0

I am new to the field of security. I thought a lot about the following scenario and could not come up with a good solution

  1. Suppose I go to the Instagram "forgot password" page. I enter a person's mobile number whose account I want to hack.

  2. It sends a 6 digit code to that person.

  3. I want to brute force it - around a million combinations.

  4. I get 5000 IPs and send 200 requests per IP and brute force it i.e. sending requests concurrently from all the IPs. There is a race condition here, right? So wouldn't I be able to break in?

As the requests are going concurrently how can you keep a count and block the user after a few failed attempts? That is what this guy did. Can someone explain how this was possible and how to mitigate it?

Improve this question

1 Answer 1

Reset to default
2

Can someone explain how this was possible

It was possible due to a lack of rate-limiting on the action/request. As you said, it could be brute-forced hence.

Instagram has now patched this issue. I haven't seen any official publication on the mitigation measures, but a quick visit to Instagram's Password Reset Page reveals the [intended] user is now sent a link.

and how to mitigate it?

You could rate-limit the action/request - not only by IP address but actually upon the action itself. However, this would pose a potential DOS(Denial of Service) attack - hence why Instagram probably did not limit it as such in the first place. For one, given it is a 6 digit code given to the user you could significantly reduce the rate-limiting threshold per IP address (i.e. from 200 to 20) to increase significantly the cost of the attack.

But put simply, the 6 digit code itself is flawed. Although the DOS attack may be viewed as 'unlikely', it carries relatively small cost given the potential gains/motives for the attacker, so it should be mitigated. Hence, as instagram have - the easiest solution is to verify the user via more secure means, e.g.:

Send a link to the user (via external, previously established, communication channels) and then get them to input the code at this unique link.

Make the code 10 digits alphanumeric and set a 30 minute expiration & rate-limit the number of codes that can be issued repeatedly.

etc.

Improve this answer
3
  • Great! But how would rate-limit on action/request cause DOS? When the request limit is reached the server would not take in any more requests right? So how can huge number of requests come in for a DoS?
    – Siddharth C
    Commented Jul 20, 2019 at 0:26
  • User requires password reset. I max-out the request limit so that user can now not legitimately reset their password & hence cannot gain access to their account. Hence, Denial Of Service attack. Given the scope for celebrities (i.e. millions/billions of followers) and motives of attackers (attention seeking, trolling, proof of concept), and the focus of instagram on 'extreme usability', this is probably why it was not rate limited, as many such things are not on similar big platforms/services alike. Hope that helps.
    – Reality
    Commented Jul 20, 2019 at 0:32
  • I think I found a better answer. Instagram was accepting a million tries with the same CSRF token. So if only 1 try was accepted per CSRF token this would have been mitigated.
    – Siddharth C
    Commented Jul 22, 2019 at 17:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .