5 ms·

Instagram vulnerability on iPhone allows for account takeover

24 points by derpenxyne 14y ago

alpb 14y ago
Instagram uses POST method do actually issue a "delete" photo request on their API. Just wanted to say this is a bad REST API practice. http://reventlov.com/advisories/instagram-plaintext-media-disclosure-issue http://reventlov.com/advisories/instagram-plaintext-media-di...
- gfosco 14y ago
  Bad is such a subjective word... Nothing bad about using typical HTTP get/post to run your app. Things don't have to conform to REST. Using PUT/DELETE won't make it any more secure.
- terhechte 14y ago
  Their official API handles REST correctly (i.e. utilizing PUT and POST and DELETE where necessary) however, deleting images is not part of the official API, it is only available for the iPhone / Android apps. So I guess they just never came round to changing this since it is only part of an internal protocol anyway.
- travisp 14y ago
  This surely has nothing to do with the security problem, even if it's not exactly REST. It's not even that unusual for browser focused APIs: For example, many older browsers don't support sending the DELETE method, so Ruby on Rails applications often send Ajax DELETE requests as a POST, with the "_method" parameter set to "delete" (rather than a different URL as in the case of Instagram). That's probably not the reason in Instagram's case, but if you look at a lot of public REST APIs you are going to find many things that aren't exactly "REST".
kmf 14y ago
Trying to recreate this using Paros as a mitmproxy on Mac, looks like Instagram has blocked any kind of logging in/profile editing (the two vulnerabilities mentioned in the article) while on a proxy. No dice. Quick response by their team though. Edit: That's not to say a MITM couldn't happen without the vulnerable user being on a proxy. Just trying to recreate it isn't working.
- terhechte 14y ago
  Interestingly, I played around with mitmproxy and Instagram early last week, and couldn't get it to work either. Maybe they're somehow blocking mitm proxy as it is the most well known one, and the researcher in the linked article uses his own setup?
- slig 14y ago
  How can they tell you're using a mitmproxy? Conversely, why mitmproxy ins't completely transparent?
  - notaddicted 14y ago
    In the case of the Instagram iPhone app, since Instagram controls both the application and the server they can validate their own certificates in the iPhone app before continuing with the https request.
- idunno246 14y ago
  This is probably by accident. If you use CFNetwork and dont explicitly enable proxies, it ignores the system settings.
stusmall 14y ago
Has anyone tested this for the Android version?

24 points by derpenxyne 14y ago

alpb 14y ago

Instagram uses POST method do actually issue a "delete" photo request on their API. Just wanted to say this is a bad REST API practice. http://reventlov.com/advisories/instagram-plaintext-media-disclosure-issue http://reventlov.com/advisories/instagram-plaintext-media-di...

gfosco 14y ago
Bad is such a subjective word... Nothing bad about using typical HTTP get/post to run your app. Things don't have to conform to REST. Using PUT/DELETE won't make it any more secure.
terhechte 14y ago
Their official API handles REST correctly (i.e. utilizing PUT and POST and DELETE where necessary) however, deleting images is not part of the official API, it is only available for the iPhone / Android apps. So I guess they just never came round to changing this since it is only part of an internal protocol anyway.
travisp 14y ago
This surely has nothing to do with the security problem, even if it's not exactly REST. It's not even that unusual for browser focused APIs: For example, many older browsers don't support sending the DELETE method, so Ruby on Rails applications often send Ajax DELETE requests as a POST, with the "_method" parameter set to "delete" (rather than a different URL as in the case of Instagram). That's probably not the reason in Instagram's case, but if you look at a lot of public REST APIs you are going to find many things that aren't exactly "REST".

kmf 14y ago

Trying to recreate this using Paros as a mitmproxy on Mac, looks like Instagram has blocked any kind of logging in/profile editing (the two vulnerabilities mentioned in the article) while on a proxy. No dice. Quick response by their team though. Edit: That's not to say a MITM couldn't happen without the vulnerable user being on a proxy. Just trying to recreate it isn't working.

terhechte 14y ago
Interestingly, I played around with mitmproxy and Instagram early last week, and couldn't get it to work either. Maybe they're somehow blocking mitm proxy as it is the most well known one, and the researcher in the linked article uses his own setup?
slig 14y ago
How can they tell you're using a mitmproxy? Conversely, why mitmproxy ins't completely transparent?
- notaddicted 14y ago
  In the case of the Instagram iPhone app, since Instagram controls both the application and the server they can validate their own certificates in the iPhone app before continuing with the https request.
idunno246 14y ago
This is probably by accident. If you use CFNetwork and dont explicitly enable proxies, it ignores the system settings.

stusmall 14y ago

Has anyone tested this for the Android version?