Instagram is one of the most popular social media apps, with more than 200 million users and a relatively solid track record when it comes to vulnerabilities. However, according to Threatpost, security researcher David Sopas of WebSegura has discovered a potentially massive hole in the Instagram application programming interface (API) — and so far, the picture-sharing site doesn’t seem keen on fixing the issue.

Reflected Dangers of Instagram API

According to Sopas, Instagram’s problem stems from a new attack technique called the reflected file download (RFD). First identified by Oren Hafif of Trustwave SpiderLabs, RFDs allow malicious actors to create links that make it appear that files are being hosted by trusted domains, such as Google, Bing or Instagram. In fact, response content in the form of malicious files are created on the fly by Web browsers. The result is malware downloads that require no uploads. For this type of attack to work, the three following elements must be present:

• Some user input must be “reflected” to create the response content.
• The URL or API of the site being used must accept additional commands.
• Downloadable files must be created on the fly.

Finding Focus

So how does this apply to the Instagram API? Sopas said the site’s programming interface can be modified by entering a batch command in the “bio” field, which fills the role of persistent reflected content. The only caveat? Attackers need a token to start the process, which can be easily obtained by creating a new account. Using Chrome, Opera, Chrome for Android — the Android stock browser — and, in some cases, Firefox, Sopas was able to generate an email link that appears to point to a legitimate Instagram domain. In fact, it takes users to an attacker-controlled Web page.

As far as Sopas is concerned, “RFD is very dangerous, and combined with other attacks like phishing or spam, it could lead to massive damage.”

Instagram’s response? Not much. A spokesperson said the RFD issue discovered by Sopas doesn’t fall under the company’s bug bounty program because it “excludes reports which have no practical security implications, as well as social engineering techniques that require significant interaction from the victim.”

In other words, the social site sees this problem as an unlikely circumstance that demands work from both malicious actors and victims. However, in the event of a successful RFD attack that also leverages a targeted phishing campaign, a host of fake download links crop up that cannot be differentiated from the real thing. While users are always best to avoid clicking any in-email links, this type of masking technique could easily fool even savvy technophiles. Without the need to upload any malware to initiate the download process, catching the culprits will be no easy task.

The big picture? Instagram’s API has a flaw, and so far, there’s no fix. Security researchers say it poses a large risk, while the company considers it a minor irritant. With RFD poised to make significant inroads as a new attack vector, however, a new best practice emerges: Carefully filter all email for the mark of duplicitous domains.

Image Source: Flickr