Threat Update: Instagram Account Takeover and Other News

Vulnerability in Instagram Could Allow for Easy Account Takeover

When a user forgets their Instagram password, they are able to request a reset passcode be sent to their mobile device. This code can be used to change an account's password. A security researcher has discovered a method of brute forcing this code by bypassing request rate limiting to the password reset link, which could be used to change the password of any targeted account, enabling an attacker to access and log in as their victim. Facebook, who owns Instagram, has since patched this vulnerability.

Recommendations

• Enable multi-factor authentication on accounts whenever possible.
• Monitor logins to all social media accounts
• Notify the account provider immediately if you receive a password recovery request email or text, and did not make the request.

Details

A security researcher who discovered a new method for Instagram account takeover was awarded a $30,000 bug bounty for providing Facebook with information to patch the vulnerability. When an Instagram user forgets their password, they are able to reset their password using a link on the mobile application. This prompts the sending of a six-digit passcode to the mobile number entered, which is used to change the account password. Because in theory, an attacker could brute force this kind of passcode by sending a huge number of requests until the code was successfully guessed, these kinds of requests are usually rate limited so that they cannot be brute forced within the code expiration window.

In this particular case, although the Instagram account recovery process is rate limited, an attacker is able to get around the limit by sending requests from different IP addresses. This allowed for bypass of the rate limiting mechanism by sending a large number of requests from many different IP addresses, which may have ultimately resulted in an attacker being able to brute force the password recovery code.

This vulnerability was reported to Facebook by the researcher, and was subsequently fixed.

Breaking News - 07.15.2019

QNAPCrypt Ransomware Spotted Targeting NAS Servers

Ransomware typically targets Windows computers, so seeing some malware target Linux is both refreshing and horrifying. NAS is commonly deployed to Linux servers, especially as a backup service, so it makes sense for cybercriminals to target these troves of data. Researchers have identified 15 unique and ongoing campaigns targeting Linux servers

See the full report here: https://threatpost.com/linux-ransomware-nas-servers/146441/

PureScript NPM Installer Hijacked to Deliver Malicious Code

The npm registry is notorious for having dependencies upon dependencies within it's package structure. In this post, researchers report that a popular dependency in a large package contained malicious code that would be executed for anyone that installed PureScript.

See the full report here: https://www.theregister.co.uk/2019/07/15/purescripts_npm_installer/

New 0-day Reported in Windows 7 and Server 2008

Researchers at ESET have discovered a zero-day exploit being used in targeted attacks against Eastern European organizations. The attack leverages pop up window functionality in order to gain local privilege escalation. Micosoft has released a patch for this vulnerability (CVE-2019-1132), which is available here.

See the full report here: https://www.welivesecurity.com/2019/07/10/windows-zero-day-cve-2019-1132-exploit/