Instagram Account Hijack Code Published

A Developer in London Discovered that, an Instagram Account Could be Easily Hijacked and he Released to the Public a Proof-of Concept of the Method after Facebook Denied him a Bug Bounty, Saying that, they were Aware of the Problem he Described to them. Because of Instagram's Insecure Communication, Stevie Graham was Able to Intercept Traffic from the Instagram App for iOS and Retrieve the Session Cookies, which Allowed him to Hijack the Account for the Service. The Flaw is Not New and Consists in the Fact that Instagram Doesn't Have Encrypted Communication Implemented for All of its Parts and API Calls are Made to Endpoints over Simple HTTP; these Contain Session Cookies in the Request Headers. Intercepting the Session Cookies Can be Done Easily, with Free Network Traffic Capture Tools and Loading them into a Web Browser Provides an Attacker Access to the Instagram Account without Having to Authenticate.


Regular Logging into the Service is Done over an Encrypted Connection but, Ulterior Communication with the Cookies is Carried Out without Encryption. With Access to the Account, a Potential Attacker could Initiate the Same Actions as if they were the Owner, Making Modifications, Adding New Content or Editing Comments. Sending Spam or Directing Followers to Pages Hosting Malicious Files are just Some of the Nefarious Activities that Can be Perpetrated by Leveraging this Security Flaw. Graham Made the Proof-of-Concept Available after Previously Exchanging Messages regarding the Matter with the Facebook Bug Bounty Team. He Tweeted about the Denial of a Bug Bounty and Said that, his Next Step would be to Write an Automated Tool that Enabled Mass Hijacking of Accounts. “I think this attack is extremely severe because it allows full session hijack and is easily automated”, he Said on the Page Disclosing the Flaw.


Graham is Not the Only One that Made this Discovery and Reported it to Facebook. This Week, Researcher Mazin Ahmed Made the Same Disclosure, Referring to the Instagram App for Android. After Contacting Facebook, he Received an Answer from the Security Team Letting him Know that, they were Aware of the Problem. “Facebook has discussed this issue at length and plans on moving everything on the Instagram site to HTTPS. However, there is no definite date for the change. At the moment Facebook accepts the risk of parts of Instagram communicate over HTTP and not HTTPS. We consider this a known issue and are working toward a solution in the near future”, the Facebook Team Told him.