>>"All it takes is one sufficiently skilled person to release a tool so simple even a script kiddie can use it"
And that's why this was made :-)... http://en.wikipedia.org/wiki/Firesheep
Maybe you should contribute instagram-sniffing to it :) https://github.com/codebutler/firesheep
Thanks, I referenced Firesheep in the grandparent. FS is currently very broken. I still couldn't get it to work after downloading the source and making some changes. The OS X API used by FS has long been deprecated and simply doesn't work on Mavericks. If there is enough interest I will write "Instasheep" this evening.
Re:Instagram iOS session hijack
by codebutler on Monday July 28, 2014 @04:14PM
(#8099082)
Hi, I'm the author of Firesheep. The code in git master should work with recent versions of Firefox, but there is an issue when running on recent versions of OS X related to elevating privileges. If you manually setuid the firesheep-backend binary, it might work. Let me know if you're interested in helping to fix this! Writing a handler for this Instagram vulnerability should be trivial.
Re:Instagram iOS session hijack
by donfrancisco on Tuesday July 29, 2014 @12:34AM
(#8100691)
Got the instasheep domain name if you want me to point it at a github repo.
Re:Instagram iOS session hijack
by tansou_471ss on Sunday August 03, 2014 @08:59AM
(#8127796)
#1380asal
#pinar_mg
Re:Instagram iOS session hijack
by tansou_471ss on Sunday August 03, 2014 @08:51AM
(#8127785)
#1380asal
Re:Instagram iOS session hijack
by tansou_471ss on Sunday August 03, 2014 @09:00AM
(#8127797)
salam
"Hi Stevie,
This issue has been reported some already so unfortunately cannot reward you, instagram is working to get https for all endpoints. Its a pretty high barrier to exploitation to already sniffing someones traffic however.
Thanks,
name removed
Security
Facebook"
And here I am sitting in the Apple Store around the corner from my apartment watching various cookies whizz past my screen.
I don't agree the barrier to exploit is high. All it takes is one sufficiently skilled person to release a tool so simple even a script kiddie can use it. At that point Pandora's Box has been blown apart. The obvious precedent for this is Firesheep (now sadly not functional) from back in 2010.