2 ms·
Link 1 says > In case you're wondering, because the system treats this high-privilege recovery flow as a total account reset by the "true" owner, the original
by croes 5mo ago
Link 1 says
> In case you're wondering, because the system treats this high-privilege recovery flow as a total account reset by the "true" owner, the original 2FA gets thoroughly bypassed in the process.
But link 2 says
> The hackers who released the video on Telegram said their exploit failed to work against any accounts that had MFA enabled.
So which one is true?
- parable 5mo agoThe original 2FA did not get thoroughly bypassed, because otherwise I would've lost my username, so that's false - at least, based on my experience. However, there are separate vulnerabilities that allow for 2FA to be bypassed on Instagram. I assume they were chained to take over specific high-value accounts. The 2FA removal happens as a service - most people charge around $1,000+ - so it wasn't viable for most lower-value accounts. Anything that was worth over $1k probably had the bypass applied to it.