How I Could Have Hacked Any Instagram Account • Hacker News Board

Re: How I Could Have Hacked Any Instagram Account

#121

Post by AgentME » Fri, Jul 19, 2019, 3:55 AM UTC

_57jb wrote: post #114

So a bit of a strongly worded title. I'm going to nitpick for a second. First you need the device-id, second you need the code that will be sent via text. The code sent via text is 6 digits meaning 10^6 == 1MM permutations. He shows how he can enumerate these using 1K IP's ultimately bruteforcing the reset code. The Device ID is still not captured although I'm guessing they allow handwaving via a malicious app or som…

He's doing the password reset flow from his own device, and receives a link to the form containing the session id and his device id. He doesn't need to bruteforce those.

Instagram had a limit on the number of times that the user could guess the code, but they had a race condition that let the limit be bypassed. The fix is for them to fix the race condition.

Re: How I Could Have Hacked Any Instagram Account

#122

Post by ridaj » Fri, Jul 19, 2019, 5:03 AM UTC

GhostVII wrote: post #12

Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA. Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low…

I used to work at a cell phone company. One day I needed to change my SIM card so I call up the help desk :

"Hi I have a new SIM card, can you please activate it?

— Sure what's your number and IMSI?

— My number is ..., the IMSI is ...

— OK done"

And so, just like that, I took over someone else's phone number. Not on purpose, but the guy made a mistake punching in my number, didn't verify my identity, and ended up assigning someone else's phone number to my SIM card. I called the guy back after realizing that I wasn't getting calls and that the people I called thought I now had a new number.

Granted it was a while ago but the experience gave me a very low opinion of SMS for 2FA.

Re: How I Could Have Hacked Any Instagram Account

#123

Post by rolltiide » Fri, Jul 19, 2019, 5:37 AM UTC

mlrtime wrote: post #115

rolltiide wrote: post #102

Earlier quoted context omitted.

the hijacking happens on the grey market because there is no reliable escrow agent and its already against the terms of service of IG you don't need this script to find the accounts, you would use it when you promised to buy or sell an account and hack the phone number based 2-factor to either assume control of the account without paying, or steal it back but if you did want to scale this up to stealing normal user's…

This is true , the only way I've seen accounts recovered: 1) Higher a lawyer and threaten a lawsuit. 2) If you have the ID you can hire a hacker to get it back.

Thanks for chiming in, the people on hackernews often want an easily google-able peer reviewed study on some stuff thats private for a reason

Its lazy to derail a discussion with “I didnt see it so SOURCE! Ha Im so right about everything your whole argument is invalid”

instead of

“oh thats a problem what can we do about that” especially when unsubstantiated nonsense isn't really a big problem here, while completely misunderstanding problems and solutions is what this forum gets laughed at about

Re: How I Could Have Hacked Any Instagram Account

#124

Post by FDSGSG » Fri, Jul 19, 2019, 6:57 AM UTC

tptacek wrote: post #98

FDSGSG wrote: post #94

Earlier quoted context omitted.

Instagram names regularly sell for 5-figure prices on swapd/ogusers. You wouldn't want to go after active accounts.

And? How much are you going to pay for a script that lets you steal inactive Instagram accounts that you will then go on to sell on a grey market? You're not going to do it yourself, because when (not if) it's discovered how this happened, there will be an investigation, and you'll get caught, lose all the money you "earned" in legal fees, and (bypassing a login screen is textbook , right-in-the-strike-zone CFAA) spe…

OTOH someone stealing inactive instagram usernames is likely to be the lowest possible priority to law enforcement.

Re: How I Could Have Hacked Any Instagram Account

#125

Post by oarsinsync » Fri, Jul 19, 2019, 8:46 AM UTC

claviola wrote: post #47

pmarreck wrote: post #20

Earlier quoted context omitted.

I have turned off phone 2FA on all services that permit me to do so after getting hacked by someone using that exploit. Typically I use Google 2FA via Authy or Authy itself

I've been considering getting a second, secret SIM card exclusively for use with services where SMS 2FA is the only option.

That's a great plan, and it definitely reduces your risk to being exposed to SIM hijacking. Unfortunately, I suspect services that enforce poor security standards are probably not following best practices in their backend either. This means your secret number stops being secret if their database ever leaks.

It's still better than using the same number as you use for everything else, but it's important to understand the caveats.

Re: How I Could Have Hacked Any Instagram Account

#126

Post by laumars » Fri, Jul 19, 2019, 10:08 AM UTC

ldoughty wrote: post #39

laumars wrote: post #19

Earlier quoted context omitted.

He's probably lambda rather than EC2 or even docker but I'd be interested to know the details too.

Docker doesn't help distribute requests over IPs, lambda or ec2 most likely. You can easily set up a launch configuration for EC2 that runs a script or program... But with a bit more work lambda will save a lot of money

> Docker doesn't help distribute requests over IPs

That depends on your orchestration. AWS provide several tools for running Docker without having to maintain your own EC2 hosts.

> You can easily set up a launch configuration for EC2 that runs a script or program... But with a bit more work lambda will save a lot of money

You could do that via a launch configuration but that would be a pretty naff way of doing it. Baked AMI would be easier but personally I'd prefer ECS (Docker) or lambda. Cheaper, quicker to deploy, lower ramp up times.

Ultimately though, there's no wrong way to do this - just personal preference.

Re: How I Could Have Hacked Any Instagram Account

#127

Post by kalleboo » Fri, Jul 19, 2019, 10:12 AM UTC

fiblye wrote: post #100

rwmj wrote: post #46

Earlier quoted context omitted.

Also for people who don't have mobile phone signal at home (hello us), it's almost impossible to use these 2FA systems. There are a few systems including the UK government's own "Verify" scheme for submitting tax returns that I quite literally cannot use. Not that mobile phone 2FA is actually secure. Fraudsters in the UK have discovered that it's possible to take over phone numbers rather easily because that relies o…

Or people who change phone numbers for any reason or even travel. If 2FA decides to kick in then, your account is effectively dead with most companies until you regain access to your old phone number.

I lost my Uber account to this after I logged in on a prepaid SIM while traveling and didn't reset it before tossing the SIM

Re: How I Could Have Hacked Any Instagram Account

#128

Post by kalleboo » Fri, Jul 19, 2019, 10:19 AM UTC

claviola wrote: post #47

pmarreck wrote: post #20

Earlier quoted context omitted.

I have turned off phone 2FA on all services that permit me to do so after getting hacked by someone using that exploit. Typically I use Google 2FA via Authy or Authy itself

I've been considering getting a second, secret SIM card exclusively for use with services where SMS 2FA is the only option.

This is standard practice for public figures like YouTubers who often get griefed

Re: How I Could Have Hacked Any Instagram Account

#129

Post by yardstick » Fri, Jul 19, 2019, 10:47 AM UTC

chatmasta wrote: post #113

yardstick wrote: post #58

Earlier quoted context omitted.

I think you are dead on, yeah it’s the quick rate of large numbers of requests that avoid the per-account rate limiting. Curious how they resolved this— run all authentication requests for a given user serially and in a consolidated fashion at some point. Exclusive lock the relevant db record before checking the code and recording the failure?

Distributed rate limiting is hard. He could hit multiple front ends simultaneously before they have a chance to catchup to the correct counts.

Yeah it is hard. The enforcement would need to be done on a single backend. Not all users need to have their auth done by the same specific backend, but each user individually should always have their auth go to the same backend (or same concurrency domain, if distributed locking applies to the architecture).

Re: How I Could Have Hacked Any Instagram Account

#130

Post by shawabawa3 » Fri, Jul 19, 2019, 11:00 AM UTC

fredsted wrote: post #73

shawabawa3 wrote: post #40

Earlier quoted context omitted.

It's very easy to terraform 1000 nano machines on ec2, as he said it wouldn't be expensive at all. In fact, he estimates $150, but for 1000 nano machines for 10 minutes i believe it's under a dollar. Possibly nano machines aren't powerful enough to spam the verify endpoint enough

Wouldn't you be hitting EC2 limits pretty quickly though? I guess you could get them raised, but last time AWS wanted a valid reason.

> but last time AWS wanted a valid reason.

Yep - my reason is normally "I'm planning a project that needs more instances"

I doubt they even look at that field to be honest