This Flaw Could Have Allowed Hackers to Hack Any Instagram Account Within 10 Minutes

Instagram is growing quickly—and with the most popular social
media network in the world after Facebook, the photo-sharing
network absolutely dominates when it comes to user engagement and
interactions.

Despite having advanced security mechanisms in place, bigger
platforms like Facebook, Google, LinkedIn, and Instagram are not
completely immune to hackers and contain severe
vulnerabilities.

Some vulnerabilities have recently been
patched, some are still under the process of being fixed, and
many others most likely do exist, but haven’t been found just yet.

Details of one such critical vulnerability in Instagram surfaced
today on the Internet that could have allowed a remote attacker to
reset the password for any Instagram account and take complete
control over it.

Discovered and responsibly reported by Indian bug bounty hunter
Laxman
Muthiyah^[2], the vulnerability
resided in the password recovery mechanism implemented by the
mobile version of Instagram.

The “password reset” or “password recovery” is a feature that
allows users to regain access to their account on a website in case
they forgot their password.

On Instagram, users have to confirm a six-digit secret passcode
(that expires after 10 minutes) send to their associated mobile
number or email account in order to prove their identity.

That means, one out of a million combinations can unlock any
Instagram account using brute force attack, but it is not as simple
as it sounds, because Instagram has rate-limiting enabled to
prevent such attacks.

However, Laxman found that this rate limiting can be bypassed by
sending brute force requests from different IP addresses and
leveraging race condition, sending concurrent requests to process
multiple attempts simultaneously.

“In a real attack scenario, the attacker needs 5000 IPs to hack
an account. It sounds big, but that’s actually easy if you use a
cloud service provider like Amazon or Google. It would cost around
150 dollars to perform the complete attack of one million
codes.”

Laxman has also released a proof-of-concept exploit for the
vulnerability, which has now been patched by Instagram, and the
company awarded Laxman with $30,000 reward as part of its bug bounty
program^[3].

To protect your accounts against several types of online
attacks, as well to reduce your chances of being compromised where
attackers directly target vulnerable applications, users are highly
recommended to enable “two-factor
authentication^[4],” which could prevent
hackers from accessing your accounts even if they somehow manage to
steal your passwords.

^[1]