News for hackers. Stuff that matters.
Re:How I Could Have Hacked Any Instagram Account by degenerate on Thursday July 18, 2019 @10:30AM (#20470161)
I spot-checked some of those IPs in the video, and it appears all of them are on Amazon. So, what does the attacker's stack look like? Is it a bunch of servers running PHP and listening for a connection to run curl? Or Lambda functions configured to proxy the connection attempt to IG? Curious how much effort goes into setting up an attack like this. It's surprising (to me) that so many IPs can be used for so little money.
Re:How I Could Have Hacked Any Instagram Account by ikeboy on Thursday July 18, 2019 @11:20AM (#20470726)
I've done scraping distributed over many IPs. I used luminati, bought X IPs, ran a bash script to download all IPs to a file, read the file in from python and spit out a new thread for each IP. Just used as a proxy, all activity was controlled by a single server.

Re Amazon, I've done that too and the way it works is you start up an EC2 instance that does the work and sends back info. In my case I sent the info to an S3 bucket and then pulled all the info from that bucket elsewhere once all the machines finished. Ultimately you pay for what you use, and if you only use an hour across a ton of machines and use the cheapest machine it's pretty cheap.

FYI: luminati will give you unlimited bandwidth for like $1/IP/month.

Re:How I Could Have Hacked Any Instagram Account by notduncansmith on Thursday July 18, 2019 @11:51AM (#20471074)
Worth noting that price is for datacenter IPs - residential ones are much more expensive and I’ve heard that IG is rejecting more datacenter traffic as of late.
Re:How I Could Have Hacked Any Instagram Account by ikeboy on Thursday July 18, 2019 @12:02PM (#20471175)
If you get exclusive datacenter IPs it's much less likely to be rejected and it's not significantly more expensive.
Re:How I Could Have Hacked Any Instagram Account by mtrovo on Thursday July 18, 2019 @12:23PM (#20471398)
Is this the company that offers a free VPN extension and pays for it selling those people machines bandwidth? I always thought their business model is way too shady to be legal.
Re:How I Could Have Hacked Any Instagram Account by ikeboy on Thursday July 18, 2019 @12:40PM (#20471546)
They sold a majority stake at a valuation of $200MM and it's now a separate company from the one that runs the VPN.
Re:How I Could Have Hacked Any Instagram Account by dylz on Thursday July 18, 2019 @12:39PM (#20471544)
Yeah. There's been numerous cases of people just grabbing a stolen credit card and getting a botnet to attack sites with.
Re:How I Could Have Hacked Any Instagram Account by stibba on Thursday July 18, 2019 @10:52AM (#20470420)
I'm curious too, how would he set up so many machines that do the same thing?
Re:How I Could Have Hacked Any Instagram Account by shawabawa3 on Thursday July 18, 2019 @12:12PM (#20471287)
It's very easy to terraform 1000 nano machines on ec2, as he said it wouldn't be expensive at all. In fact, he estimates $150, but for 1000 nano machines for 10 minutes i believe it's under a dollar. Possibly nano machines aren't powerful enough to spam the verify endpoint enough
Re:How I Could Have Hacked Any Instagram Account by flatiron on Thursday July 18, 2019 @12:39PM (#20471540)
200 curls can be ran from any ec2 instance. there is literally no overhead.

personally i would spin up a million lambda functions and just see what happens. each one def wouldn't get its own ip but maybe you would have good coverage?

Re:How I Could Have Hacked Any Instagram Account by fredsted on Thursday July 18, 2019 @01:42PM (#20472184)
Wouldn't you be hitting EC2 limits pretty quickly though? I guess you could get them raised, but last time AWS wanted a valid reason.
Re:How I Could Have Hacked Any Instagram Account by shawabawa3 on Friday July 19, 2019 @07:00AM (#20477561)
> but last time AWS wanted a valid reason.

Yep - my reason is normally "I'm planning a project that needs more instances"

I doubt they even look at that field to be honest

Re:How I Could Have Hacked Any Instagram Account by merb on Thursday July 18, 2019 @06:41PM (#20474659)
"load testing my website INSERT_VALID_WEBSITE_LINK"
Re:How I Could Have Hacked Any Instagram Account by natrik on Thursday July 18, 2019 @11:04AM (#20470544)
Re:How I Could Have Hacked Any Instagram Account by ttsda on Thursday July 18, 2019 @11:24AM (#20470786)
The author said in the post comments that he used 1000 EC2 instances.
Re:How I Could Have Hacked Any Instagram Account by laumars on Thursday July 18, 2019 @11:04AM (#20470550)
He's probably lambda rather than EC2 or even docker but I'd be interested to know the details too.
Re:How I Could Have Hacked Any Instagram Account by ldoughty on Thursday July 18, 2019 @12:10PM (#20471263)
Docker doesn't help distribute requests over IPs, lambda or ec2 most likely.

You can easily set up a launch configuration for EC2 that runs a script or program... But with a bit more work lambda will save a lot of money

Re:How I Could Have Hacked Any Instagram Account by laumars on Friday July 19, 2019 @06:08AM (#20477353)
> Docker doesn't help distribute requests over IPs

That depends on your orchestration. AWS provide several tools for running Docker without having to maintain your own EC2 hosts.

> You can easily set up a launch configuration for EC2 that runs a script or program... But with a bit more work lambda will save a lot of money

You could do that via a launch configuration but that would be a pretty naff way of doing it. Baked AMI would be easier but personally I'd prefer ECS (Docker) or lambda. Cheaper, quicker to deploy, lower ramp up times.

Ultimately though, there's no wrong way to do this - just personal preference.