5 ms·
How I hacked Instagram to see private photos
- 1337biz 13y agoNow, where is Hunter Moore when he is needed the most? Oh right, grounded in his parents' basement.
- alecsmart1 13y agoI believe he was arrested.
- Gracana 13y agoNobody -- past, present, or future -- needs Hunter Moore.
- btbuildem 13y agoAmazing font shadows, so unreadable..
- trippy_biscuits 13y agoI can't read that page without getting ill. Even highlighting doesn't help.
- phr0nak 13y agoSorry to hear that. I'll fix this issue as soon as possible.
- badman_ting 13y agoDoes checking the UA string offer much security? I've always been under the impression that it's essentially user input and not to be trusted. But yeah, that is a pretty nasty CSRF. Good post, thanks.
- dcaunt 13y agoYou're right, it's not an absolute fix. It would have prevented requests from an authenticated browser (without a mobile UA) from being accepted, reducing the effectiveness of the attack.
- meritt 13y agoFor a CSRF attack it actually does because it needs to be executed inside an unsuspecting victim's browser. That wouldn't be sending an custom Instagram user-agent.
- phr0nak 13y agoAs you said, checking the User-Agent does not offer much security, but at this point, is more than nothing. I know that Instagram team are studying other ways (csrftoken among others) to protect their website or application against this kind of attacks. Thanks.
- tantalor 13y ago@phr0nak: Great article, but you should spend more time editing, or get a friend who is fluent in English to help you (I assume you are not). Phrases like "Due I guessed the website could be already audited and secure" are difficult to understand. I think you meant, "[Since/because] I guessed the website [would already be]..."
- phr0nak 13y agoThanks for your comments :)
- iunk 13y agoMaybe you should write in your native language, and let everyone else to learn the language. I don't like when people criticize your writing skills when it's not your native language.
- mentat 13y agoOr maybe he wants the largest possible audience and the comment is aimed at getting him that.
- TallGuyShort 13y agoI don't think the criticism was intended in a negative spirit. Getting a native speaker of the language to help edit your writing is a very helpful suggestion. It's a good way to improve your own language skills, while still making your writing available to other audiences. I would definitely encourage people to still publish in their native language though. As you point out, it encourages others to learn other languages and will be very helpful to your fellow countrymen.
- danellis 13y agoIt might not be correct English, but it's not even remotely difficult to understand what was meant. (In fact, I didn't even notice it was wrong until you pointed it out.)
- juliann 13y agoI was wondering how generous was the reward Facebook gives for helping them find this kind of security issues, can you share that? (If you consider that you don't want to share this kind of information is completely fine for me, im just curious). Thanks and congrats, good research!
- aabalkan 13y agoWow, not even a Referer header check was in place.
- kclay 13y agoYou would be surprised,what some people leave behind. I'm doing some work on an app that has in-app payments, but the payments are not verified on the server to unlock o_0. This is just a big no no. I just wonder how many other companies have this same simple error.
- 8ig8 13y ago116 days (almost 4 months) from first report to bounty payment. Longer than I expected. Is this typical?
- xerophtye 13y agoWell there seems to be a certain exploit going around on FB. it a picure that claims "hack anyone's account by opening their profile and copy pasting this code into the webconsole" where said code uses you logged in credentials to make FB API calls. The version i saw made you like a bunch of pages, follow a bunch of people and tag all of your friends in the comments to that picture. But I wonder if same can be used to change the privacy settings
- marclipovsky 13y agoI'm impressed that you got a reward considering Instagram is on their exclusions list for bug bounties. Well done!
- phr0nak 13y agoI think you're wrong. Read carefully the "Exclusion"'s section on https://www.facebook.com/whitehat https://www.facebook.com/whitehat