Instagram App Vulnerability Let Hackers to Take Control of Your Account Using Malformed Picture

Researchers detected a critical RCE Instagram vulnerability that allows the threat actors to take control of your Instagram account by sending a simple images to the victim via email, WhatsApp or other media exchange platforms. When the victim opens the Instagram app, the exploitation takes place.

We all know that Instagram is one of the most widespread social networks in the world, as it has more than 100 million photos uploaded daily, and almost 1 billion monthly active users. That’s why, for the threat actors, Instagram is one of the most lucrative targets. 

However, the Check Point researchers revealed all the details regarding this critical vulnerability in Instagram’s Android and iOS app that could have enabled the remote attackers to take control over a targeted device by transferring a specially crafted image to the victims.

Discovery

A crucial vulnerability that might enable the threat actors is technically assigned to remote code execution (RCE). This kind of exposure can allow the threat actors to implement any operation they wish to implement in the Instagram app. 

We all know that the Instagram app has extensive acceptance, enabling the threat actors to immediately turn the victim’s phones into a whole spying tool – placing the privacy of millions of users at high risk.

Custom third-party code integration

The experts asserted that the vulnerability is a packet of buffer overflow (CVE-2020-1895) befalling when Instagram decided to upload a more comprehensive image considering it to be smaller. However, Facebook has fixed the problem in springtime, following the compelled disclosure from cybersecurity company Check Point, and issued a hazy security announcement for it.

Gal Elbaz from Check Point highlights how a custom implementation of third-party code on Instagram could have directed to a dangerous, remote code execution uncertainties.

But the weak point in this procedure is that the hardcoded consistent value that Instagram developers attached while combining Mozjpeg. It’s an open-source JPEG encoder that Mozilla branch from ​libjpeg-turbo for better concentration of JPEG images.

Skills to exploit the glitch

A possible situation from the threat actors with skills to exploit the glitch are mentioned below:-

• Send an ill-disposed image to the victims via email, WhatsApp, SMS, or another messaging service.
• In case the user saves the image and opens the Instagram app, then the bug exploitation will starts, providing the threat actor full access to the target’s phone for remote takeover.
• Exploitation could also be utilized to break the victim’s Instagram app frequently unless it is removed and reinstalled.

Mitigations

Mitigations that are to be followed by the users to keep themselves safe and secure:-

• Always remember to update your mobile application regularly, as well as your mobile operating system.
• Give better thought to those applications which are asking for permission.
• Think twice regarding the approvals, and take a few seconds to consider before you allow anything.

Security experts are still investigating this whole matter and affirmed that they would provide every detail regarding this vulnerability. Till then, they requested all the users to perform every mitigation that they have provided, as it will help the users to keep themselves safe and secure.

You can follow us on Linkedin, Twitter, Facebook for daily Cyber security and hacking news updates.

Also Read:

MFA Bypass Bugs Would Allows Hackers to Access Office 365 Accounts

New Raccoon Attack Allow Hackers to Break SSL/TLS Encryption

BLURtooth – Bluetooth Vulnerability Let Hackers Perform Man-in-the-Middle Attacks in Billions of Devices