Security Experts On Instagram bug lets hackers ‘snoop on you through your phone’ by sending a single image file

Security researchers at Check Point published research today, identifying a Remote Control Execution (RCE) vulnerability in Instagram. The attacker would only need a single, malicious image to execute the attack. Check Point researchers summarised the attack method to three steps:

  1. The attacker sends an image to a target victim’s email, WhatsApp or other media exchange platform.
  2. The picture is saved to the user’s mobile phone. This is can be done automatically or manually depending on the sending method, the mobile phone type, and configuration. A picture sent via WhatsApp for example will be saved to the phone automatically by default on all platforms.
  3. The victim opens the Instagram app, triggering the exploitation, giving the attacker full access for remote takeover

In effect, the vulnerability gives the attacker full control over the Instagram app and turns it into a spy tool with the power to create actions on behalf of the user: reading all direct messages on the Instagram account, deleting, or posting photos at will, manipulating account profile details. Since the Instagram application is known to have extensive permissions that are gateways to features and functionality on one’s phone, an attacker could use the vulnerability to access phone contacts, location data, phone cameras, and files stored on the device, turning the phone into a perfect spying tool. At the most basic level, the exploitation could be used to crash a user’s Instagram app, denying them access to the app until they delete it from their device and re-install it, causing inconvenience and possible loss of data.

Research details:

Chris Hauk, Consumer Privacy Champion,  Pixel Privacy
September 26, 2020
Users need to keep the apps on their mobile devices and computer up to date.
This flaw could have turned the user's device into a tool that could've been used to spy on them. Perhaps the worst possibility is that it could've been used to ruin the reputations of Instagram users, via the manipulation of a user's Instagram profile. Happily, the security hole was plugged after Instagram owner Facebook was notified of the flaw. Even though the flaw was patched, it underscores ....
[Read More >>]
Tim Erlin, VP of Product Management and Strategy ,  Tripwire
September 26, 2020
The more these apps are integrated into business and daily life, the more critical they become.
We might think of social media apps as frivolous, but the more these apps are integrated into business and daily life, the more critical they become. Social media, including Instagram, are conduits for news and information. They’re also conduits to personal information stored on mobile devices. Targeted takeover of high profile accounts is one possibility, but in this age of disinformation camp ....
[Read More >>]
Tim Mackey, Principal Security Strategist,  Synopsys CyRC
September 26, 2020
Any abnormal behavior during these tests should be treated with the same level of priority.
Consumers expect that the processing of photos and images in their apps will be fast and flexible. Apps like Instagram and web browsers like Firefox are called upon to process this image data on a constant basis. Because there are so many different formats for image data, and the images themselves originate from untrusted sources like ad-networks or random strangers, care must be taken to ensure t ....
[Read More >>]
Jake Moore, Cybersecurity Specialist,  ESET
September 25, 2020
There is always a risk when you give up any level of access control.
Allowing permissions in apps is something most people don’t tend to think twice about, but the truth is that there is always a risk when you give up any level of access control. Where possible, it remains safer to disable all app permissions, like the ability for apps to save photos to the device, access the camera, and use the microphone. Privacy and security starts by holding back on those per ....
[Read More >>]
Jayant Shukla, CTO and Co-Founder,  K2 Cyber Security
September 25, 2020
Open source code is as likely to have vulnerabilities as any other code.
This latest discovered vulnerability in Instagram has many important lessons for enterprise security. First, the flaw is a Remote Code Execution (RCE) vulnerability, one of the most dangerous vulnerabilities because it gives the cybercriminal the ability to run arbitrary code on the exploited system. As such, it should be high on the list of vulnerabilities that are tested for in applications dev ....
[Read More >>]

If you are an expert on this topic:

Submit Your Expert Comments

In this article