The real vulnerability is that Amazon makes it very cheap to make a botnet almost instantly
How I Could Have Hacked Any Instagram Account
71–80 of 138 posts
Re: How I Could Have Hacked Any Instagram Account
#72"WE have decided to reward you $30,000" should be "Because the market has decided that hacking top tier instagram accounts is worth a low seven figures, here is your $1,000,000 payout to save you the time, effort and liability of monetizing this yourself"
it would not be that profitable anyway after factoring server costs. say you hack into one celeb account. Instagram would immediately recognize the problem and fix it. but until they fix it, maybe you could make a few hundred dollars promoting some crpyto thing. Who knows. .s Instagram does not allow live links and suppresses posts that look like ads, so instead of being seen by millions of followers is only seen by…
thats not how the instagram economy works.
accounts are basically worth an additional $100 for every 5,000 followers, multiplied by engagement percent. ie. 1% engagement account with 5,000 followers would be worth around $100, 2% with 5,000 followers worth around $200. forget accounts with high heat (A and B-list celebrities), people flip meme and inspirational accounts ALL DAY. (this a simplistic scale from how I've seen the opening bids be set, and the negotiations I've had).
when when you aren't flipping and suddenly rebranding accounts, you get ROI by doing promos which have a fairly fixed cost. $10 to post about someone else or tag them in a story. the better your account is, the more you can charge and the less time you have to show someone. with stories you can stack promos all day and break even on an account in a week.
you get ROI to break even very quick.
(a hacker or phish may try other things like scamming D-list model's thirsty followers in Direct Messages.)
> maybe you could make a few hundred dollars promoting some crpyto thing
false. you'll get 2% of the entire currency pre-mined and minted straight to you, 3% of the funds raised, and upfront fees in the low five figures.
and if the crypto is post-launch, you'll get upfront fees, a lot less tokens, and then the hundreds of thousands you'll make pumping it if people bite. otherwise, you have to buy yourself and hope you can pump it, and if you are poor thats the only way you'll wind up with "just a few hundred dollars promoting some crypto thing"
yeah leave this to the pros and imagine people are still just buying fake followers or something relevant half a decade ago.
honestly, I feel like Facebook should be acting as an escrow agent and taking a cut of the promos and account sales. Would be safer for participants and lucrative for FB.
Re: How I Could Have Hacked Any Instagram Account
#73Earlier quoted context omitted.
I'm curious too, how would he set up so many machines that do the same thing?
It's very easy to terraform 1000 nano machines on ec2, as he said it wouldn't be expensive at all. In fact, he estimates $150, but for 1000 nano machines for 10 minutes i believe it's under a dollar. Possibly nano machines aren't powerful enough to spam the verify endpoint enough
Wouldn't you be hitting EC2 limits pretty quickly though? I guess you could get them raised, but last time AWS wanted a valid reason.
Re: How I Could Have Hacked Any Instagram Account
#74"WE have decided to reward you $30,000" should be "Because the market has decided that hacking top tier instagram accounts is worth a low seven figures, here is your $1,000,000 payout to save you the time, effort and liability of monetizing this yourself"
it would not be that profitable anyway after factoring server costs. say you hack into one celeb account. Instagram would immediately recognize the problem and fix it. but until they fix it, maybe you could make a few hundred dollars promoting some crpyto thing. Who knows. .s Instagram does not allow live links and suppresses posts that look like ads, so instead of being seen by millions of followers is only seen by…
except there'd be a ton of clickbait articles like "Kim K's insta hacked! See what the hackers posted" and they'd get free publicity
Re: How I Could Have Hacked Any Instagram Account
#75Is this reset mechanism conceptually flawed? Even with one attempt before invalidating the code, you have a 1:999,999 shot of stealing someone's account by lotto. Not bad odds for an automated process. It's like every account on Instagram has an alternative six digit password.
You are right. Betting everything on a 6 digit code surely is a mistake. For example, try same code on a million different account, and you definitely get access to atleast 1 of them. (Considering they are using a good random generator)
You probably get access to at least one of them, not definitely
Re: How I Could Have Hacked Any Instagram Account
#76Earlier quoted context omitted.
He didn't really explain it, but I think what was going on is the rate limiting is done per account, and the race condition was a way to circumvent that. He has to make all the requests very quickly because the first thing all the requests are doing is determining if new requests for this account should be ignored. All the requests are received around the same time, they all make this check and decide they are valid…
I think you are dead on, yeah it’s the quick rate of large numbers of requests that avoid the per-account rate limiting. Curious how they resolved this— run all authentication requests for a given user serially and in a consolidated fashion at some point. Exclusive lock the relevant db record before checking the code and recording the failure?
Could start by incrementing the value, then checking if it's below the threshold, similar to an atomic fetch_add operation. PostgreSQL has RETURNING clauses, SQL Server has OUTPUT clauses, etc...
Re: How I Could Have Hacked Any Instagram Account
#77Earlier quoted context omitted.
I have turned off phone 2FA on all services that permit me to do so after getting hacked by someone using that exploit. Typically I use Google 2FA via Authy or Authy itself
I've been considering getting a second, secret SIM card exclusively for use with services where SMS 2FA is the only option.
I've been using Google Voice for that purpose for years, and it has been perfect. The phone number that is for 2FA only, shouldn't be as easy to social engineer your typical telcom, since it is all controlled from within my Google account, and I get immediate security notifications if something fishy is up.
Re: How I Could Have Hacked Any Instagram Account
#78Earlier quoted context omitted.
You are right. Betting everything on a 6 digit code surely is a mistake. For example, try same code on a million different account, and you definitely get access to atleast 1 of them. (Considering they are using a good random generator)
You probably get access to at least one of them, not definitely
There is a 36.7%(or ~1/e) chance that you don't get any of them.
Re: How I Could Have Hacked Any Instagram Account
#79"WE have decided to reward you $30,000" should be "Because the market has decided that hacking top tier instagram accounts is worth a low seven figures, here is your $1,000,000 payout to save you the time, effort and liability of monetizing this yourself"
I don't see any evidence that the market has given a 5-figure value, let alone a 7 figure value, to temporary access to an Instagram account.
Re: How I Could Have Hacked Any Instagram Account
#80Earlier quoted context omitted.
How many requests does IG handle per second? I am not even going to guess a number but I am sure 1000 specific requests would drown in that. So you would need a dashboard that specifically visualizes this kind of thing. Do that and you are now protecting yourself in one type of scenario. But there are endless other scenarios that you still wouldn't see.
Authentication is certainly a scenario I think you'd want to monitor for brute force attacks? Sure IG gets 1000's+ requests a second, but they shouldn't be getting 1000's+ requests per second per user - especially on a login route. I monitor 400 requests on our website - A massive spike in those would warrant investigation.
I'm sure IG gets several orders of magnitude more than 1000s of requests per second. Even if a dashboard existed visualizing excess request traffic per route per user, when you're talking about this kind of request volume, there is an indexing lag + a reporting lag + alerting lag (assuming there is alerting on this specific scenario on top of the dashboard) + human or automated response lag. It sounds like this attack could be completed in minutes rather than hours or days, it's feasible that it would have succeeded well before anyone got around to mitigating it.