How I Could Have Hacked Any Instagram Account

#1

Post by Garbage » Thu, Jul 18, 2019, 12:17 PM UTC

How I Could Have Hacked Any Instagram Account
thezerohack.com

Re: How I Could Have Hacked Any Instagram Account

#2

Post by hmate9 » Thu, Jul 18, 2019, 2:02 PM UTC

This is probably applicable to a lot of other services.

I always find it weird that if I accidentally enter the wrong code, I get to try again instead of being sent a new one.

Re: How I Could Have Hacked Any Instagram Account

#3

Post by np_tedious » Thu, Jul 18, 2019, 2:05 PM UTC

hmate9 wrote: post #2

This is probably applicable to a lot of other services. I always find it weird that if I accidentally enter the wrong code, I get to try again instead of being sent a new one.

Fat fingers happen, so I could see allowing maybe 3 attempts from a usability and convenience standpoint.

Beyond that, definitely should regenerate / resend. This is to confirm you own that phone number. It's not hard to get another

Re: How I Could Have Hacked Any Instagram Account

#4

Post by deanclatworthy » Thu, Jul 18, 2019, 2:08 PM UTC

Pretty interesting that distributed circumvention of rate limiting has to be considered its own class of vulnerability nowadays. I would think (of course) many other services are vulnerable. Rate limiting is hard.

Re: How I Could Have Hacked Any Instagram Account

#5

Post by penagwin » Thu, Jul 18, 2019, 2:12 PM UTC

np_tedious wrote: post #3

hmate9 wrote: post #2

This is probably applicable to a lot of other services. I always find it weird that if I accidentally enter the wrong code, I get to try again instead of being sent a new one.

Fat fingers happen, so I could see allowing maybe 3 attempts from a usability and convenience standpoint. Beyond that, definitely should regenerate / resend. This is to confirm you own that phone number. It's not hard to get another

Yeah for sure, a few attempts isn't a problem IMO, even only say 6 digits there's too many permutations.

> I have used 1000 different machines (to achieve concurrency easily) and IPs to send 200k requests (that’s 20 percent of total one million probability) in my tests.

I'm just surprised nobody looked at a dashboard and said "huh this account is getting 200k requests", surely that should be raising red flags?

Re: How I Could Have Hacked Any Instagram Account

#6

Post by kristiandupont » Thu, Jul 18, 2019, 2:21 PM UTC

penagwin wrote: post #5

np_tedious wrote: post #3

Earlier quoted context omitted.

Fat fingers happen, so I could see allowing maybe 3 attempts from a usability and convenience standpoint. Beyond that, definitely should regenerate / resend. This is to confirm you own that phone number. It's not hard to get another

Yeah for sure, a few attempts isn't a problem IMO, even only say 6 digits there's too many permutations. > I have used 1000 different machines (to achieve concurrency easily) and IPs to send 200k requests (that’s 20 percent of total one million probability) in my tests. I'm just surprised nobody looked at a dashboard and said "huh this account is getting 200k requests", surely that should be raising red flags?

How many requests does IG handle per second? I am not even going to guess a number but I am sure 1000 specific requests would drown in that. So you would need a dashboard that specifically visualizes this kind of thing. Do that and you are now protecting yourself in one type of scenario. But there are endless other scenarios that you still wouldn't see.

Re: How I Could Have Hacked Any Instagram Account

#7

Post by fortran77 » Thu, Jul 18, 2019, 2:23 PM UTC

That's some hole! Imagine if this were used to get access to a celebrity's IG account. A lot of "damage" to a celebrity brand could have been done.

Re: How I Could Have Hacked Any Instagram Account

#8

Post by eitland » Thu, Jul 18, 2019, 2:30 PM UTC

Now this left me wondering how hard it would be to guess the bugcrowd url at the bottomof the last picture.

Re: How I Could Have Hacked Any Instagram Account

#9

Post by degenerate » Thu, Jul 18, 2019, 2:30 PM UTC

I spot-checked some of those IPs in the video, and it appears all of them are on Amazon. So, what does the attacker's stack look like? Is it a bunch of servers running PHP and listening for a connection to run curl? Or Lambda functions configured to proxy the connection attempt to IG? Curious how much effort goes into setting up an attack like this. It's surprising (to me) that so many IPs can be used for so little money.

Re: How I Could Have Hacked Any Instagram Account

#10

Post by rdtwo » Thu, Jul 18, 2019, 2:33 PM UTC

fortran77 wrote: post #7

That's some hole! Imagine if this were used to get access to a celebrity's IG account. A lot of "damage" to a celebrity brand could have been done.

Lol log in to a celebrity account, announce support for Donald trump. Enjoy the ensuing dumpster fire