Technology
Indian bug hunter finds flaw in Instagram, wins $30,000
New Delhi, July 18
Chennai-based security researcher Laxman Muthiyah has won $30,000 as a part of a bug bounty programme after he spotted a flaw in Facebook-owned photo-sharing app Instagram.
Muthiyah said the vulnerability allowed him to to "hack any Instagram account without consent permission."
He discovered it was possible to take over someone's Instagram account by triggering a password reset, requesting a recovery code, or quickly trying out possible recovery codes against the account.
"I reported the vulnerability to the Facebook security team and they were unable to reproduce it initially due to lack of information in my report. After a few email and proof of concept video, I could convince them the attack is feasible," Muthiyah wrote in a blog post this week.
Facebook and Instagram security teams fixed the issue and rewarded me $30,000 as a part of their bounty programme, he added.
Paul Ducklin, Senior Technologist at cyber security major Sophos, however, warned while the vulnerability found by Muthiyah no longer existed, users should familiarise themselves with the process of getting back control of their social media accounts, in case they get hacked.
"In case any of your accounts do get taken over, familiarise yourself with the process you'd follow to win them back. In particular, if there are documents or usage history that might help your case, get them ready before you get hacked, not afterwards," Ducklin said in a statement.
Muthiyah earlier identified not only a data deletion flaw, but also a data disclosure bug on Facebook.
The first bug could have zapped all your photos without knowing your password; the second meant tricking you to install an innocent-looking mobile app that could riffle through all your Facebook pictures without being given access to your account.
"To be clear: he found those holes in compliance with Facebook's Bug Bounty programme, and he disclosed them responsibly to Facebook," Ducklin said.
"As a result, Facebook was able to fix the problems before the bugs became public, and (as far as anyone knows) these bugs were patched before anyone else found them," he remarked.
Muthiyah said the vulnerability allowed him to to "hack any Instagram account without consent permission."
He discovered it was possible to take over someone's Instagram account by triggering a password reset, requesting a recovery code, or quickly trying out possible recovery codes against the account.
"I reported the vulnerability to the Facebook security team and they were unable to reproduce it initially due to lack of information in my report. After a few email and proof of concept video, I could convince them the attack is feasible," Muthiyah wrote in a blog post this week.
Facebook and Instagram security teams fixed the issue and rewarded me $30,000 as a part of their bounty programme, he added.
Paul Ducklin, Senior Technologist at cyber security major Sophos, however, warned while the vulnerability found by Muthiyah no longer existed, users should familiarise themselves with the process of getting back control of their social media accounts, in case they get hacked.
"In case any of your accounts do get taken over, familiarise yourself with the process you'd follow to win them back. In particular, if there are documents or usage history that might help your case, get them ready before you get hacked, not afterwards," Ducklin said in a statement.
Muthiyah earlier identified not only a data deletion flaw, but also a data disclosure bug on Facebook.
The first bug could have zapped all your photos without knowing your password; the second meant tricking you to install an innocent-looking mobile app that could riffle through all your Facebook pictures without being given access to your account.
"To be clear: he found those holes in compliance with Facebook's Bug Bounty programme, and he disclosed them responsibly to Facebook," Ducklin said.
"As a result, Facebook was able to fix the problems before the bugs became public, and (as far as anyone knows) these bugs were patched before anyone else found them," he remarked.
2 hours ago
Dharmesh Patel's Fate Uncertain After Devil’s Slide Incident
2 hours ago
Composer Reena Esmail is welcomed by the Music Institute of Chicago
2 hours ago
PM Modi takes opposition to cleaners on EVMs, once again
2 hours ago
Tech entrepreneur's 18-month prison term handed down for securities and wire fraud
2 hours ago
Two advertisements for Susheela Jayapal's campaign are released.
2 hours ago
US report on human rights abuses is dismissed by India.
2 hours ago
Kim Kardashian: A Conversation with US Vice President kamala Harris on Criminal Justice Reform
4 hours ago
CBI recovers huge cache of arms, explosives from house of Shahjahan’s relative at Sandeshkhali
4 hours ago
Bengal LS polls: BJP's Raju Bista complains of violence at Chopra; 47.29 pc turnout till 1 pm
4 hours ago
Elon Musk’s AI company xAI to raise $6 billion: Report
5 hours ago
Anoushka Shankar to get honorary degree by Oxford University, calls it ‘pinch-me moment’
5 hours ago
Anuradha Paudwal praises ‘Superstar Singer 3’ contestant, says he ‘can be next hero voice’
5 hours ago
Amid rumours of split, source says Zendaya, Tom Holland have discussed marriage