Chennai Techie Wins $10,000 After Finding Flaw in Instagram

He showed that this vulnerability can be exploited to hack Instagram accounts

facebook, social media
Facebook, Messenger and Instagram apps are displayed on an iPhone, March 13, 2019, in New York. VOA

Barely a month after winning $30,000 from Facebook for spotting a flaw in Instagram, Chennai-based security researcher Laxman Muthiyah on Monday said he again discovered a new account takeover vulnerability on the photo and video-sharing app. This time he has won $10,000 as part of the social network’s bug bounty programme.

The new vulnerability that Muthiyah spotted was similar to the one he reported in July and allowed anyone to hack Instagram accounts without consent permission.

Facebook has now fixed the vulnerability that Muthiyah reported.

“Facebook and Instagram security team fixed the issue and rewarded me $10000 as a part of their bounty programme,” Muthiyah said in a blog post.

facebook privacy
FILE – The Instagram icon is displayed on a mobile screen in Los Angeles. VOA

Muthiyah found that the same device ID – the unique identifier used by Instagram server to validate password reset codes – can be used to request multiple pass codes of different users.

Also Read: Tech Giant Microsoft to Pay Hackers for Bug Bounty Programme

He showed that this vulnerability can be exploited to hack Instagram accounts.

“You identified insufficient protections on a recovery endpoint, allowing an attacker to generate numerous valid nonces to ten attempt recovery,” Facebook said in a letter to Muthiyah. (IANS)

LEAVE A REPLY

Please enter your comment!
Please enter your name here