Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Could Have Hacked Any Instagram Account

thezerohack.com

Post reply on HN
Print view View original

131–138 of 138 posts

Re: How I Could Have Hacked Any Instagram Account

#131

Post by kalleboo »

throwaway66666 wrote: post #65
floatingatoll wrote: post #27

Earlier quoted context omitted.

Sony was using 8 characters of alphanumeric at one point. They reduced it to 6 digits. It turns out that the chance of guessing six digits successfully given one or two tries only is low enough to satisfy human beings when it comes to “annoyance versus protection”, especially when codes expire after a couple attempts.

Problem with alphanumeric, is you have people from foreign countries who do not even have an english keyboard installed on their phone. Default is probably their native language and they do not care to add a secondary or switch. Numeric values solve that problem. edit: drunk typing

Is that a thing? Domain names, email addresses, passwords all tend to require the latin character set. Here in Japan I can't remember seeing a single site that uses kanji passwords.

Re: How I Could Have Hacked Any Instagram Account

#132

Post by tripzilch »

ridaj wrote: post #122
GhostVII wrote: post #12

Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA. Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low…

I used to work at a cell phone company. One day I needed to change my SIM card so I call up the help desk : "Hi I have a new SIM card, can you please activate it? — Sure what's your number and IMSI? — My number is ..., the IMSI is ... — OK done" And so, just like that, I took over someone else's phone number. Not on purpose, but the guy made a mistake punching in my number, didn't verify my identity, and ended up ass…

Friend of mine walked into a mobile phone store to do pretty much the same thing and he was also extremely surprised that they didn't ask for any extra info or ID. He did get the correct number, though :)

Re: How I Could Have Hacked Any Instagram Account

#134

Post by davinic »

penagwin wrote: post #35
kristiandupont wrote: post #6

Earlier quoted context omitted.

How many requests does IG handle per second? I am not even going to guess a number but I am sure 1000 specific requests would drown in that. So you would need a dashboard that specifically visualizes this kind of thing. Do that and you are now protecting yourself in one type of scenario. But there are endless other scenarios that you still wouldn't see.

Authentication is certainly a scenario I think you'd want to monitor for brute force attacks? Sure IG gets 1000's+ requests a second, but they shouldn't be getting 1000's+ requests per second per user - especially on a login route. I monitor 400 requests on our website - A massive spike in those would warrant investigation.

But once you know that this is a specific attack surface, it's far easier to limit the surface (fix the problem) rather than build a dashboard that a human has to monitor perpetually.

Re: How I Could Have Hacked Any Instagram Account

#135

Post by pmarreck »

oarsinsync wrote: post #54
pmarreck wrote: post #20

Earlier quoted context omitted.

I have turned off phone 2FA on all services that permit me to do so after getting hacked by someone using that exploit. Typically I use Google 2FA via Authy or Authy itself

> Google 2FA via Authy "Google 2FA" is TOTP, an open standard, not a Google produced solution. https://tools.ietf.org/html/rfc6238

Thanks for the clarification. I knew it was open-source, didn't realize it was an RFC.

Re: How I Could Have Hacked Any Instagram Account

#136

Post by bhandziuk »

mychael wrote: post #70

Low bounties like that are going to motivate hackers to sell to malicious actors instead of going through the proper channels. Facebook should know better.

30,000 $ is a low bounty? It seems like a lot of money to me. How much should they reward?

Re: How I Could Have Hacked Any Instagram Account

#137

Post by hkai »

herpderperator wrote: post #85

Seems like a lot of improvements could have been made here. After you get the code wrong, it should reset and send you a different code. If you get more than 3 wrong in some pre-determined time, it should lock the person out for some other pre-determined time. You could even use exponential backoff time in both scenarios. Keeping the code the same after getting it wrong just seems really stupid.

Mathematically, does regenerating the code make a lot of difference?

You can simulate that by running a loop that generates a random 4-digit number in each iteration and randomly guessing it.

On average, you will guess the number after 10,000 iterations. It doesn't help that you regenerate the number each time. Your chance is still 1/10,000.

Re: How I Could Have Hacked Any Instagram Account

#138

Post by spullara »

jen729w wrote: post #95
spullara wrote: post #82

Earlier quoted context omitted.

A lot of carriers support wifi calling. You should see if yours done and turn it on.

I still don’t think an actual SMS would be received. SMS is old-school. That thing is going via the tower or it’s not going at all. (This is just a hunch. Happy to be told I’m wrong!)

SMS will be received. It is just like being on the normal cell network.
Post reply on HN