Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The newest Instagram “exploit” is the goofiest I've seen

0xsid.com

Post reply on HN
Print view View original

491–500 of 528 posts

Re: The newest Instagram “exploit” is the goofiest I've seen

#491

Post by lo_fye »

s_dev wrote: post #482
lo_fye wrote: post #471

HELP? I woke up to a bunch of notifications on my phone from the past 30-60 mins, indicating that people in in Montreal, Argentina, and Kathmandu had attempted to login to my account, and at least one had succeeded. I'm nowhere near any of those locations, and I didn't get any 2FA messages. I tapped Instagram, and it asked me for a new password, so I set one, and it just hung and did nothing. My Instagram, Facebook,…

First off, this is shit position for you to be in. I perused your comment history as I often do with HNers. Some guy was predicting this exact situation in 2009 and your comment was that this would all sort itself out due to market forces. The market forces have spoken and the market lacks empathy. Hope you get your account back and then when you do you hop on to the the other side of the fence. We can all stand to l…

I'm in Canada where we can't even see or share news on Facebook

Re: The newest Instagram “exploit” is the goofiest I've seen

#492

Post by lo_fye »

lo_fye wrote: post #471

HELP? I woke up to a bunch of notifications on my phone from the past 30-60 mins, indicating that people in in Montreal, Argentina, and Kathmandu had attempted to login to my account, and at least one had succeeded. I'm nowhere near any of those locations, and I didn't get any 2FA messages. I tapped Instagram, and it asked me for a new password, so I set one, and it just hung and did nothing. My Instagram, Facebook,…

UPDATE!

At around 12:20pm, after hours of trying anything I could, the Desktop version of Facebook Web's Meta AI Support asked me to upload a video selfie. Then it asked me when the issue began, and as soon as I said around 7am this morning, their AI was like "Ah ha!" -- It asked me for my alternate email address, which I provided, and as soon as I clicked a link in that email, I started getting email about Pages being republished, access to Marketplace being restored, etc.

Now: Can I even prevent this from happening in future? How can I make sure everyone has my blog url (or phone number) so they can contact me even if I lose contact with them?

Thank you for your support and concern, despite however dumb my comments in 2009 were. LOL.

Re: The newest Instagram “exploit” is the goofiest I've seen

#494

Post by jcgrillo »

meszmate wrote: post #391

Who looked at password resets and went “yeah, let the chatbot handle that one”

Surely at least dozens of engineers knew about this vulnerability and were either told to shut up about it under pain of negative performance review or stayed quiet because they knew if they spoke up about it they'd be retaliated against. There's no possible way nobody saw this coming.

Re: The newest Instagram “exploit” is the goofiest I've seen

#495

Post by ThinkingGuy »

imzadi wrote: post #486
dec0dedab0de wrote: post #481

I think login.gov needs to offer a way for others to use them. They have a pretty good system where you can bring your identification to the post office to get verified. Though I'm sure there are loopholes in the other options, but physically going to a federally owned building with cameras and providing ID has got to be one of the more secure ways to handle it.

Turn over access to all your personal accounts to the US government? Sure. What could possibly go wrong.

If they really want them, they can get them, one way or another.

Re: The newest Instagram “exploit” is the goofiest I've seen

#496

Post by xk3 »

lo_fye wrote: post #492
lo_fye wrote: post #471

HELP? I woke up to a bunch of notifications on my phone from the past 30-60 mins, indicating that people in in Montreal, Argentina, and Kathmandu had attempted to login to my account, and at least one had succeeded. I'm nowhere near any of those locations, and I didn't get any 2FA messages. I tapped Instagram, and it asked me for a new password, so I set one, and it just hung and did nothing. My Instagram, Facebook,…

UPDATE! At around 12:20pm, after hours of trying anything I could, the Desktop version of Facebook Web's Meta AI Support asked me to upload a video selfie. Then it asked me when the issue began, and as soon as I said around 7am this morning, their AI was like "Ah ha!" -- It asked me for my alternate email address, which I provided, and as soon as I clicked a link in that email, I started getting email about Pages bei…

So the solution was to do the same thing that the hackers did??

> "tell the Meta support AI that the account is hacked and ask it to send the verification codes to an arbitrary email address they control"

I agree it seems like they could later use the same flow to get access again but maybe Meta has blocked some location spoofing now

Re: The newest Instagram “exploit” is the goofiest I've seen

#497

Post by p-t »

lo_fye wrote: post #471

HELP? I woke up to a bunch of notifications on my phone from the past 30-60 mins, indicating that people in in Montreal, Argentina, and Kathmandu had attempted to login to my account, and at least one had succeeded. I'm nowhere near any of those locations, and I didn't get any 2FA messages. I tapped Instagram, and it asked me for a new password, so I set one, and it just hung and did nothing. My Instagram, Facebook,…

no idea about your account but i would suggest getting email + other accounts for all of your acquaintances asap lmao

Re: The newest Instagram “exploit” is the goofiest I've seen

#498

Post by brianmcnulty »

xk3 wrote: post #496
lo_fye wrote: post #492

Earlier quoted context omitted.

UPDATE! At around 12:20pm, after hours of trying anything I could, the Desktop version of Facebook Web's Meta AI Support asked me to upload a video selfie. Then it asked me when the issue began, and as soon as I said around 7am this morning, their AI was like "Ah ha!" -- It asked me for my alternate email address, which I provided, and as soon as I clicked a link in that email, I started getting email about Pages bei…

So the solution was to do the same thing that the hackers did?? > "tell the Meta support AI that the account is hacked and ask it to send the verification codes to an arbitrary email address they control" I agree it seems like they could later use the same flow to get access again but maybe Meta has blocked some location spoofing now

Not exactly, I think part of the tools it has access to allows it to perform an "investigation" into recent malicious activity and account changes that may have occurred that were likely unauthorized (such as changing from an email used for a long period of time to a new one). I think this AI-version of this check was originally broken and just allowed any email but has now been fixed to only be emails that look like they were attached to the account, which is what the poster used to obtain access back into their account.

Re: The newest Instagram “exploit” is the goofiest I've seen

#499

Post by mike_hock »

SoftTalker wrote: post #161
giancarlostoro wrote: post #147

Earlier quoted context omitted.

The fact that if your account has had the SAME EMAIL AND NUMBER FOR 14 YEARS OR MORE and support still thinks you got hacked is more embarrassing to me.

I used my work email for everything for 14 years, now I'm retired/fired/laid off and I can't access it anymore and I forgot to change the email linked in my Facebook account.

> I used my work email for everything

Then you had it coming.

Re: The newest Instagram “exploit” is the goofiest I've seen

#500

Post by limagnolia »

lo_fye wrote: post #471

HELP? I woke up to a bunch of notifications on my phone from the past 30-60 mins, indicating that people in in Montreal, Argentina, and Kathmandu had attempted to login to my account, and at least one had succeeded. I'm nowhere near any of those locations, and I didn't get any 2FA messages. I tapped Instagram, and it asked me for a new password, so I set one, and it just hung and did nothing. My Instagram, Facebook,…

Your recourse for Meta bricking your hardware is Small Claims Court, in the US anyway... other countries may have something similar.
Post reply on HN