Saturday, July 26, 2014

Session Hijacking in Instagram Mobile App via MITM Attack [ 0-DAY ]




In this post, I am going to share a new critical issue that I have identified on Instagram Mobile App. During my tests on their android app, I have set-up a lab to pentest the app. Then I started using the app on my phone, and monitoring the traffic in the network using WireShark, looking for evidence for unencrypted data that goes through the network or a technique to make this data unencrypted (if it was encrypted). As soon as I logged into my account on my phone, Wireshark has captured unencrypted data that goes through HTTP. This data includes: The pictures that the victims watching, The victim's session cookies, the victim's username and ID.



I was shocked after seeing the results, it is unbelievable that Facebook, the company that is responsible for Instagram, did not insure that the data is secured and goes through HTTPS.


Then, I took the session cookies and used it in my computer, and simply “The Victim's Session Has Been Hijacked”.




I have reported this issue to Facebook, and they emailed me saying:



       The security member said:” Facebook accepts the risk of parts of Instagram communicating over HTTP not over HTTPS”.
If this unencrypted data can lead to session hijacking and stalking Instagram users, this may raise an eye-brow of suspicious.


Timeline:
Jul 24, 2014 4:35am – Reported the issue.
Jul 24, 2014 4:38am – Received a confirmation email of receiving the submission.
Jul 24, 2014 9:45pm –  Received the first response from Facebook Security.
Jul 24, 2014 9:45pm – I Asked for a disclosure.
Jul 24, 2014 11:56pm – Received the second response from Facebook Security.

Recommendation:
       Until a patch is released ( which there is no specific date for releasing a patch that has been assigned by Facebook), do not use Instagram Mobile App. Instead, use the normal website, it is generally secured and encrypted.

Final Thoughts:
       It is unbelievable that a company such as Facebook does not take the maximum measure to insure the security of their users. Right now, I believe this issue might be getting exploited in the public by surveillance and agencies.

     Follow me on Twitter @mazen160 , and check my Blog for the latest news and findings.

61 comments:

  1. Thanks for sharing, I will post it in http://www.anti-virus4u.com/ media channels

    ReplyDelete
  2. Nice work. But I think now you won't be considered for https://www.facebook.com/whitehat

    ReplyDelete
    Replies
    1. Unfortunately, it didn't qualify for Fb bounty program. But it is good that everyone knows about the reality of Facebook & Instagram now.
      Thanks,
      Mazin

      Delete
  3. awesome post i really like it thanks for sharing this.
    mobile

    ReplyDelete
  4. Can we talk over email??? I have read your article & found some questions regarding it...
    android event app

    ReplyDelete
  5. Webdesign, Web Development, Software, Matrimony,Bulk SMS, Web Hosting, Online Application, Mobile Development, school management system, college management system, mlm software, recurring and fixed deposit software, inventory software, billing software, lab management, in tamilnadu, india. Loginfotech

    ReplyDelete
  6. This comment has been removed by the author.

    ReplyDelete
  7. Your post will be rather good, and I’m sure some will find it interesting because it’s about a topic that’s as widely discussed as others. Some may even find it useful.Thanks so much for your post. mobile app development

    ReplyDelete
  8. thanks very much.
    http://www.2n2media.com/mobile-application-development-singapore

    ReplyDelete
  9. Thanks for sharing information.
    recharge offers
    videocontelecom offers new Customers the proposition will be available on Plan voucher (PV) priced at Rs 76, offering All Local Calls at 25P/min only for 6 months including Rs 63 Talk time; 1050 MB data for 3 month and 100 SMS free/day, with first 2 SMS of the day chargeable at rack rate only in Haryana.

    ReplyDelete
  10. Your information about Selenium scripts is really interesting. Also I want to know the latest new techniques which are implemented in selenium. Can you please update it in your website? Selenium training in Chennai

    ReplyDelete
  11. Love it! Thank you so much for sharing this one really well defined all peaceful info,well really like it,Keep it up Love it- Fantasy League App Developers

    ReplyDelete
  12. The future of software testing is on positive note. It offers huge career prospects for talented professionals to be skilled software testers. Best software testing training institute in Chennai | Software Testing Training in Chennai | Software testing training institute Chennai

    ReplyDelete
  13. This comment has been removed by the author.

    ReplyDelete
  14. With the help of such a useful portable tool recording every online action was made simpler and easier. Thanks to Selenium testing course in chennai. The content you have furnished here is worthwhile to read, keep sharing article like this. By the way you are running a great blog.(Selenium testing training)

    ReplyDelete
  15. I gathered useful information on this point . Thank you posting relative information and its now becoming easier to complete this assignment
    mahjong |geometry dash | hulk|agario| kizi|sniper games| minecraft|halloween | pacman| games

    ReplyDelete

  16. An impressive and interesting information, thanks for sharing and great article.

    Best Indian Tattoo Desings

    ReplyDelete
  17. Never heard of such issues before but will be careful after what you showed here.

    Crazy Bulk | Crazy Bulk Reviews

    ReplyDelete
  18. Hi, this is Yasmin from Chennai. Thanks for sharing such an informative post. Keep posting. I did Selenium Training in Chennai at Besant technologies. It’s really useful for me to know more knowledge about selenium. They also give 100% placement guidance for all students.

    ReplyDelete
  19. Automation will make any work to be completed so soon(Selenium training in chennai), in addition to this recording the actions is possible with automated tool. Your content explicitely states the same(Selenium training institute in chennai). Thanks for sharing this worth able content in here. This was very useful to me as well. Keep blogging like this(Selenium testing course in chennai).

    ReplyDelete
  20. I think the problem lies in the fact that most people read articles on sites like Problogger and do nothing about it. They don't take action on the advice. They read the article, leave a comment, and go back to tweeting. It's sad.
    Buy Dbol Tablets Online

    ReplyDelete
  21. You cannot ignore mobile presence in this digital world. Most businesses are driven by the need for mobile presence. Responsive designs happily initiate your presence across the different devices. You can be pulled up using a smartphone or a tablet anytime anywhere. But, the question still remains the same- should you go for a mobile app or a responsive/mobile friendly design? What factors will decide if a mobile app will help further your business goals. mobile phone tracker

    ReplyDelete
  22. Then people with special devices opens appropriate channels. The number and frequency direction of the channel to ensure a natural appearance is important. Hair follicles were placed individually into slots.

    ReplyDelete
  23. Does Phen375 helps to decrease the human body's abilities to store worthless fat? Find Phen375 review at http://www.dietreviewmonster.com

    ReplyDelete
  24. Currently, with more than 1.4 billion apps, Google Play app market has become the world's largest. You may be surprised at the figure of 15% of these applications were labeled "low quality". They are the applications will not bring you anything, beyond the loss of time and increased advertising revenue for developers.!
    G9G , Dora , Kizi new , Huz 2 , Kizi hot , Friv 4 , 85 Play , 4223 Games , 85 Games

    ReplyDelete
  25. crazy bulk is one of the best selling legal steroids which help in gaining strength, muscle,visit here : http://www.buycrazybulks.com/

    ReplyDelete
  26. I love reading blogs posted here.They are truly very well written,precise and to the point. Thanks.

    MOBILE APPLICATION DEVELOPMENT Belfast UK & Social Media Marketing Belfast UK

    ReplyDelete
  27. http://www.wheretobuycrazybulk.com/
    http://www.crazybulksale.com/
    http://www.wheretobuyphenq.com/
    http://www.phenqweightloss.com/

    ReplyDelete
  28. PhenQ Reviews - Most Powerful Weight Loss Pills. PhenQ is the newest weight loss pill that has been proven by legitimate and smart science. http://phenq-reviews.com/

    ReplyDelete
  29. I read this article and feel this article is more specific which i read from another article from
    agario
    pacman
    plants vs zombies
    solitaire
    happy wheels
    car games

    ReplyDelete
  30. "In some cases of alopecia the problem may lie not in the fall itself, but rather that the hair is not renewed, which would entail a decrease in hair mass that can lead to hair loss," says Dr. dermatologist
    Hair Transplant in Delhi Cost

    ReplyDelete
  31. http://www.crazybulkreviews.com.au/

    This does not works

    ReplyDelete
  32. I was working and suddenly I visits your site frequently and recommended it to me to read also. The writing style is superior and the content is relevant. Thanks for the insight you provide the readers!
    Signature:
    i like play games happy wheels online and play happy wheels 2 games and agario , fireboy watergirl , agar io

    ReplyDelete
  33. It will surely be considered when required to perform.

    ReplyDelete
  34. Such a informative post.Thanks for sharing your knowledge with us.keep it up for updating post..
    http://sonymobileservicecenterinchennai.in/AboutUs.html

    ReplyDelete
  35. This comment has been removed by the author.

    ReplyDelete
  36. Nice blogs.
    Videocon and stay in touch with your Contacts, Friends, and Loved ones.
    Seamless Roaming across India. National Roaming is Pre-Activated on Videocon Prepaid Connection with Zero Monthly Rentals.
    Tariff while Roaming anywhere in India.

    ReplyDelete
  37. The best Weight Loss Supplements in Best Sellers. Find the top products most popular items in weight loss opinion http://www.weightlossopinion.com/

    ReplyDelete
  38. I really like your idea of http://blogweightlossdietposts.tumblr.com/
    Thanks for the information http://awesomefitnessads.blogspot.com/
    Thanks for the best blog. http://weightloss-diettipz.weebly.com/
    Really impressive post.https://weightlossdiet2015.wordpress.com/
    Useful information.I am actual blessed to read this article.http://5tipz.livejournal.com/
    Here's the right information for the best results. http://weightlossdiet2016.jimdo.com/

    ReplyDelete
  39. Good site development service providing companies are not hard to find out. Starting from the field of professional site app projects development to designing services they use to offer every facility to its customers.blog live

    ReplyDelete
  40. Great post and informative blog.it was awesome to read, thanks for sharing this great content to my vision.
    Informatica Training In Chennai
    Hadoop Training In Chennai
    Oracle Training In Chennai
    SAS Training In Chennai

    ReplyDelete
  41. Great post and informative blog.it was awesome to read, thanks for sharing this great content to my vision.
    Informatica Training In Chennai
    Hadoop Training In Chennai
    Oracle Training In Chennai
    SAS Training In Chennai

    ReplyDelete
  42. Garcinina Cambogia extract was recently featured on Dr. Oz where he proclaimed it as the "Holy Grail of Weight Loss" supplements. Learn how Dr Oz Garcinia Extracts Works to Lose Weight, Burn fat and suppress appetite.

    ReplyDelete
  43. Really awesome blog. Your blog is really useful for me. Thanks for sharing this informative blog. Keep update your blog.
    Oracle Training In Chennai

    ReplyDelete
  44. I am reading ur post from the beginning, it was so interesting to read & i feel thanks to you for posting such a good blog, keep updates regularly.Best Hadoop Training Institute In Chennai

    ReplyDelete
  45. Really appreciate this wonderful site. Mount Rinjani Trek Rinjani Trekking
    Rinjani Trekking Centre Lombok Volcano
    Rinjani Trekking Packages Rinjani Mountain
    Lombok Speed Boat Gili
    Rinjani routes Rinjani trekking Map
    Gili islands Gili
    Getting to Gilis Gili
    Green Rinjani halomitrekker.com
    Rinjani Trek

    ReplyDelete
  46. Most popular, industries-recognize certification that required complete Selenium training course & hand-on experience in
    Selenium Training in Chennai

    ReplyDelete
  47. Testing is very important before launching a web application or a mobile application because it can detect the error at an early stage, and it reduces the work of the developer.
    manual testing training institute in chennai | mobile application training in chennai | FITA Academy Chennai

    ReplyDelete