Instagram vulnerability on iPhone allows for account takeover
A security researcher has found a vulnerability in Instagram involving how it handles cookies
IDG News Service - A security researcher published on Friday another attack on Facebook's Instagram photo-sharing service that could allow a hacker to seize control of a victim's account.
The attack was developed by Carlos Reventlov around a vulnerability he found within Instagram in mid-November. He notified Instagram of the problem on Nov. 11, but as of last Tuesday, it had not been fixed.
The vulnerability is in the 3.1.2 version of Instagram's application, released on Oct. 23, for the iPhone. Reventlov found that while some sensitive activities, such as logging in and editing profile data, are encrypted when sent to Instagram, other data was sent in plain-text. He tested the two attacks on an iPhone 4 running iOS 6, where he first found the problem.
"When the victim starts the Instagram app, a plain-text cookie is sent to the Instagram server," Reventlov wrote. "Once the attacker gets the cookie he is able to craft special HTTP requests for getting data and deleting photos."
The plain-text cookie can be intercepted using a man-in-the-middle attack as long as the hacker is on the same LAN (local area network) as the victim. Once the cookie is obtained, the hacker can delete or download photos or access the photos of another person who is friends with the victim.
The Danish security company Secunia verified the attack and issued an advisory.
Reventlov continued to study the potential of the vulnerability and found the cookie issue could also allow the hacker to take over the victim's account. Again, the attacker has to be on the same LAN as the victim.
The compromise uses a method called ARP (Address Resolution Protocol) spoofing, where the web traffic of the victim's mobile device is channeled through the attacker's computer. Reventlov wrote that it is then possible to intercept the plain-text cookie.
By using another tool to modify the headers of a web browser during transmission to Instagram's servers, it is possible to then sign in as the victim and change the victim's email address, resulting in a compromised account. The fix for Instagram is easy: the site should use always use HTTPS for API requests that have sensitive data, Reventlov wrote.
"I've found that many iPhone apps are vulnerable to such things but not too many are high-profile apps like Instagram," Reventlov wrote in an email to IDG News Service.
Neither Instagram nor Facebook officials could be immediately reached on Monday. Reventlov wrote in his advisories that he received an automated reply when he told Instagram of the issue.
Send news tips and comments to email@example.com. Follow me on Twitter: @jeremy_kirk
- Agile Masking Transforms Data Security Most data masking products can create masked data copies but not distribute or update them, resulting in projects that fail to live up...
- Step Out of the Bull's-Eye Learn about the evolution of targeted attacks, the latest in security intelligence, and strategic steps to keep your business safe.
- Do More With Less: How CARFAX Consolidated Their Security Solutions Through a consolidated F5 solution, CARFAX cut site downtime to zero, secures its data, and deployed a high-performance infrastructure to support its rapid...
- F5 Data Center Firewall Aces Performance Test F5's BIG-IP 10200v with Advanced Firewall Manager (AFM) can handle traffic at 80-Gbps rates while screening and protecting tens of millions of connections...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Keep Servers Up and Running and Attackers in the Dark An SSL/TLS handshake requires at least 10 times more processing power on a server than on the client. SSL renegotiation attacks can readily...
- Will the Real Endpoint Threat Detection and Response Please Stand Up? This webinar explores new technologies & process for protecting endpoints from advanced attackers as well as the innovations that are pushing the envelope... All Data Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!