Indian techie awarded $10,000 for discovering a flaw in Instagram

By Digit NewsDesk | Published on Aug 27 2019
Indian techie awarded $10,000 for discovering a flaw in Instagram

Apple iPhone XR 64GB at Lowest Price Ever

6.1" display | 50% Faster Graphics performance | TrueDepth camera

Click here to know more

HIGHLIGHTS

This is not the first time Laxman Muthiyah has discovered a flaw in a Facebook app.

He was awarded $30,000 last month for spotting a similar vulnerability.

Facebook has awarded an Indian techie $10,000 for spotting a flaw in the app. Interestingly, he was awarded $30,000 by Facebook for finding a bug in the mobile recovery flow of the Facebook-owned photo and video sharing app. Chennai-based security researcher Laxman Muthiyah said he again discovered a new account takeover vulnerability in Instagram. The new vulnerability is similar to the one he reported in July and allowed anyone to hack Instagram accounts without consent permission.

Facebook says it has fixed the spotted vulnerability. "Facebook and Instagram security team fixed the issue and rewarded me $10000 as a part of their bounty programme," Muthiyah said in a blog post

The vulnerability could allow hackers to use the same device ID - the unique identifier used by Instagram server to validate password reset codes - to request multiple passcodes of different users.

In reply, Facebook said in a letter to Muthiyah, "You identified insufficient protections on a recovery endpoint, allowing an attacker to generate numerous valid nonces to ten attempt recovery.”

Last month, he found a bug that allowed hackers to hack in three simple steps:

  • Triggering a password reset.
  • Requesting a recovery code.
  • Quickly trying out every possible recovery code against the account.

While looking for an account takeover vulnerability, the techie turned his attention to the Instagram forgot password endpoint. Last month he claimed that he had sent thousands of requests to check whether Instagram’s systems are validating and rate limiting the requests properly. He found he was able to send requests continuously without getting blocked. In order to be able to change the password, he needed the code (which was sent to the account user’s registered mobile number). So there was only one, hit-and-trial, method that could have provided him with success. 

This is not the second time Muthiyah has found a flaw in a Facebook app. In the past, he uncovered a data deletion flaw and a data disclosure bug on Facebook as well. 

logo
Digit NewsDesk

The guy who answered the question 'What are you doing?' with 'Nothing'.

Digit caters to the largest community of tech buyers, users and enthusiasts in India. The all new Digit in continues the legacy of Thinkdigit.com as one of the largest portals in India committed to technology users and buyers. Digit is also one of the most trusted names when it comes to technology reviews and buying advice and is home to the Digit Test Lab, India's most proficient center for testing and reviewing technology products.

We are about leadership-the 9.9 kind! Building a leading media company out of India.And,grooming new leaders for this promising industry.