How I hacked Instagram to see private photos

Re:How I hacked Instagram to see private photos by badman_ting on Monday February 10, 2014 @01:40PM (#7212786)

Does checking the UA string offer much security? I've always been under the impression that it's essentially user input and not to be trusted. But yeah, that is a pretty nasty CSRF. Good post, thanks.

[ Parent | on HN ]

Re:How I hacked Instagram to see private photos by phr0nak on Monday February 10, 2014 @01:52PM (#7212873)

As you said, checking the User-Agent does not offer much security, but at this point, is more than nothing. I know that Instagram team are studying other ways (csrftoken among others) to protect their website or application against this kind of attacks. Thanks.

[ Parent | on HN ]

Re:How I hacked Instagram to see private photos by meritt on Monday February 10, 2014 @01:47PM (#7212830)

For a CSRF attack it actually does because it needs to be executed inside an unsuspecting victim's browser. That wouldn't be sending an custom Instagram user-agent.

[ Parent | on HN ]

Re:How I hacked Instagram to see private photos by dcaunt on Monday February 10, 2014 @01:46PM (#7212827)

You're right, it's not an absolute fix.

It would have prevented requests from an authenticated browser (without a mobile UA) from being accepted, reducing the effectiveness of the attack.

[ Parent | on HN ]