Deprecated: Array and string offset access syntax with curly braces is deprecated in /home/mediadev/public_html/blog/admin/kernel/helpers/text.class.php on line 171

Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; DB_POSTS has a deprecated constructor in /home/mediadev/public_html/blog/admin/kernel/db/db_posts.class.php on line 12

Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; DB_PAGES has a deprecated constructor in /home/mediadev/public_html/blog/admin/kernel/db/db_pages.class.php on line 12

Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; DB_TAGS has a deprecated constructor in /home/mediadev/public_html/blog/admin/kernel/db/db_tags.class.php on line 12

Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; DB_CATEGORIES has a deprecated constructor in /home/mediadev/public_html/blog/admin/kernel/db/db_categories.class.php on line 12

Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; DB_SETTINGS has a deprecated constructor in /home/mediadev/public_html/blog/admin/kernel/db/db_settings.class.php on line 12

Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; DB_COMMENTS has a deprecated constructor in /home/mediadev/public_html/blog/admin/kernel/db/db_comments.class.php on line 12

Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; DB_NOTIFICATIONS has a deprecated constructor in /home/mediadev/public_html/blog/admin/kernel/db/db_notifications.class.php on line 12

Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; DB_USERS has a deprecated constructor in /home/mediadev/public_html/blog/admin/kernel/db/db_users.class.php on line 12

Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; Login has a deprecated constructor in /home/mediadev/public_html/blog/admin/kernel/api/login.class.php on line 12

Deprecated: Function get_magic_quotes_runtime() is deprecated in /home/mediadev/public_html/blog/admin/boot/rules/4-remove_magic.bit on line 18

Deprecated: Function get_magic_quotes_gpc() is deprecated in /home/mediadev/public_html/blog/admin/boot/rules/4-remove_magic.bit on line 23
Media Developments - Merging crisp design, powerful communication and ease of use hosting - cutting edge green hosting solutions - Instagram Account Takeover Vulnerability Earns Hacker $30,000

Media Developments

Instagram Account Takeover Vulnerability Earns Hacker $30,000

16 July, 2019 | Security Notices

A researcher claims to have received $30,000 from Facebook after discovering a critical vulnerability that could have been exploited to easily hack Instagram accounts.

India-based bug bounty hunter Laxman Muthiyah discovered the security hole while analyzing Instagram’s password recovery system for mobile devices.

When users want to change their Instagram password, a six-digit code is sent to their mobile phone and they have to enter that code within 10 minutes to be able to change the password. Instagram developers had implemented a rate-limiting mechanism to prevent attackers from brute-forcing the six-digit code, but Muthiyah identified a way to bypass it.

The researcher noticed that if he sent 1,000 requests containing possible verification codes, 250 of them would go through while the rest would be blocked. He then used what he described as a combination of a race condition and IP rotation to send out a total of 200,000 requests.

He achieved this by using 1,000 different IPs and he said an attacker would have needed 5,000 IPs to hack into any Instagram account.

“It sounds big but that’s actually easy if you use a cloud service provider like Amazon or Google. It would cost around 150 dollars to perform the complete attack of one million codes,” Muthiyah explained.

The white hat hacker reported his findings to Facebook -- Facebook owns Instagram -- which informed him on July 10 that a bounty of $30,000 would be awarded for the vulnerability report.

This is not the first time Muthiyah has earned a significant bounty from Facebook. In the past, he discovered serious flaws that could have been exploited to delete videos and modify and delete copyright rules, access private photos, and delete a user’s photos.

By Eduard Kovacs on July 15, 2019