(miss.cabul via Shutterstock)
Meta’s own AI support chatbot apparently helped hackers take over several Instagram accounts using a simple technique.
Over the weekend, apparent pro-Iranian hackers were able to hijack the official Instagram accounts for Barack Obama’s White House, beauty product retailer Sephora and the Chief Master Sergeant for the US Space Force.
Instagram’s parent, Meta, has since booted out the hackers. But videos have been circulating on the messaging app Telegram that allegedly show the company’s own support chatbot played a key role in enabling the account access.
An explanation attached to one of the videos says an attacker needs to connect to Instagram’s login page using an IP address based in the same region as the account they wish to take over. This can be accomplished using a VPN. The attacker must then click “forgot password” and type in the username for the targeted account. A button to access Meta’s AI support bot called “Get Support" can appear.
(Telegram)The chatbot will then offer three options to initiate a password reset, which normally involves sending the reset code to the legitimate owner's email account or phone number. But rather than selecting the options, the explanation indicates you can type in a prompt that simply requests the chatbot to send the password reset code to the attacker's own email address.
It can take more than one try to exploit the flaw, but the video shows Meta’s chatbot eventually sending the password reset code to the desired email address, thus bypassing the password protection. The received 8-digit reset code can then be entered into Meta’s chatbot to create a new password for the targeted Instagram account.
For now, Meta has only officially said: “This issue has been resolved and we are securing impacted accounts." Still, the incident seems to highlight how AI support chatbots can introduce vulnerabilities into online systems, especially if they’re given privileges to change account settings. 404Media also uncovered signs that the exploit technique may have been around for months since at least March.
Whether the flaw could hijack accounts protected by two-factor authentication isn't entirely clear. We've spotted some users on Telegram saying they couldn't use the exploit on 2FA accounts. But at least a few users report losing their account to the hackers despite the multi-factor protection in place.
Despite's Meta's statement, at least a few users also say they're struggling to reclaim their hacked accounts after the exploit technique was widely revealed over the weekend. In the meantime, concerned Instagram users can consider turning the 2FA setting on to help ward off potential hijackings.