Instagram is a social networking service built around sharing photos and videos. It launched in October 2010 on iOS first and became available on Android in April 2012. Facebook purchased the service on April 2012 and has owned it since.

Not Really Immune to Hackers!

Having advanced security mechanisms like Facebook, Google, LinkedIn. Instagram is not completely immune to hackers and contains severe vulnerabilities.

Some vulnerabilities have recently been patched, some are still under the process of being fixed, and many others most likely do exist, but haven’t been found just yet.

Some of them include,

Facebook late last month revealed that the social media company mistakenly stored passwords for “hundreds of millions” of Facebook users in plaintext, including “tens of thousands” passwords of its Instagram users as well.

They Said,

“Since this post was published, we discovered additional logs of Instagram passwords being stored in a readable format. We now estimate that this issue impacted millions of Instagram users. We will be notifying these users as we did the others. Our investigation has determined that these stored passwords were not internally abused or improperly accessed.”



The “password reset” or “password recovery” is a feature that allows users to regain access to their account on a website in case they forgot their password.


This flaw was discovered and responsibly reported by Indian bug bounty hunter “LaxmanMuthiyah,” the vulnerability resided in the password recovery mechanism implemented by the mobile version of Instagram. Details of one such critical vulnerability in Instagram surfaced on the Internet could have allowed a remote attacker to reset the password for any Instagram account and take complete control over it.


On Instagram, users have to confirm a six-digit secret passcode (that expires after 10 minutes) sent to their associated mobile number or email account in order to prove their identity.

That means, one out of a million combinations can unlock any Instagram account using brute force attack, but it is not as simple as it sounds, because Instagram has rate-limiting enabled to prevent such attacks.

However, Laxman found that this rate-limiting can be by-passed by sending brute force requests from different IP addresses and leveraging race condition, sending concurrent requests to process multiple attempts simultaneously.

Laxman successfully demonstrated the vulnerability to hijack an Instagram account by quickly attempting 200,000 different passcode combinations (20% of all) without getting blocked.

“In a real attack scenario, the attacker needs 5000 IPs to hack an account. It sounds big, but that’s actually easy if you use a cloud service provider like Amazon or Google. It would cost around 150 dollars to perform the complete attack of one million codes.”

Laxman has also released a proof-of-concept exploit for the vulnerability, which has now been patched by Instagram, and the company awarded Laxman with $30,000 reward as part of its bug bounty program.

To protect your accounts against several types of online attacks, as well to reduce your chances of being compromised where attackers directly target vulnerable applications, users are highly recommended to enable “two-factor authentication,” which could prevent hackers from accessing your accounts even if they somehow manage to steal your passwords.

Related Story:

Instagram Accidentally Exposed Some Users Passwords Because Of Download Your Data Feature

Stay Tuned For More Updates (IST)

390 total views, 3 views today

Leave a Reply

Your email address will not be published. Required fields are marked *