If by chance you recently changed the password for your Instagram profile, it was possibly exposed to a hacker’s attack for ten minutes. According to cybersecurity expert Lamax Muthiya, until recently the social network had a vulnerability that allowed another person to access the accounts through a very simple process.
CYBERSECURITY
This cybersecurity expert discovered that when a person requests a new Instagram password, their profile is left largely unprotected for ten minutes. Coincidentally, the validity period of the text message that the social network itself sends to the user’s mobile phone. The message includes six figures that are necessary to verify that the person who requested a new password is the owner of the account.
Mutiyah was interested in discovering if a vulnerability existed, he decided to perform a ¨brute force attack¨ over the validity period of the message. ¨Performing a force majeure attack is very simple. If a password is based on a numerical code, you just have to make all the possible combinations to end up finding the correct one, thus accessing the social network, he explains.
To carry out this attack, Mutiyah decided to use different servers in the cloud that would allow him to use the IPs necessary to carry out the 200,000 numerical combinations essential to access the account. And if you use a single address, the account would be blocked after a few attempts.
It is assumed that in attacks similar to this, if the code is not correct, the system crashes completely or temporarily. However, the problem with Instagram is that it counts as errors those who came from the same IP address.
Mutiyah used up to 5,000 different IP addresses to make the attack a success. A process that is quite simple and is within the reach of anyone who has minimal computer knowledge. Although Mutiyah used cloud servers, there are other ways to breach an account with this vulnerability, such as by using a botnet network, which is often used by hackers to send ¨spam¨ messages en masse.
Instead of taking advantage of what he had discovered, Mutiyah chose to inform Facebook, the company that owns Instagram, about the existence of this defect. The company has decided to act and, consequently, has decided to reward the expert with a payment of $30,000.
This post is also available in: