[Tracefl0w]

This Flaw Could Have Allowed Hackers to Hack Any Instagram Account Within 10 Minutes

Instagram is growing quickly, and with the most popular social media network in the world after Facebook, the photo-sharing network absolutely dominates when it comes to user engagement and interactions.

Despite having advanced security mechanisms in place, bigger platforms like Facebook, Google, LinkedIn, and Instagram are not completely immune to hackers and contain severe vulnerabilities.

Discovered and responsibly reported by Indian bug bounty hunter Laxman Muthiyah, the vulnerability resided in the password recovery mechanism implemented by the mobile version of Instagram.

The "password reset" or "password recovery" is a feature that allows users to regain access to their account on a website in case they forgot their password.
On Instagram, users have to confirm a six-digit secret passcode (that expires after 10 minutes) sent to their associated mobile number or email account in order to prove their identity. That means, one out of a million combinations can unlock any Instagram account using brute force attack, but it is not as simple as it sounds, because Instagram has rate-limiting enabled to prevent such attacks.

However, Laxman found that this rate limiting can be bypassed by sending brute force requests from different IP addresses and leveraging race condition, sending concurrent requests to process multiple attempts simultaneously.

"Race hazard (concurrent requests) and IP rotation allowed me to bypass it. Otherwise, it wouldn't be possible. 10 minutes expiry time is the key to their rate limiting mechanism, that's why they didn't enforce permanent blocking of codes," Laxman told The Hacker News.

As shown in the above video demonstration, Laxman successfully demonstrated the vulnerability to hijack an Instagram account by quickly attempting 200,000 different passcode combinations (20% of all) without getting blocked.

"In a real attack scenario, the attacker needs 5000 IPs to hack an account. It sounds big, but that's actually easy if you use a cloud service provider like Amazon or Google. It would cost around 150 dollars to perform the complete attack of one million codes."

Laxman has also released a proof-of-concept exploit for the vulnerability, which has now been patched by Instagram, and the company awarded Laxman with $30,000 reward as part of its bug bounty program.

Certainly caught my attention the other day. It's crazy that with a budget of 150$, you could hack almost any IG account.

[Drako]

A simple, yet effective exploit. It's a good thing that the guy who found this exploit made it public. Lots of damage could have been done. With that other sites should be checking for this vulnerability.

[Tracefl0w]

A simple, yet effective exploit. It's a good thing that the guy who found this exploit made it public. Lots of damage could have been done. With that other sites should be checking for this vulnerability.

It is indeed, however I still can't wrap my head around the simple solution of rate limiting per ip and not per account. Why would they do that?

[mothered]

I still can't wrap my head around the simple solution of rate limiting per ip and not per account. Why would they do that?

Exactly my thoughts.

You'd think that ex-amount of Invalid authentication attempts (regardless of where they originated), would be "account-based", thereby an account block Is Issued. It's simply common sense Implementing this type of account lockout threshold.

[darkninja1980]

That what happens to most social media sites.

[OversouL]

Wow this is fascinating. I wouldn't expect such a flaw from a big social media.

[Dismas]

Surprised it went unnoticed for so long. Someone could have caused rather serious damage.