What you need to know
- The flaw made Instagram users contact info available through the source code on the website.
- It was first reported in February and patched by March, but evidence shows it had been present since at least last October.
- The info could have been easily used to create a database and it is possible it already was by an Indian marketing company called Chtrbox.
Bad news for users of Instagram, as apparently the site has been leaking the phone numbers and email addresses of its users for the last few months.
Back in February, data scientist David Stier notified Instagram when he discovered the site was showing some user's contact info in the source code. While the information wasn't showing directly on profiles, having it displayed in the source code on the user's page would still make it easy for someone to scrape the info and build a database.
The problem was fixed by March, but by then it may have already been too late. During Stier's investigation, he found that this flaw had been present since at least last October while viewing archived versions of the website. That's more than enough time for this to have been discovered and exploited.
In fact, just recently it was revealed that a database with the contact info for millions of Instagram influencers had been created. The database was eventually traced back to an Indian marketing company called Chtrbox, who had been storing it online unencrypted where anyone could access it.
This very flaw could be responsible for the creation of that database. Chtrbox later pulled the database offline and said it was only accessible for 72 hours.
The new Instagram bug is the latest in security fails when it comes to services owned by Facebook. Just last week it was uncovered that WhatsApp had a flaw allowing spyware to be installed with nothing more than a phone call.
With data thieves always on the lookout to collect more information, lapses in security such as this put us all at risk. After every new leak, it gives hackers more info to compile into databases which can later be used for identity theft.
