Hackers Used Meta's AI Support Bot to Seize Instagram Accounts
krebsonsecurity.com
Hackers Used Meta's AI Support Bot to Seize Instagram Accounts
1–10 of 22 posts
Re: Hackers Used Meta's AI Support Bot to Seize Instagram Accounts
#2This simultaneously seems like: 1) such an obvious attack vector that it is extreme negligence to not have had planned for appropriate security protections against this, and 2) the most obvious outcome for Meta to be this security lax and stupid. If it doesn't hurt their ad sales, it doesn't matter to Meta.
Re: Hackers Used Meta's AI Support Bot to Seize Instagram Accounts
#3Instagram auth flow is still hosed as I write this. If I try to sign on via web to my account, which was "recovered" yesterday at least 8 times by me and by hackers, I get the most obnoxious recaptcha treatment I've ever seen with 4-6 different pages of "click the motorcycle" where all 16 squares contain motorcycles, and after I deal with that for several minutes it still just hangs on "we will now redirect you".
Re: Hackers Used Meta's AI Support Bot to Seize Instagram Accounts
#4"Hackers"? No. There's no hacking involved. It's literally just politely asking the bot to send you the login link.
Re: Hackers Used Meta's AI Support Bot to Seize Instagram Accounts
#5"Hackers"? No. There's no hacking involved. It's literally just politely asking the bot to send you the login link.
most "hacking" is just politely trying to login with user: root password: password
Re: Hackers Used Meta's AI Support Bot to Seize Instagram Accounts
#6Already on the front page:
The newest Instagram “exploit” is the goofiest I've seen
https://news.ycombinator.com/item?id=48359102 - 180 comments
Re: Hackers Used Meta's AI Support Bot to Seize Instagram Accounts
#7It might be Zuck who was just exploring his own platforms to see if they all can be destroyed like Metaverse or not
Re: Hackers Used Meta's AI Support Bot to Seize Instagram Accounts
#8Re: Hackers Used Meta's AI Support Bot to Seize Instagram Accounts
#9"Hackers"? No. There's no hacking involved. It's literally just politely asking the bot to send you the login link.
Social engineering is hacking.
Re: Hackers Used Meta's AI Support Bot to Seize Instagram Accounts
#10Have you seen Meta or Instagram AI code? It is horrible. No one understands the whole PyTorch any more.
This is probably a vibe coded feature by someone who had to meet his minimum token quotas.
Or some genius who implemented a "sandbox" and thought that this time, this sandbox will work unlike all other sandboxes in history.
Instagram is of course even worse, since even the Python core developers there use all sorts of hacks. It is not clear if Python is involved in the login system though, but the culture is awful.