{"id":84526,"date":"2018-12-04T09:28:16","date_gmt":"2018-12-04T17:28:16","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=84526"},"modified":"2019-05-03T20:01:14","modified_gmt":"2019-05-04T03:01:14","slug":"did-instagram-leak-your-password","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/did-instagram-leak-your-password\/","title":{"rendered":"Did Instagram leak your password?"},"content":{"rendered":"

\"Instagram<\/p>\n

Back in April, Instagram introduced a data export feature to comply with the General Data Protection Regulation (GDPR), a regulation in European Union law intended to protect citizens’ privacy.<\/p>\n

But, in an ironic twist, the way in which Instagram implemented its data export feature inadvertently leaked some users’ passwords. The Facebook subsidiary\u00a0notified affected users via e-mail in November.<\/p>\n

What Happened?<\/h3>\n

\"Downloads<\/p>\n

Instagram’s “Download Your Data” feature worked correctly if a user clicked on the Submit button after entering their password.<\/p>\n

However, if the user had instead pressed the Return or Enter key to submit their password, the site reportedly put the user’s password in plaintext in the URL of the resulting page. That’s a bad thing, because it means that in some very specific circumstances, it may have been possible for unauthorized parties to discover affected users’ passwords.<\/p>\n

Instagram has since fixed the bug, so it’s safe to use the Download Your Data feature now.<\/p>\n

Who Had Access to\u00a0Leaked Passwords?<\/h3>\n

\"GuyInstagram’s server logs unintentionally collected these passwords in plaintext, so the company is reportedly deleting any passwords found in those logs.<\/p>\n

Neither Instagram nor its parent company Facebook have responded to our inquiries about who may have had access to the affected logs or whether the log sanitization has been completed.<\/p>\n

Historically it was much worse for a password to be found in a URL because it meant that any “man in the middle” (anyone in between your browser and the server to which\u00a0you are connecting) could see the complete address. But now that most sites use HTTPS, only the domains\u2014for example, instagram.com\u2014are visible to in-between parties, not the full URLs.<\/p>\n

Well, at least that’s true in most cases. If you or someone with access to your device has installed a special root certificate authority and configured your system to always trust it, then a man in the middle (MITM) who possesses the matching private key could even potentially see complete HTTPS URLs you’ve accessed.<\/p>\n

\"\"<\/p>\n

Example of an explicitly trusted, non-default root CA<\/p>\n

The practice of leveraging an MITM certificate is common on enterprise or school networks for the purposes of monitoring employee or student activity. If a victim of the Instagram bug had such a certificate installed, then it’s possible that their password may have been stored in plaintext in their organization’s Web filter logs too.<\/p>\n

\"Malware
\nMalware like OSX\/MaMi<\/a> can also engage in MITM attacks.<\/p>\n

Of course, anyone with direct access to a victim’s device could also search the browser history to look for Instagram URLs that may contain a password. If you were unfortunate enough to have used a publicly shared computer to download your Instagram data, anyone who used the computer after you could have\u00a0gotten your password unless you remembered to delete your browsing data. (For this and a plethora of other reasons, users should avoid logging into any accounts\u00a0when using public kiosks at\u00a0places like hotels, libraries, labs or Internet caf\u00e9s.)<\/p>\n

How Many Users Were Affected?<\/h3>\n

An Instagram spokesperson has stated that “a very small number of people” were affected by the bug, which was “discovered internally”\u2014in other words, not\u00a0reported to Instagram by a third party. Thus it\u00a0seems plausible that very few people outside of Instagram were aware of the bug until after\u00a0Instagram’s\u00a0disclosure to affected users.<\/p>\n

What To Do If You Might Have Been Affected<\/h3>\n

\"ChangeIf you’re not sure whether your Instagram account was\u00a0affected, check your e-mail; you should have received notification from Instagram around November 15. If you didn’t receive an e-mail but you did use the data export feature before that date, it wouldn’t hurt to change your Instagram password and delete your browser history just to be safe. If you’ve used the same password on other sites, you’ll want to change\u00a0your password\u00a0elsewhere too and avoid reusing passwords across multiple sites in the future.<\/p>\n

How\u00a0Can I Learn More?<\/h3>\n

\"\"<\/a>We discussed this topic on episode 59<\/a>\u00a0of the Intego Mac Podcast<\/strong>. Each week we\u00a0bring you engaging discussion of\u00a0the latest Apple security news, so be sure to subscribe<\/a> to the podcast to ensure you don’t miss any episodes. You’ll also want to subscribe to our e-mail newsletter<\/strong> and keep an eye here on The Mac Security Blog<\/strong> for updates.<\/p>\n

For a few additional details on this Instagram bug, you can refer to articles by Sarah Kuranda and Reed Albergotti<\/a> and Lisa Vaas<\/a>.<\/p>\n

CloudGuard root CA screenshot credit: Patrick Wardle<\/a>. Man in the middle diagram image credit:\u00a0Nasanbuyn<\/a>\u00a0(CC BY-SA 4.0<\/a>) and Apple<\/a>;\u00a0modified by\u00a0Joshua Long. Girl holding CHANGE YOUR PASSWORD sign based on\u00a0image by\u00a0Kasuga~enwiki<\/a>\u00a0(CC BY-SA 3.0<\/a>).<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Back in April, Instagram introduced a data export feature to comply with the General Data Protection Regulation (GDPR), a regulation in European Union law intended to protect citizens’ privacy. But, in an ironic twist, the way in which Instagram implemented its data export feature inadvertently leaked some users’ passwords. The Facebook subsidiary\u00a0notified affected users via […]<\/p>\n","protected":false},"author":14,"featured_media":84541,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[13],"tags":[43,53,1834,96,106],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\n\t\n\t\n\t\n