How I Could Have Hacked Any Instagram Account

[GhostVII]

Using a phone number for password reset seems like a terrible idea in general, especially if you have SMS-based 2FA. Phone numbers are way to easy to social engineer, and if your second factor can reset your first one, you don't have 2FA.

Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange. Why wouldn't Instagram just allow a fixed number of tries (some low limit, like 25) from any IP before invalidating the code? I don't really see a scenario where it makes sense to have per-IP rate limiting here. I guess they are probably just using the rate limiting features which are built in to whatever framework Instagram is using for their API.

[CPLX]

> Also if I am reading it correctly, it sounds like the rate limiting was being done per-IP, which sounds strange.

Seems to me that the main mistake was not rate limiting per account right? If you get 200k password requests for a single user something is severely wrong.

Or maybe they did and it didn't work, he makes reference to a race condition in the original post but doesn't elaborate.

[rwmj]

Also for people who don't have mobile phone signal at home (hello us), it's almost impossible to use these 2FA systems. There are a few systems including the UK government's own "Verify" scheme for submitting tax returns that I quite literally cannot use.

Not that mobile phone 2FA is actually secure. Fraudsters in the UK have discovered that it's possible to take over phone numbers rather easily because that relies on the phone companies' own systems which are (predictably) insecure.

[dahfizz]

> Why wouldn't Instagram just allow a fixed number of tries (some low limit, like 25) from any IP before invalidating the code?

This could makes it very easy to perform a DOS attack against a user. You could constantly send failed attempts and make it impossible for the user to type in the real code before you invalidate it.

[pmarreck]

I have turned off phone 2FA on all services that permit me to do so after getting hacked by someone using that exploit. Typically I use Google 2FA via Authy or Authy itself

[ridaj]

I used to work at a cell phone company. One day I needed to change my SIM card so I call up the help desk :

"Hi I have a new SIM card, can you please activate it?

— Sure what's your number and IMSI?

— My number is ..., the IMSI is ...

— OK done"

And so, just like that, I took over someone else's phone number. Not on purpose, but the guy made a mistake punching in my number, didn't verify my identity, and ended up assigning someone else's phone number to my SIM card. I called the guy back after realizing that I wasn't getting calls and that the people I called thought I now had a new number.

Granted it was a while ago but the experience gave me a very low opinion of SMS for 2FA.

[mncolinlee]

The first type of attack that should come to mind with SMS-based 2FA is SIM cloning. Identity question answers can be purchased off the dark web from previous leaks. Also, social engineering is notoriously effective against several of the top carriers, who lack effective identity validation. Lives have been ruined.

[someexgamedev]

Is this reset mechanism conceptually flawed? Even with one attempt before invalidating the code, you have a 1:999,999 shot of stealing someone's account by lotto. Not bad odds for an automated process.

It's like every account on Instagram has an alternative six digit password.

[mkagenius]

You are right. Betting everything on a 6 digit code surely is a mistake. For example, try same code on a million different account, and you definitely get access to atleast 1 of them. (Considering they are using a good random generator)

[floatingatoll]

Sony was using 8 characters of alphanumeric at one point. They reduced it to 6 digits. It turns out that the chance of guessing six digits successfully given one or two tries only is low enough to satisfy human beings when it comes to “annoyance versus protection”, especially when codes expire after a couple attempts.

[thefreeman]

a 6 digit password that is only valid for 10 minutes

[degenerate]

I spot-checked some of those IPs in the video, and it appears all of them are on Amazon. So, what does the attacker's stack look like? Is it a bunch of servers running PHP and listening for a connection to run curl? Or Lambda functions configured to proxy the connection attempt to IG? Curious how much effort goes into setting up an attack like this. It's surprising (to me) that so many IPs can be used for so little money.

[ikeboy]

I've done scraping distributed over many IPs. I used luminati, bought X IPs, ran a bash script to download all IPs to a file, read the file in from python and spit out a new thread for each IP. Just used as a proxy, all activity was controlled by a single server.

Re Amazon, I've done that too and the way it works is you start up an EC2 instance that does the work and sends back info. In my case I sent the info to an S3 bucket and then pulled all the info from that bucket elsewhere once all the machines finished. Ultimately you pay for what you use, and if you only use an hour across a ton of machines and use the cheapest machine it's pretty cheap.

FYI: luminati will give you unlimited bandwidth for like $1/IP/month.

[hmate9]

This is probably applicable to a lot of other services.

I always find it weird that if I accidentally enter the wrong code, I get to try again instead of being sent a new one.

[np_tedious]

Fat fingers happen, so I could see allowing maybe 3 attempts from a usability and convenience standpoint.

Beyond that, definitely should regenerate / resend. This is to confirm you own that phone number. It's not hard to get another

[filleokus]

I quite recently learnt about “Residential proxies”, for a scraping idea I had. Seems like that can be useful for attacks like this.

It’s surprisingly cheap to get access to services which fan out your requests over millions of normal residential IPs, making them (I assume) hard to block.

Of course their use can be highly objectionable, as well as how they got the proxies installed in homes of people in the first place (semi-malware?)

E.g https://oxylabs.io/pricing/residential-proxy-pool

[CPLX]

This page was amusing to me: https://oxylabs.io/solutions/ad-verification

This is a euphemism right? Like what they're really saying is that this service would make it possible to fake ad traffic right?

[sbarre]

This has to be provided by a botnet or some other malware, right?

They claim 30M residential IP addresses.. How would this be done otherwise?

There's no info on the site about "signing up" to be a proxy, just about using them..

[deanclatworthy]

Pretty interesting that distributed circumvention of rate limiting has to be considered its own class of vulnerability nowadays. I would think (of course) many other services are vulnerable. Rate limiting is hard.

[tuna-piano]

Could someone explain how this person is allowed to do that type of testing (sending 200,000 requests)? How would Facebook know he is a white hat and not a black hat?

I would be interested in starting to try some of these programs, but a bit scared I'd be doing something illegal... Where is the line?

[btown]

The actual "bug" is that Facebook did not have sufficient controls in place to even detect this type of brute-force attack, much less make it impossible to attempt in the first place. Facebook seems (IN THIS INSTANCE) to have appreciated the white-hat nature of this and awarded the bug bounty, but it very well might not have. And certainly other organizations don't take nearly as friendly stances. Generally, I wouldn't bet on most organizations seeing brute-force attacks as in-scope for bug bounties - this is by no means legal advice though.

[stibba]

If you want to test a company look at their 'Responsible disclosure'. For example: https://www.facebook.com/whitehat

[jakecraige]

They have a bug bounty program that gives you permission to do certain kinds of things and it not be illegal since you’re planning to report anything you find (and get paid for it)

[Swaglord333]

I feel like this was worth more than 30k

[ryanlol]

To people selling IG accounts, yes. Not to facebook.

[paulpauper]

The real vulnerability is that Amazon makes it very cheap to make a botnet almost instantly

[dane-pgp]

So what pricing changes would you recommend Amazon adopt to make this sort of whitehat security research prohibitively expensive?

[georgiecasey]

which most webservices have flagged as dodgy IPs. surprised instagram don;t

[_57jb]

So a bit of a strongly worded title. I'm going to nitpick for a second.

First you need the device-id, second you need the code that will be sent via text.

The code sent via text is 6 digits meaning 10^6 == 1MM permutations. He shows how he can enumerate these using 1K IP's ultimately bruteforcing the reset code.

The Device ID is still not captured although I'm guessing they allow handwaving via a malicious app or something of that nature.

Credit where credit is due, he cleverly enumerates them concurrently across 1K IP's and earned his bonus.

Interested how they fixed it...guessing adding a random session guid in the url and maybe increasing entropy && length of the secret.

[T1glober]

This is pretty much dependent on your attack vector being, for the most part, infinite. Method of delv and spawn rate, etc.

A 0day RAT for android was hitting about 500 devs per second before getting fixed.

[fortran77]

That's some hole! Imagine if this were used to get access to a celebrity's IG account. A lot of "damage" to a celebrity brand could have been done.

[rdtwo]

Lol log in to a celebrity account, announce support for Donald trump. Enjoy the ensuing dumpster fire

[jumbopapa]

A UF Air Force Recruiting page was compromised on FB last week and was posting a bunch of racist stuff.

[herpderperator]

Seems like a lot of improvements could have been made here. After you get the code wrong, it should reset and send you a different code. If you get more than 3 wrong in some pre-determined time, it should lock the person out for some other pre-determined time. You could even use exponential backoff time in both scenarios. Keeping the code the same after getting it wrong just seems really stupid.

[hkai]

Mathematically, does regenerating the code make a lot of difference?

You can simulate that by running a loop that generates a random 4-digit number in each iteration and randomly guessing it.

On average, you will guess the number after 10,000 iterations. It doesn't help that you regenerate the number each time. Your chance is still 1/10,000.

[rwmj]

I wonder if they (FB) have an IPv6 API endpoint. That could make acquiring the necessary number of distinct IP addresses much easier.

[miyuru]

All Facebook services are IPv6 enabled by default and their internal network is IPv6 only.

https://code.fb.com/production-engineering/legacy-support-on...

[yardstick]

Good question! I can see IPv6 rate limiters being adjusted to work on /64s and larger.

[eitland]

Now this left me wondering how hard it would be to guess the bugcrowd url at the bottomof the last picture.

[odensc]

I've always wondered - is there some kind of software that can match font glyphs from a partial image?

[w8rbt]

I'd just use IPv6 and Go from AWS. No need to have 1000's of machines.

[Hitton]

Nice find, but the original author has no idea what race condition means. This isn't race condition, it's just brute force combined with per ip rate limiting avoidance.

[thtthings]

Why do they not lock the account after n number of tries say 5?

The user will need to use a different way to authenticate if they can't enter the correct code in 5 tries

[rileymat2]

It gets tricky to implement lockouts, so the next article very well could be "How I DOSed all of Instagram"

[Obvisouly, there are ways just easy to screw up]

[AgentME]

There was a limit, but a race condition allowed the limit to be bypassed.

[ape4]

I need to say "endpoint" (rather than URL) to sound current.

[mychael]

Low bounties like that are going to motivate hackers to sell to malicious actors instead of going through the proper channels.

Facebook should know better.

[bhandziuk]

30,000 $ is a low bounty? It seems like a lot of money to me. How much should they reward?