Saturday, August 17, 2019
News

Indian bug hunter finds flaw in Instagram, wins $30,000

   SocialTwist Tell-a-Friend    Print this Page   COMMENT

New Delhi | Thursday, 2019 11:15:05 PM IST
Chennai-based security researcher Laxman Muthiyah has won $30,000 as a part of a bug bounty programme after he spotted a flaw in Facebook-owned photo-sharing app Instagram.

Muthiyah said the vulnerability allowed him to to "hack any Instagram account without consent permission."

He discovered it was possible to take over someone's Instagram account by triggering a password reset, requesting a recovery code, or quickly trying out possible recovery codes against the account.

"I reported the vulnerability to the Facebook security team and they were unable to reproduce it initially due to lack of information in my report. After a few email and proof of concept video, I could convince them the attack is feasible," Muthiyah wrote in a blog post this week.

Facebook and Instagram security teams fixed the issue and rewarded me $30,000 as a part of their bounty programme, he added.

Paul Ducklin, Senior Technologist at cyber security major Sophos, however, warned while the vulnerability found by Muthiyah no longer existed, users should familiarise themselves with the process of getting back control of their social media accounts, in case they get hacked.

"In case any of your accounts do get taken over, familiarise yourself with the process you'd follow to win them back. In particular, if there are documents or usage history that might help your case, get them ready before you get hacked, not afterwards," Ducklin said in a statement.

Muthiyah earlier identified not only a data deletion flaw, but also a data disclosure bug on Facebook.

The first bug could have zapped all your photos without knowing your password; the second meant tricking you to install an innocent-looking mobile app that could riffle through all your Facebook pictures without being given access to your account.

"To be clear: he found those holes in compliance with Facebook's Bug Bounty programme, and he disclosed them responsibly to Facebook," Ducklin said.

"As a result, Facebook was able to fix the problems before the bugs became public, and (as far as anyone knows) these bugs were patched before anyone else found them," he remarked.

--IANS gb/pcj

( 358 Words)

2019-07-18-17:26:06 (IANS)

 
  LATEST COMMENTS (0)
POST YOUR COMMENT
Comments Not Available
 
POST YOUR COMMENT
 
 
TRENDING TOPICS
 
 
CITY NEWS
MORE CITIES
 
 
 
MORE SCIENCE NEWS
Amazon ambassadors flood Twitter with 'f...
Czech scientists find way to extract wat...
Twitter to remove spam, abuse from your ...
Instagram starts allowing users to flag ...
Latest Microsoft update slows some Surfa...
Apple to unveil new iPhones on September...
More...
 
INDIA WORLD ASIA
RPF head constable commits suicide in De...
PM, Shah extend greetings to Parsi commu...
J-K: Section 144 relaxed in Kishtwar for...
Army jawan killed as Pak violates ceasef...
Kapil Mishra, AAP women wing chief Richa...
Rains batter Rajasthan resulting in floo...
More...    
 
 Top Stories
Teachers launch rally to back HK yo... 
Archer can 'blow away' teams in Tes... 
Amazon ambassadors flood Twitter wi... 
Calls to boycott 'Mulan' after star... 
Philippe Coutinho set to join Bayer... 
Doctors can help parents talk with ... 
Luis Suarez suffers a right calf in... 
Delhi Police nabs interstate arms s...