Is Instagram Doing Enough to Fix its Account Hijacking Bug ?

If you're Checking Instagram on Public Wi-Fi, you May be Exposing More than you Realize. A Security Researcher Named, Mazin Ahmed, has Published a New Report Showing How Easy it is to Hijack an Instagram Account and Taking the Company to Task for Lax Security. The Technique Relies on Catching Instagram Data in Transit, either through an Open Wi-Fi Hotspot or a More Sophisticated Attack at the Network Level. If Attackers Can do that, Ahmed Says, they'll be Able to See Unencrypted Pictures, User IDs and Account Keys — Potentially Allowing Outsiders to Take Over your Account Entirely. The Bug Isn't New — Researchers Have Reported it as Early as 2012 — but so Far, Instagram Doesn't Seem Worried about it.


When Ahmed Reported his Finding to Facebook, which Owns the Service, a Company Representative Told him it was a Known Issue. "We accept the risk", the rep Told Ahmed in an Email, "and [we're] working towards a solution in the future". It's still Unclear When a Fix Might be Coming and Whether the Company will be Willing to Accept the Extra Time and Processor Load that Comes with Encryption. Reached for Comment, an Instagram Representative Told, The Verge, "we are doing the technical work that is necessary to add HTTPS protection across the remaining parts of the Instagram app, while still ensuring stability and performance. We'll keep the Instagram community updated on our progress".




Info Sources:

http://thehackernews.com/2014/07/instagram-mobile-app-issue-leads-to_27.html

http://mazinahmed1.blogspot.in/2014/07/session-hijacking-in-instagram-mobile.html