Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The newest Instagram “exploit” is the goofiest I've seen

0xsid.com

Post reply on HN
Print view View original

101–110 of 528 posts

Re: The newest Instagram “exploit” is the goofiest I've seen

#101

Post by MarleTangible »

basisword wrote: post #86
sosodev wrote: post #9

Support requests have always been the weakest link in the security chain for big corps. I've had accounts of mine turned over with 2FA disabled by humans before. I guess we shouldn't be surprised that the LLMs are doing the same thing. The simple fact that 2FA can be removed by low level support staff drives me mad. It defeats the whole purpose of the process.

>> The simple fact that 2FA can be removed by low level support staff drives me mad. It defeats the whole purpose of the process. The fact it can be removed by anyone is the problem. If you lose access to your 2FA (and recovery codes) then you should lose access to your account. Having it removable by anyone (other than a logged in account holder) defeats the entire point.

In theory there is no difference between theory and practice, but in practice there is. Well, it gets complicated quickly when a wide range of users involved.

Re: The newest Instagram “exploit” is the goofiest I've seen

#102

Post by nkrisc »

dpark wrote: post #43
hbn wrote: post #21

It's insane the AI has been provided the tooling to send emails to arbitrary addresses like that. Like, getting it to send a 2FA code at a user's request is one thing. But it should only be able to "hit a button" to send a 2FA email to the address attached to the account, all run with hand-written code. It shouldn't have access to the 2FA code itself, or the message subject, or body, or the recipient address, etc. Wh…

This exploit has essentially nothing to do with AI and everything to do with a terribly designed account recovery flow. This exact same flow could have been (and may have been; I don’t know how much the chatbot here actually does) statically coded.

The AI part does seem relevant because it enabled incredibly low-effort “social” engineering.

For what it’s worth I don’t think you can call this social engineering since there was no human on the other end, even though it appears similar.

The question is, if there were actual human support agents, would they have built additional safeguards to prevent social engineering in this manner?

Re: The newest Instagram “exploit” is the goofiest I've seen

#103

Post by moritzwarhier »

Krasnol wrote: post #78
moritzwarhier wrote: post #48

Earlier quoted context omitted.

100% Urgency. Emotions. It's all there, and high-stakes environments with no proper protocol are most vulnerable. Source: used to work part-time in IT support at a hospital, by now 10+ years ago, so it was routinely requested to circumvent regulations and security protocols, even medical ones (cough Windows in ICU monitors and other medical "kiosk" PCs that should absolutely not run Windows)

I love those admin passwords which a tech will give you at some point because he doesn't want to do the work himself. If they even have passwords... Unfortunately Siemens woke up.

You mean

  admin
or

  Administrator
?

Horrific, people should be jailed for cyberattacks when they carelessly just give out this word.

The experiences I meant were mostly

- password reset requests (admittedly, we had a protocol even then to strictly require a "physical signature", normally meaning Fax or internal snail mail)

- medical protocols: don't wanna go into too much detail here, but:

1) Windows requires a lot of maintenance, often even hard restores, to function normally, even when sold as the UI for physical ICU monitors

2) Medical personell often is severely overworked, especially people in important, but not formally highly-qualified roles. And things like Surgery rooms and ICUs often have very slim time slots.

With the former, you should not enter into them without wearing appropriate clothing.

It doesn't prevent people working there from requesting you to finally come over and make that UEFI-Windows-Crapware-Kiosk-PC which was sold as a medical device boot... of course especially not when there is an ongoing surgery nearby. And of course, your higher-ups will be there to help you sort out these issues without violating protocols...

thankfully I didn't do careless things there and haven't witnessed IT-related disasters there. But still, I gave these examples for a reason :D

there was a healthy culture but some of the situations encountered in medical IT support should really require specialized, short-term training.

Keeping up rigorous hygiene protocols requires dedicated work by professionals, especially in a large hospital.

And the same argument can be made for account protection and user support for large software providers.

Re: The newest Instagram “exploit” is the goofiest I've seen

#104

Post by athrowaway3z »

dpark wrote: post #43
hbn wrote: post #21

It's insane the AI has been provided the tooling to send emails to arbitrary addresses like that. Like, getting it to send a 2FA code at a user's request is one thing. But it should only be able to "hit a button" to send a 2FA email to the address attached to the account, all run with hand-written code. It shouldn't have access to the 2FA code itself, or the message subject, or body, or the recipient address, etc. Wh…

This exploit has essentially nothing to do with AI and everything to do with a terribly designed account recovery flow. This exact same flow could have been (and may have been; I don’t know how much the chatbot here actually does) statically coded.

Drowning has essentially nothing to do with water and everything to do with a terribly designed ability to get air into your lungs.

If you'd do a retrospective and ignore how AI has shaped expectations and a company's culture to allow this to pass through into production, you'd be complicit/perpetuating what led to this debacle in the first place.

It's not the end of the world, and water isn't going anywhere, but saying AI has essentially nothing to do with it is just a bad take.

Re: The newest Instagram “exploit” is the goofiest I've seen

#105

Post by kennywinker »

nashashmi wrote: post #61
hbn wrote: post #21

It's insane the AI has been provided the tooling to send emails to arbitrary addresses like that. Like, getting it to send a 2FA code at a user's request is one thing. But it should only be able to "hit a button" to send a 2FA email to the address attached to the account, all run with hand-written code. It shouldn't have access to the 2FA code itself, or the message subject, or body, or the recipient address, etc. Wh…

Some Jr engineer got tired of handling stupid support requests and automated the job with an agent. That’s how. Assigning Jr engineers for security support is ridiculous partly because young people don’t understand how critical security is sometimes. And partly because they don’t value privacy as much.

Very generous of you to blame the screw up of one of the largest companies in the world on a jr engineer.

I’ve been a jr engineer at a large company. I had the power to implement absolutely jack shit on my own. I deeply doubt the security flow for account recovery in meta ai account security was a single jr engineer.

What i think is actually going on is basically a soft form of ai psychosis. Senior engineer gets ai to code ai account recovery feature, that same or a different engineer asks ai to review the feature, and then it gets pushed to prod. Move fast, break things. The ai coded it, the ai reviewed it - the people trusted the ai because it sounds confidently right.

Just like how the ai doesn’t know if you should walk or drive to the car wash, the ai doesn’t understand exploits like this one.

Re: The newest Instagram “exploit” is the goofiest I've seen

#106

Post by parable »

nashashmi wrote: post #61
hbn wrote: post #21

It's insane the AI has been provided the tooling to send emails to arbitrary addresses like that. Like, getting it to send a 2FA code at a user's request is one thing. But it should only be able to "hit a button" to send a 2FA email to the address attached to the account, all run with hand-written code. It shouldn't have access to the 2FA code itself, or the message subject, or body, or the recipient address, etc. Wh…

Some Jr engineer got tired of handling stupid support requests and automated the job with an agent. That’s how. Assigning Jr engineers for security support is ridiculous partly because young people don’t understand how critical security is sometimes. And partly because they don’t value privacy as much.

As a "young person" (under 30), my thoughts: There's a minority of us that do genuinely care, possibly more than most - so hiring someone from this minority would be helpful - but the vast majority of my peers don't care about privacy nor security. They often take this defeatist mindset of "my data is already out there, why should I care?", or prefer convenience over security. For example, "why should I switch to Signal if I have a public Instagram profile?" or "I can't remember all those passwords! I just use one for everything."

As for your comment about junior engineers, see kennywinker's reply to this thread - I share the same thoughts.

Re: The newest Instagram “exploit” is the goofiest I've seen

#109

Post by hangonhn »

zorrn wrote: post #12
hangonhn wrote: post #10

Earlier quoted context omitted.

More like "Prompt engineering" ?

Can we really name this "Prompt engineering"? The prompt is so simple this is hardly any work even less than this comment

Fair point but it's not social either. It's a new class of exploit that's based on tricking the AI.

Re: The newest Instagram “exploit” is the goofiest I've seen

#110

Post by mikey_p »

umarcyber wrote: post #59

I'm sitting here wondering why the Chief Master Sergeant of the U.S. Space Force has an Instagram account to begin with. I understand it's the office itself, but still don't see the reason to expand the attack surface of government offices. X makes sense, Instagram, I'm not so sure as much

Why does X make sense? It makes no sense at all to me. X is the least logical place to put it.
Post reply on HN