Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The newest Instagram “exploit” is the goofiest I've seen

0xsid.com

Post reply on HN
Print view View original

61–70 of 528 posts

Re: The newest Instagram “exploit” is the goofiest I've seen

#61

Post by nashashmi »

hbn wrote: post #21

It's insane the AI has been provided the tooling to send emails to arbitrary addresses like that. Like, getting it to send a 2FA code at a user's request is one thing. But it should only be able to "hit a button" to send a 2FA email to the address attached to the account, all run with hand-written code. It shouldn't have access to the 2FA code itself, or the message subject, or body, or the recipient address, etc. Wh…

Some Jr engineer got tired of handling stupid support requests and automated the job with an agent. That’s how.

Assigning Jr engineers for security support is ridiculous partly because young people don’t understand how critical security is sometimes. And partly because they don’t value privacy as much.

Re: The newest Instagram “exploit” is the goofiest I've seen

#62

Post by plagiarist »

hbn wrote: post #21

It's insane the AI has been provided the tooling to send emails to arbitrary addresses like that. Like, getting it to send a 2FA code at a user's request is one thing. But it should only be able to "hit a button" to send a 2FA email to the address attached to the account, all run with hand-written code. It shouldn't have access to the 2FA code itself, or the message subject, or body, or the recipient address, etc. Wh…

This exploit is my new gold standard for trivially avoidable security failures. Someone has finally beaten Gitlab's password reset emails to attacker-provided addresses.

Re: The newest Instagram “exploit” is the goofiest I've seen

#63

Post by spullara »

acdha wrote: post #36
spullara wrote: post #11

Earlier quoted context omitted.

recovery is always the weakest link in any authentication system

This is not wrong but what’s really missing is cost: Meta did this so they can avoid paying people to do it. Lots of companies follow that decay spiral: your bank could shut phishers down cold by requiring wire transfers to be authorized in person but they don’t want to pay staff or risk you being upset by a transaction taking an extra hour so they don’t. Imagine an alternate universe where big tech companies worked…

for a while facebook had the ability to recover your account by having them ask several of your friends if the recovery was legitimate but it was turned off. my guess is that not enough people added trusted contacts to bother running it.

https://www.theverge.com/2013/5/2/4292744/facebook-trusted-c...

Re: The newest Instagram “exploit” is the goofiest I've seen

#65

Post by [deleted] »

dpark wrote: post #43
hbn wrote: post #21

It's insane the AI has been provided the tooling to send emails to arbitrary addresses like that. Like, getting it to send a 2FA code at a user's request is one thing. But it should only be able to "hit a button" to send a 2FA email to the address attached to the account, all run with hand-written code. It shouldn't have access to the 2FA code itself, or the message subject, or body, or the recipient address, etc. Wh…

This exploit has essentially nothing to do with AI and everything to do with a terribly designed account recovery flow. This exact same flow could have been (and may have been; I don’t know how much the chatbot here actually does) statically coded.

[deleted]

Re: The newest Instagram “exploit” is the goofiest I've seen

#66

Post by toast0 »

toomuchtodo wrote: post #23
SoftTalker wrote: post #20

Earlier quoted context omitted.

It's a tough problem, because people forget passwords, change phones, lose access to 2FA devices, but still need to use their accounts.

I manage customer identity and access management ("CIAM") for a financial services firm. Passkeys are primary, recovery can be performed by providing a government credential remotely (which costs us ~$2-3 per recovery). I do not think it is hard, based on what we have built and spent to enable these capabilities. NIST Special Publication NIST SP 800-63 Digital Identity Guidelines is a helpful resource on this topic.…

> recovery can be performed by providing a government credential remotely

That only works because you presumably do KYC when you open accounts, so you have an identity to match to. Most internet accounts don't do real KYC, so a government credential doesn't really work for recovery --- they didn't know who you were, so proving who you are doesn't help anything.

That doesn't mean that letting anyone sweet talk support or an AI into taking over an account is acceptable, of course.

Re: The newest Instagram “exploit” is the goofiest I've seen

#68

Post by mrandish »

I get that account recovery for sites with hundreds of millions of users is a huge burden they're struggling to manage but I'm shocked they didn't restrict such loose verification to the >90% of lower value accounts that aren't worth stealing and keep the stricter verif on high-value accounts.

The next obvious thing would be to let accounts the algorithm judges to be low-value still opt-in to strict verif. The vast majority of low-value accts won't bother flipping it on if the option is buried two menus deep, but many of the few low follower/views accts who are targets for some other reason (political, stalker, etc) - know they are targets and can self-protect by opting in, further reducing account hijacks.

So, before we even get to whether this 'loose' verif is "bad", those two simple implementation changes would certainly have cut the bad outcomes of a (potentially) bad idea by >95%.

Re: The newest Instagram “exploit” is the goofiest I've seen

#70

Post by toomuchtodo »

toast0 wrote: post #66
toomuchtodo wrote: post #23

Earlier quoted context omitted.

I manage customer identity and access management ("CIAM") for a financial services firm. Passkeys are primary, recovery can be performed by providing a government credential remotely (which costs us ~$2-3 per recovery). I do not think it is hard, based on what we have built and spent to enable these capabilities. NIST Special Publication NIST SP 800-63 Digital Identity Guidelines is a helpful resource on this topic.…

> recovery can be performed by providing a government credential remotely That only works because you presumably do KYC when you open accounts, so you have an identity to match to. Most internet accounts don't do real KYC, so a government credential doesn't really work for recovery --- they didn't know who you were, so proving who you are doesn't help anything. That doesn't mean that letting anyone sweet talk support…

It's a fair point, and can be solved for as part of the "Verified" offerings Meta offers. This binds IRL identity to the digital identity at verification for future identity assurance step up (including if and when recovery is required). Failing that, TOTP, SMS, and even mailing an OTP to a mailing address remain low friction auth factors (with, of course, various levels of security).

My point is that while this is not easy, there are obvious very bad ways to implement this that should not be done (chatbot or other generative AI interface vulnerable to the usual suspects of AI inherent attack surface). Don't build the bad way, the right away is known and straightforward.

Post reply on HN