Private photos exposed in Instagram hack
Private profiles of Instagram users could be made public as a result of a vulnerability that took almost six months to fix.
The flaw would have enabled hackers to change privacy settings within user profiles to expose potentially sensitive photos to the internet, or to lock down popular pages by marking them as private.
The attack was launched by a malicious phishing link that exploited a Cross Site Request Forgery (CSRF) flaw, a common vulnerability described as "the worst kind of vulnerability [because they are] very easy to exploit by attackers, yet not so intuitively easy to understand for software developers". The flaws occur when websites fail to check that sensitive actions - like changing Instagram privacy settings - were actually sent from the authenticated user; instead, most websites just check that the action came from the user's browser.
