He Sent 200,000 Reset Codes to Instagram in 10 Minutes. Instagram Paid Him $30,000.

Summary

Member-only story He Sent 200,000 Reset Codes to Instagram in 10 Minutes. Instagram Paid Him $30, 000. Q u i c kn o t e — I b u i lt [H a c k T h ro ug h] . I tt u r n sre a l b ug b o u n t y w r i t e u p s in t o in t er a c t i v es t e p - b y - s t e p c ha ll e n g es . T hi s b ug i so n t h ere . G o pl a y i t in s t e a d o f j u s t re a d in g i f t ha t so u n d s in t eres t in g . M os t d e v e l o p ers a ss u m e t ha t i f yo u p u t a 6 - d i g i tOTP b e hin d a r a t e l imi t er, b r u t e f orce i s d e a d . Y o u ha v e 1, 000, 000 p oss ib l eco mbina t i o n s . T h eco d ee x p i res in 10 min u t es . I f so m eo n e t y p es t h e w ro n g co d e 5 t im es, yo u l oc k t h e m o u t f or anh o u r . P ro b l e m so l v e d . T ha t ’ s t h e t h eory . I n p r a c t i ce, co n c u rre n cy an dd i s t r ib u t e d in f r a s t r u c t u re mak er a t e l imi t in g o n eo f t h e ha r d es tt hin g s t o g e t r i g h t a t sc a l e . I n 2019, sec u r i t yrese a rc h er L a x man M u t hi y ah l oo k e d a t I n s t a g r am ’ s p a ss w or d rese t e n d p o in t an df o u n d tw o l o g i c b l in d s p o t s . B yc hainin g t h e m t o g e t h er, h e p ro v e d h eco u l d rese tt h e p a ss w or d o nan y I n s t a g r ama cco u n t in u n d er 10 min u t es f or ab o u t$ 150 in cloud compute. Facebook acknowledged the critical severity and paid him $30,000. Here’s the breakdown of how he did it, why the rate limiter broke, and what backend engineers keep getting wrong about OTP verification.

By Vivek PS

Original Article

Fast Feed

He Sent 200,000 Reset Codes to Instagram in 10 Minutes. Instagram Paid Him $30,000.

Summary

By Vivek PS

Backlinks