Stevie Graham, a security researcher who reported an authentication flaw in Instagram a few days ago, did not receive any monetary reward for reporting the bug to Facebook.
Apparently, because the vulnerability was not new, and not because it is not serious. (The vulnerability had been reported since 2012.)
So Graham began publishing public instructions directing anyone interested in how to hack Instagram accounts
See also: How to find out if your passwords have been leaked online?
All you need is a shared Wi-Fi, a sniffer app, and the knowledge that you'll be breaking the law if you invade someone's privacy.
The attack can be carried out via Firesheep.
Do you know Firesheep?
In 2010, social networks like Twitter and Facebook handled session authentication like this:
- Accept a connection using HTTPS (secure HTTP), which allows the user to enter their username and password over an encrypted connection.
- The above websites send back a unique "session cookie" or as it is known, a "session cookie", which is valid until logout, with a one-time cryptographic code that proves that the user has logged in correctly.
- This cookie was then accepted via an insecure connection (HTTP).
So, someone wouldn't be able to "catch" the user's password , but they could easily catch their login cookie and hack current Twitter or Facebook connections in real time.
See also: New Fleckpe Android malware detected on Google Play
What do I do with Firesheep?
Firesheep was a Firefox add-on that automates the process of waiting for a user to log in and then stealing login cookies.
This allows accounts, at least until the owner realizes what is happening and logs out.
Firesheep, by itself, could motivate companies like Twitter or Facebook to use HTTPS all the time.
Of course, like Facebook and Twitter, there are many others that use an unencrypted session cookie.
So for four years now, it seems that the Instagram app for iOS works in exactly the same way as explained above.
See also: Dark Web 4 sites that are not on Google
In short, it allows HTTP connections after the initial login.
[tweet_embed id=493469001075679232]
So, Instagram users with iPhones and iPads can "lose" their accounts very easily, reports Stevie Graham and published five simple steps to do so:
We will tell you 1 very serious reason not to do it
(At least, don't do it on someone else's account unless they give you their permission.)
It is illegal.
But if it's really as easy as Graham says, Facebook will probably react very quickly.
