Reverse-engineering Instagram to access the private API
definedcodehosting.com
Reverse-engineering Instagram to access the private API
1–10 of 16 posts
Re: Reverse-engineering Instagram to access the private API
#2Note that Instagram doesn't encrypt requests to their private API, they're only signing them. In fact the parameter is called 'signed_body', not 'encrypted_body'.
Anyway interesting post.
Re: Reverse-engineering Instagram to access the private API
#3Interesting write up. Seems rather simple, really. Presumably Instagram could change their private key and rollout a new client version on each platform, breaking all third party apps using the current key though. Although I guess it'd be just as easy to get it again.
Re: Reverse-engineering Instagram to access the private API
#4Interesting write up. Seems rather simple, really. Presumably Instagram could change their private key and rollout a new client version on each platform, breaking all third party apps using the current key though. Although I guess it'd be just as easy to get it again.
Well if you have the private key on the device you can always pull it out, so really they should have used public key encryption if they didn't want people to forge the signatures.
Re: Reverse-engineering Instagram to access the private API
#5Note that Instagram doesn't encrypt requests to their private API, they're only signing them. In fact the parameter is called 'signed_body', not 'encrypted_body'. Anyway interesting post.
The traffic is encrypted over SSL (HTTPS), so there's no need for double-encryption, since presumably the app can trust the DNS and certificate chains on the device. If I were a paranoid Instagram developer, though, I could even use a custom certificate chain that only trusted certificates on my server, so there's no point to doing the encryption in the app.
Re: Reverse-engineering Instagram to access the private API
#6Interesting write up. Seems rather simple, really. Presumably Instagram could change their private key and rollout a new client version on each platform, breaking all third party apps using the current key though. Although I guess it'd be just as easy to get it again.
Well if you have the private key on the device you can always pull it out, so really they should have used public key encryption if they didn't want people to forge the signatures.
Public key encryption to sign involves encrypting using my own private key. Which would be on the phone, and so any end user could pull it from the device.
Re: Reverse-engineering Instagram to access the private API
#7Is it still the case that the app only uses HTTPS to create a session and plain HTTP for everything else? I remember that was the case about a year ago after using mitmproxy to sniff traffic, although I don't recall HMAC being used to sign requests then. Anyway, I wondered then why nobody had used firesheep to devastating effect, e.g. a bot sitting on an open wifi and posting NSFW images to any account on the network.
Re: Reverse-engineering Instagram to access the private API
#8Earlier quoted context omitted.
Well if you have the private key on the device you can always pull it out, so really they should have used public key encryption if they didn't want people to forge the signatures.
Public key encryption to sign involves encrypting using my own private key. Which would be on the phone, and so any end user could pull it from the device.
So what can you do ? You can't fight the private key retrieval right ?
Re: Reverse-engineering Instagram to access the private API
#9Earlier quoted context omitted.
Public key encryption to sign involves encrypting using my own private key. Which would be on the phone, and so any end user could pull it from the device.
So what can you do ? You can't fight the private key retrieval right ?
Well, you can lock down the device so that the end user doesn't own it, doesn't have root, and can't inspect your binary/data outside of your exposed interface. Which is exactly what iPhones and many Android vendors attempt to do.
Re: Reverse-engineering Instagram to access the private API
#10Isn't the fact that they are using a simple HMAC-SHA256 hash also a root of the problem?
If instead of using the POST data only to create the hash they added another information, like a the hour of the day. Wouldn't it be way harder for a hacker to actually understand what went into signing the request?