Threat actors compromised multiple high-profile Instagram accounts last week by simply asking Meta’s AI-powered account recovery assistant to hand them over.
The attackers exploited a logic flaw in the AI assistant, a classic ‘confused deputy’ issue, to have their own email addresses linked to the targeted accounts and take them over.
Confused deputy weaknesses have been known to security researchers for decades and involve tricking a deputy that has elevated privileges into performing specific actions on the attacker’s behalf.
In this case, the Meta AI assistant had API access to account management systems, being deployed to help users re-link email addresses, reset passwords, and verify they are the owners of specific accounts.
Due to the logic flaw, hackers were able to simply ask the chatbot to link a targeted account to a new email address, under the pretense that they had been hacked or that they had lost access to the previously linked email address.
To bypass Meta’s fraud detection protections, they used VPNs to appear as if they were in the target’s geographic location.
The AI assistant happily linked the new email address and then sent a code that allowed the attackers to reset the password for the targeted account, locking the rightful owner out.
In the event that the chatbot asked for a selfie to verify account ownership, the attackers reportedly modified victims’ photos using AI tools and submitted the altered images.
Inexplicably, the attack also bypassed two-factor authentication (2FA) protections for the targeted accounts, and some victims say they were never notified of the password reset attempts.
Hundreds of high-profile accounts were reportedly compromised and immediately sold on the dark web. Some miscreants were seen sharing videos and instructions on how the account takeover is performed.
Using the trick, the hackers gained access to the Obama White House handle and to the accounts of Sephora and John Bentivegna, the Chief Master Sergeant of the Space Force.
Instagram parent company Meta has resolved the issue, and the exploit no longer works, but it’s unclear how many accounts might have been affected. SecurityWeek has emailed the company for a statement and will update this article if it responds.
“This is a great illustration of why AI agent authorization is the harder, and more critical, problem than authentication. Meta’s bot verified nothing about who was asking; it just helpfully did what it was told to do, up to and including sending the attacker a confirmation code to make sure the new email address was valid. The industry is pretty focused on keeping AI from saying bad things. That’s fine, as long as we don’t completely overlook whether AI should be allowed to do what it’s trying to do,” FusionAuth senior director Dan Moore commented.
Related: As the Pentagon Pushes for Battlefield AI, Some Military Leaders Urge Caution
Related: Researcher Discovers 4th WhatsApp View Once Bypass; Meta Won’t Patch
Related: McDonald’s Chatbot Recruitment Platform Exposed 64 Million Job Applications
Related: Pro-Iranian Hacking Group Claims Credit for Hack of FBI Director Kash Patel’s Personal Account
https://www.securityweek.com/meta-ai-hands-over-high-profile-instagram-accounts-to-hackers/
