Hacker Claims He Could Have Hacked Any Instagram Account in 10 Minutes

  • A bug bounty hunter has figured a way to hack into any Instagram account in 10 minutes.
  • The cost of doing that would be only $150, which is nothing compared to the value of some Instagram accounts.
  • The hacker received $30k as a reward from Facebook, and the security flaw has been already fixed.

Indian hacker Laxman Muthiyah has found a vulnerability on Instagram which allowed him to hack to any account he wanted without the holder being able to do anything about it. The hacker has released the proof of concept code by now, as Facebook’s security team already fixed the problem and rewarded him with $30000 for the tip. The vulnerability that was exploited by the bug bounty hunter concerns the password recovery system that supports the Instagram platform, so the hacker leveraged the “password reset” that normally helps people who forgot or lost their password to access their account again.

Bounty
image source: thezerohack.com

When a user asks for a password reset, Instagram sends a six-digit passcode to their mobile phone or registered email account, which expires in ten minutes. This is something like a two-factor authentication step that helps the platform affirm that it is the real holder who is asking the password reset. The hacker has figured out that if he sent thousands of simultaneous password reset requests from different IP addresses, he could leverage a race condition and bypass the authentication step. Going from theory to practice, Muthiyah used 1000 different IPs to send 200k requests, just to make his point to Facebook’s security team.

As he points out, an attacker would need 5000 IPs and one million requests to brute force his/her way into an Instagram account, and it would cost approximately $150 to rent the required cloud service infrastructure to do so. Although the number of account-takeover attempts should guarantee a blocking action from the platform, the 10 minutes of expiry time was the key to keep the rate-limiting mechanism to a level that makes this attack possible. No known incidents of this hack having taken place in the wild are known, and it’s already too late for malicious actors to do it now as the problem has been fixed.

If you own an Instagram account and want to learn how to stay safe from any attacks, there are a number of things you can do from your side. One is to change your password regularly and always use a unique, strong combination of letters, numbers, and punctuation marks. Uncheck the “Remember Me” box when not using your computer, don’t blindly approve account access to third-party apps, and turn-on two-factor authentication.

Have you ever experienced an account takeover on Instagram? How did it happen? Share your experience with us in the comments down below, and also on our socials, on Facebook and Twitter.

REVIEW OVERVIEW

Latest

How to Watch Moon Knight on Disney Plus: Release Date, Cast, Trailer, Plot

Marvel Studios' Moon Knight series launch date and trailer were announced recently, and everyone is super excited to see it. This is...

My Hero Academia Battle Royale Coming Soon – Check Out The Gameplay

Good news for anime and gaming fans across the world: My Hero Academia is about to get its own Battle Royale game!...

One Punch Man Chapter 157 Release Date, Time and Where to Read Online

One Punch Man Chapter 157 is about to release soon, and we've got all the information you need to catch up! One...
For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: Chrome, Edge, Firefox, Safari