flâneur

The Newest Instagram "Exploit" is the Goofiest I've Seen | Sid's Blog

0xsid.com · 595 words · saved by 3 readers

Yesterday, a slew of Instagram accounts, including some high profile ones like the Obama White House account, seemingly got hacked. Look, I’m no spring chicken. I’ve spent almost a decade and a half identifying vulnerabilities and exploits at unicorn scale, but this is hands down the most unserious, "almost too stupid to be true" of them all. Step 01: Faking the Location & Initiating Support All the attacker needs to kick this off is your account username. Then, they hop on a VPN or proxy close to your city so Instagram's security algorithms don't suspect a thing. (You can quite easily get this from your public profile or "About" section or a hundred other ways.) Once it looks like the request is coming from the correct region, they tell the Meta support AI that the account is hacked and ask it to send the verification codes to an arbitrary email address they control. Step 02: That's It Really, that's it. The first proper zero auth password reset I've seen in production. There appears

Yesterday, a slew of Instagram accounts, including some high profile ones like the Obama White House account, seemingly got hacked. Look, I’m no spring chicken. I’ve spent almost a decade and a half identifying vulnerabilities and exploits at unicorn scale, but this is hands down the most unserious, "almost too stupid to be true" of them all. The Takeover Flow Step 01: Faking the Location & Initiating Support All the attacker needs to kick this off is your account username. Then, they hop on a VPN or proxy close to your city so Instagram's security algorithms don't suspect a thing. (You…

saved by

related reading