Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

this.weekinsecurity.com

Post reply on HN
Print view View original

241–250 of 287 posts

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#241

Post by trumpdong »

sebastiennight wrote: post #87
adamddev1 wrote: post #63

Earlier quoted context omitted.

There's an excellent little book in German called "KI und der Neue Faschismus" [1] (AI and the New Fascism) where the author (Rainer Mühlhoff) tries to warn about the dangers of decisions based on opaque statistical models (like LLMs) instead of a clear, human auditable decision process. [1]: https://rainermuehlhoff.de/KI-und-der-neue-Faschismus-Reclam...

Isn't there an EU law that allows any EU citizen the right to transparency and/or appeal as to automated decisions made about them?

Yes, but it doesn't actually happen. It's basically impossible for an individual to enforce their GDPR rights.

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#242

Post by RobotToaster »

embedding-shape wrote: post #39
vb-8448 wrote: post #30

Earlier quoted context omitted.

In italian we say "l'operazione è riuscita perfettamente, ma il paziente è morto" -> "the surgery was a complete success, but the patient died"

Both this and what Meta said reminds me of "Clarke and Dawe - The Front Fell Off" ( https://www.youtube.com/watch?v=3m5qxZm_JqM ) I also can't believe the people who were involved with writing this response from Meta, didn't realize how obviously bad it sounds. It's like there is no humans working and writing there anymore.

Very rigorous software engineering standards.

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#243

Post by lukan »

trumpdong wrote: post #239
jjmarr wrote: post #99

Earlier quoted context omitted.

I've always wanted to expose myself to unlimited legal liability by distributing open source software.

They did say a product. Is it a product if you're not selling it or even giving it away but you just made it available for download?

Depends on the jurisdiction I think. And if you take donations, the line gets blurry even faster.

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#244

Post by gaiagraphia »

simpaticoder wrote: post #131
johnyzee wrote: post #81

"Meta notified at least 20,225 people that their accounts had been compromised. [...] The compromises allowed the hackers to take over the person's entire Instagram and any linked accounts, including obtaining contact information, dates of birth, and profile information, as well as the ability to access the person's posts, direct messages, and account activity [...] the hacks began around April 17 and lasted until th…

No fan of Meta, but I think "staggering" is properly determined by the percent of users affected rather than the absolute number. It's staggering to an SMB with 100k customers; it's bad, but not "staggering" to an internet juggernaught with 3B MAU.

Why does scale absolve you of crime?

If you or me hacked 20,000 people and potentially fucked over their lives, what'd be the consequences?

Who's going to attach their name to this negligent act and do time?

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#245

Post by Schlagbohrer »

Cyan488 wrote: post #3

> "The tool itself worked properly and functioned as intended; however due to a bug in a separate code path, the system did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user’s Instagram account," said Meta in its breach notice. I'm not sure "worked properly" and "as intended" accurately describe this situation.

No no the tool worked fine, it was the system that failed. They blame society, basically.

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#246

Post by jeffbee »

OJFord wrote: post #222
chamomeal wrote: post #180

Earlier quoted context omitted.

I think the hack bypassed 2FA. If you can call “asking for account access” a hack lmao

It did not, TFA clearly says it worked for accounts with no 2FA, as GP said.

The hack doesn't have much to do with it. Meta account recovery flow has always allowed bypassing 2FA.

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#247

Post by onion2k »

Gigachad wrote: post #133
simpaticoder wrote: post #131

Earlier quoted context omitted.

No fan of Meta, but I think "staggering" is properly determined by the percent of users affected rather than the absolute number. It's staggering to an SMB with 100k customers; it's bad, but not "staggering" to an internet juggernaught with 3B MAU.

Twenty _thousand_ people had their personal data stolen, many of them relied on these accounts to run their business, many put at risk of hackers impersonating them. Meta in a fair world should be forced to financially compensate these people. They built a world where many people basically have to use their products for their jobs and then failed to look after the data because they wanted to replace customer support…

Twenty _thousand_ people had their personal data stolen, many of them relied on these accounts to run their business, many put at risk of hackers impersonating them.

It only worked for accounts that didn't have 2FA switched on. If your livelihood depends on your account and you're risking not turning on some pretty basic security features then you should accept partial responsibility.

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#248

Post by me-vs-cat »

simpaticoder wrote: post #142
Gigachad wrote: post #133

Earlier quoted context omitted.

Twenty _thousand_ people had their personal data stolen, many of them relied on these accounts to run their business, many put at risk of hackers impersonating them. Meta in a fair world should be forced to financially compensate these people. They built a world where many people basically have to use their products for their jobs and then failed to look after the data because they wanted to replace customer support…

Over forty _thousand_ people die every year in the US from car accidents. Plenty of other preventable injustices happen in all areas of life. I wonder how many fathers are unjustly taken away from their children by a corrupt family court system, how many people die of treatable diseases denied treatment by insurance companies, how many kids lose interest in school because of bad teachers, how many customer service wo…

> Over forty thousand people die every year in the US from car accidents.

If a single company was solely responsible for car accidents causing that many deaths in as short a time as this, the consequences would be severe.

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#249

Post by ShinyLeftPad »

ShinyLeftPad wrote: post #212
Gigachad wrote: post #133

Earlier quoted context omitted.

Twenty _thousand_ people had their personal data stolen, many of them relied on these accounts to run their business, many put at risk of hackers impersonating them. Meta in a fair world should be forced to financially compensate these people. They built a world where many people basically have to use their products for their jobs and then failed to look after the data because they wanted to replace customer support…

It's not staggering. I fully expect thousands of people to lose their IG accounts per day to other hacks before this bug. That's like 0.000001 percent of active users. It's a big platform with many people. But totally Meta should pay. There's not many people to pay. They should sue.

Here are some sources that show the amount of hacked accounts, daily, before this bug is thousands or even tens of thousands. Apparently 30%+ of all social media account takeovers happen on instagram and it's not even the largest platform.

I didn't verify the sources, just searched how many.

https://www.hackingloops.com/social-media-hacking-statistics...

https://www.zerofox.com/blog/often-social-media-accounts-hac...

Downvotes are welcome to share their sources

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#250

Post by hilariously »

onion2k wrote: post #247
Gigachad wrote: post #133

Earlier quoted context omitted.

Twenty _thousand_ people had their personal data stolen, many of them relied on these accounts to run their business, many put at risk of hackers impersonating them. Meta in a fair world should be forced to financially compensate these people. They built a world where many people basically have to use their products for their jobs and then failed to look after the data because they wanted to replace customer support…

Twenty _thousand_ people had their personal data stolen, many of them relied on these accounts to run their business, many put at risk of hackers impersonating them. It only worked for accounts that didn't have 2FA switched on. If your livelihood depends on your account and you're risking not turning on some pretty basic security features then you should accept partial responsibility.

Did they partially hack their accounts? No, why would you be saying its partially the victim's fault when the billion dollar corporation doesn't secure their shit?
Post reply on HN