Instagram vulnerability on iPhone allows for account takeover
A security researcher has found a vulnerability in Instagram involving how it handles cookies
IDG News Service - A security researcher published on Friday another attack on Facebook's Instagram photo-sharing service that could allow a hacker to seize control of a victim's account.
The attack was developed by Carlos Reventlov around a vulnerability he found within Instagram in mid-November. He notified Instagram of the problem on Nov. 11, but as of last Tuesday, it had not been fixed.
The vulnerability is in the 3.1.2 version of Instagram's application, released on Oct. 23, for the iPhone. Reventlov found that while some sensitive activities, such as logging in and editing profile data, are encrypted when sent to Instagram, other data was sent in plain-text. He tested the two attacks on an iPhone 4 running iOS 6, where he first found the problem.
"When the victim starts the Instagram app, a plain-text cookie is sent to the Instagram server," Reventlov wrote. "Once the attacker gets the cookie he is able to craft special HTTP requests for getting data and deleting photos."
The plain-text cookie can be intercepted using a man-in-the-middle attack as long as the hacker is on the same LAN (local area network) as the victim. Once the cookie is obtained, the hacker can delete or download photos or access the photos of another person who is friends with the victim.
The Danish security company Secunia verified the attack and issued an advisory.
Reventlov continued to study the potential of the vulnerability and found the cookie issue could also allow the hacker to take over the victim's account. Again, the attacker has to be on the same LAN as the victim.
The compromise uses a method called ARP (Address Resolution Protocol) spoofing, where the web traffic of the victim's mobile device is channeled through the attacker's computer. Reventlov wrote that it is then possible to intercept the plain-text cookie.
By using another tool to modify the headers of a web browser during transmission to Instagram's servers, it is possible to then sign in as the victim and change the victim's email address, resulting in a compromised account. The fix for Instagram is easy: the site should use always use HTTPS for API requests that have sensitive data, Reventlov wrote.
"I've found that many iPhone apps are vulnerable to such things but not too many are high-profile apps like Instagram," Reventlov wrote in an email to IDG News Service.
Neither Instagram nor Facebook officials could be immediately reached on Monday. Reventlov wrote in his advisories that he received an automated reply when he told Instagram of the issue.
Send news tips and comments to email@example.com. Follow me on Twitter: @jeremy_kirk
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Infographic: Converged Infrastructure Benefits This Infographic quantifies the savings organizations are realizing from increased deployment speed, higher availability, and lower annual costs.
- CIOs Deliver Productivity Breakthroughs with Intelligent Digital Signage Retailers have long recognized the influence that digital signage provides over a shopper's point-of-purchase decision making process.
- Going Paperless? Here's What You Need to Think About As makers of some of the world's most popular PDF solutions, we often consult with businesses & governmental agencies that have the goal...
- The Big Data Opportunity for HR and Finance If CEOs, CFOs, CIOs, and CHROs want to drive their businesses forward, they will need to quickly recognize the enormous value of big...
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva.
- Top 4 Digital Signage Fails Join RMG Networks for a look at four of the most common reasons digital signage fails in corporate businesses. Learn about strategies to... All Data Security White Papers | Webcasts
Our new weekly Consumerization of IT newsletter covers a wide range of trends including BYOD, smartphones, tablets, MDM, cloud, social and what it all means for IT. Subscribe now and stay up to date!