Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Could Have Hacked Any Instagram Account

thezerohack.com

Post reply on HN
Print view View original

101–110 of 138 posts

Re: How I Could Have Hacked Any Instagram Account

#101

Post by rolltiide »

tptacek wrote: post #79
rolltiide wrote: post #57

"WE have decided to reward you $30,000" should be "Because the market has decided that hacking top tier instagram accounts is worth a low seven figures, here is your $1,000,000 payout to save you the time, effort and liability of monetizing this yourself"

I don't see any evidence that the market has given a 5-figure value, let alone a 7 figure value, to temporary access to an Instagram account.

and Facebook couldn't see any evidence this hack was worth $30,000 until there was video evidence and a detailed description given to them exclusively, with no information on message boards of articles to put it in the collective conscious, or “peer review” publicly. so does your perception matter? anyway I detailed how the instagram economy works in one of my other comments

Also it wouldn't be temporary access lol. When you take over an instagram account you change the email address and the username twice, the person you took it from gets the alert email for the first change, the second email gets the alert for the second change to the third email address. The original owner doesn't know what/where the account is anymore.

Re: How I Could Have Hacked Any Instagram Account

#102

Post by rolltiide »

tptacek wrote: post #98
FDSGSG wrote: post #94

Earlier quoted context omitted.

Instagram names regularly sell for 5-figure prices on swapd/ogusers. You wouldn't want to go after active accounts.

And? How much are you going to pay for a script that lets you steal inactive Instagram accounts that you will then go on to sell on a grey market? You're not going to do it yourself, because when (not if) it's discovered how this happened, there will be an investigation, and you'll get caught, lose all the money you "earned" in legal fees, and (bypassing a login screen is textbook , right-in-the-strike-zone CFAA) spe…

the hijacking happens on the grey market because there is no reliable escrow agent and its already against the terms of service of IG

you don't need this script to find the accounts, you would use it when you promised to buy or sell an account and hack the phone number based 2-factor

to either assume control of the account without paying, or steal it back

but if you did want to scale this up to stealing normal user's accounts, stealing instagram accounts is merely a factor of changing the email address twice and then the account name. after which the original owner knows their account got stolen but has no record of the account lol, because they don't know the account ID, just the old username and email address which is super gone and doesn't match any record. you won't get caught primarily because there are too many barriers of entry for someone to take it seriously enough to investigate.

Re: How I Could Have Hacked Any Instagram Account

#103

Post by merb »

tylerhou wrote: post #86
ummonk wrote: post #37

Earlier quoted context omitted.

Add a captcha then.

Still not hard to manually DOS. And to do it at scale you only have to pay 2.5 cents per invalidation.

well you can't dos a user forever. and it's quite impossible that somebody knows that a user lost it's password and DOS's the reset mechanism.

Re: How I Could Have Hacked Any Instagram Account

#104

Post by floatingatoll »

CPLX wrote: post #26
GhostVII wrote: post #12

Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA. Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low…

> Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Seems to me that the main mistake was not rate limiting per account right? If you get 200k password requests for a single user something is severely wrong. Or maybe they did and it didn't work, he makes reference to a race condition in the original post but doesn't elaborate.

If you use a sharded “eventual consistency” database cluster to store the number of reset attempts per interval, then sufficient IPs can be purchased to overwhelm your “eventual” threshold unless each reset attempt compels consistency before evaluating whether the limit is reached. That would qualify as a “race condition” in language terms, even if not being the classical sort of one considered such by programmers, and present the easy described fix (take a consistent read lock rather than an inconsistent one or none at all) when checking the rate limit.

Re: How I Could Have Hacked Any Instagram Account

#105

Post by merb »

fredsted wrote: post #73
shawabawa3 wrote: post #40

Earlier quoted context omitted.

It's very easy to terraform 1000 nano machines on ec2, as he said it wouldn't be expensive at all. In fact, he estimates $150, but for 1000 nano machines for 10 minutes i believe it's under a dollar. Possibly nano machines aren't powerful enough to spam the verify endpoint enough

Wouldn't you be hitting EC2 limits pretty quickly though? I guess you could get them raised, but last time AWS wanted a valid reason.

"load testing my website INSERT_VALID_WEBSITE_LINK"

Re: How I Could Have Hacked Any Instagram Account

#107

Post by tptacek »

rolltiide wrote: post #102
tptacek wrote: post #98

Earlier quoted context omitted.

And? How much are you going to pay for a script that lets you steal inactive Instagram accounts that you will then go on to sell on a grey market? You're not going to do it yourself, because when (not if) it's discovered how this happened, there will be an investigation, and you'll get caught, lose all the money you "earned" in legal fees, and (bypassing a login screen is textbook , right-in-the-strike-zone CFAA) spe…

the hijacking happens on the grey market because there is no reliable escrow agent and its already against the terms of service of IG you don't need this script to find the accounts, you would use it when you promised to buy or sell an account and hack the phone number based 2-factor to either assume control of the account without paying, or steal it back but if you did want to scale this up to stealing normal user's…

This isn't answering any of the questions I asked, except that you think "you won't get caught because nobody will take this seriously enough to investigate", which is true if nobody makes more than a couple thousand dollars doing this, but not true if someone manages to make, like, $100,000 doing it.

Re: How I Could Have Hacked Any Instagram Account

#108

Post by tptacek »

rolltiide wrote: post #101
tptacek wrote: post #79

Earlier quoted context omitted.

I don't see any evidence that the market has given a 5-figure value, let alone a 7 figure value, to temporary access to an Instagram account.

and Facebook couldn't see any evidence this hack was worth $30,000 until there was video evidence and a detailed description given to them exclusively, with no information on message boards of articles to put it in the collective conscious, or “peer review” publicly. so does your perception matter? anyway I detailed how the instagram economy works in one of my other comments Also it wouldn't be temporary access lol.…

It's not "worth" $30,000; it's probably worth much less than that. The $30,000 has a much more powerful marketing function than it does intrinsic utility.

It's temporary access because you can trivially write a tool that goes through Facebook's audit logs to find out which accounts have likely been taken over using this tool, which is something Facebook would certainly do if there was evidence that people had been exploiting it at any kind of scale.

A big chunk of my last year has been in ATO detection and mitigation and I think you'd be surprised what kind of dumb stuff generates serious investigations from companies with far fewer security team resources than Facebook.

Re: How I Could Have Hacked Any Instagram Account

#110

Post by gjs278 »

GhostVII wrote: post #12

Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA. Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low…

I was the victim of a sim port just last night. they tried to get into my coinbase.
Post reply on HN