Threat Update: Spotlight on Account Takeover

Summary

Account takeover is a form of identity theft where a fraudster accesses and takes control of a victim's accounts, particularly social media accounts. A successful account takeover attack can lead to fraudulent and unauthorized activities from the victim's compromised account. ZeroFOX Alpha Team has discovered a publicly available exploit that could bypass Instagram's security measures, resulting in the takeover of targeted accounts. Attackers could abuse this flaw to take over targeted Instagram accounts. Given the lack of evidence that this exploit is legitimate, however, this could prove to be a scam. Despite this, attackers have many options to compromise their desired social accounts.

Recommendations

• If not already enabled, consider enabling the compromised credentials and hacked account self-post rules for all relevant entities and ensure relevant emails are entered for those entities. Reach out to [email protected] for assistance if needed
• Enable multi-factor authentication for all accounts to help prevent potential account takeover
• Practice healthy password habits and use unique passwords for every account. Consider using a password management system

Details

Account takeover has long been popular among attackers - particularly those with a message to share. Social media followings are difficult and expensive to build, often requiring significant time or financial investment. In an effort to circumvent these costs, would-be attackers often seek to compromise high-profile social media accounts. These accounts often have a built-in following. As an added bonus, these accounts are often viewed as highly credible, particularly if they have been verified by the social network, so their followers may be more likely to take posts from these accounts at face value.

Because of this, attackers who compromise these accounts often use them to spread malware or phishing links or use them to generate publicity and name recognition for themselves. This was the case with the recent rash of Twitter, Facebook, and Instagram account takeovers by the OurMine group.

Figure 1. Twitter post of compromised account, advertising OurMine’s so-called security services

Attackers can compromise social accounts in a variety of ways. Phishing pages are often used to obtain account credentials. Usually, these pages will be included as a link in a malicious email, masquerading as a password reset or account verification link. SIM swapping accounts are commonly used to gain access to the phone number associated with a social media account. This tactic usually involves an attacker who contacts the victim’s mobile provider. Using social engineering methods, the attacker ultimately convinces the provider to switch the phone number to a new SIM card, owned by the attacker. This could allow the attacker to either reset the password for a targeted social account using the phone number associated with the account or to potentially follow the same process to compromise the email address used for the account. Ultimately, either process would allow the attacker to reset the password for a targeted account and thus gain access.

Attackers with the financial means to do so may also buy ready-made exploits on criminal forums. One such exploit that claims to have the ability to hack almost any Instagram account by bypassing Instagram’s password security is available for the price of $2000 USD.

Figure 2. Exploit information with pricing.

The exploit runs a python script which takes the attacker to the victim’s password reset page. The only prior information needed to carry out the bypass, is the victim's Instagram username. Once the attacker lands on the password reset page, he/she could change the password of the victim’s account without having any knowledge about the previous password, sweeping the victim off from accessing their own account. In an effort to advertise the exploit, the seller has created a YouTube video demonstrating its use. The video is vague, and doesn’t fully explain the mechanics of the exploit. The administrator of the site recently posted that the exploit is currently available and works without any limitations. However, given the lack of detail and high price, this exploit is likely to be a scam.

Figure 3. Latest comment posted by the website administrator, claiming the exploit still works as intended

Conclusion

Account takeover can be utilized to monitor a victim’s social network activity, promote an attacker’s ideology or affiliation, or push scams and malware. In some cases, hijacked accounts have even been utilized to deface a victim’s image by posting highly offensive content, as in the case of the Jack Dorsey account takeover, where the attackers, who go by the name ChucklingSquad, posted anti-Semitic content in the brief period of time the account was compromised. Attackers have a variety of methods at their disposal to compromise accounts, including the purchase of ready-to-go exploits. Although some exploit offerings may be scams, some are likely legitimate. Only by actively monitoring social accounts can the risk of account takeover be mitigated.