Instagram's Million Dollar Bug (2015)

Re:Instagram's Million Dollar Bug (2015) by KMag on Monday December 14, 2020 @10:14PM (#25426541)

If *.instagram.com keypair is the TLS certificate keypair, then they could MITM Instagram. They'd probably need to physically stalk some Instagram employees, but getting the TLS certificate key pair would be the difficult part.

On a related note, what do MS Windows/OSX/Android/iOS/Linux do when they see a WiFi AP with an SSID (and maybe even MAC) they recognize, with a WPA2 key they know, operating without encryption? Will they still auto-connect in the clear? In other words, if an attacker cloned the SSID of someone's work/home network, with a strong enough signal, could they trick devices into auto-connecting to an unencrypted AP?

[ Parent | on HN ]

Re:Instagram's Million Dollar Bug (2015) by benjaminberlin on Tuesday December 15, 2020 @10:25PM (#25438695)

People do this with public WiFi - for example, set up at Starbucks with a duplicated SSID, wait for target to connect and route it through as if it were connected to the real Starbucks WiFi, all the while monitoring in the middle.

[ Parent | on HN ]

Re:Instagram's Million Dollar Bug (2015) by heavenlyblue on Wednesday December 16, 2020 @05:05AM (#25440828)

And what do they do with it? Set up a global worldwide network of agents extorting money from people sending dick pics over Instagram?

[ Parent | on HN ]