, right-in-the-strike-zone CFAA) spend months in prison. So you have to sell it to someone. How much are they paying? How many buyers are there for it? How long do they get to assume the script will keep working? The more people you sell it to, the less time each of them have to run it. And: when they get caught, if you've sold to several people, there's a significant chance you're going to get caught.

Re: How I Could Have Hacked Any Instagram Account

#99

Post by robin_reala »

rwmj wrote: post #46
GhostVII wrote: post #12

Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA. Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low…

Also for people who don't have mobile phone signal at home (hello us), it's almost impossible to use these 2FA systems. There are a few systems including the UK government's own "Verify" scheme for submitting tax returns that I quite literally cannot use. Not that mobile phone 2FA is actually secure. Fraudsters in the UK have discovered that it's possible to take over phone numbers rather easily because that relies o…

Some Verify providers have a provision for token based 2FA. I used the Post Office for my account with standard TOTP.

Re: How I Could Have Hacked Any Instagram Account

#100

Post by fiblye »

rwmj wrote: post #46
GhostVII wrote: post #12

Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA. Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low…

Also for people who don't have mobile phone signal at home (hello us), it's almost impossible to use these 2FA systems. There are a few systems including the UK government's own "Verify" scheme for submitting tax returns that I quite literally cannot use. Not that mobile phone 2FA is actually secure. Fraudsters in the UK have discovered that it's possible to take over phone numbers rather easily because that relies o…

Or people who change phone numbers for any reason or even travel.

If 2FA decides to kick in then, your account is effectively dead with most companies until you regain access to your old phone number.

Post reply on HN