Instagram Hacked - Vulnerability Details Given-Out by Kaspersky

Instagram announced that criminals have been exploiting a bug on Instagram, which allowed them to rob the credentials of Instagram users and also of celebrities.  Kaspersky Lab researchers who noticed the bug notified Instagram on Tuesday, 29 August and have shared a short technical analysis with the social media network.

The researchers discovered that the vulnerability exists in Instagram mobile version 8.5.1, released in 2016. The attack process is relatively simple:  using the out-dated application the attacker selects the reset password option and captures the request using a web proxy. They then select a victim and send a request to Instagram’s server carrying the target’s unique identifier or username. The server returns a JSON response with the victim’s personal information including sensitive data such as email and phone number.
The attacks are quite labor intensive: each one has to be done manually since Instagram uses mathematical calculations to prevent attackers from automating the request form. The hackers were spotted on an underground forum, trading the personal credentials for celebrity accounts.

Altaf Halde, Managing Director- South Asia, Kaspersky Lab advises users running older versions of the software to update immediately to the latest available version. Other useful advice for staying safe on social media includes using different email addresses for different social platforms, reporting any concerns or irregularities to the network – and, most of all: if you receive emails about a password restore that you have not initiated, alert the network immediately.