September 24, 2020

Instagram for Android Vulnerabilities

Entry Type
Security Guidance
Platform(s) Affected
Android
Threat Type
Vulnerability
Platform(s) Affected
Security Guidance
Android
Vulnerability

Lookout Coverage and Recommendation for Admins

Lookout will detect outdated versions of Instagram for Android as part of its default policy that alerts a user if an app on their device has an exploitable vulnerability. The admin can customize the policy to set a risk level and response that align with their organization’s security policies.

If the admin chooses to alert devices, end users with vulnerable versions of the app will receive an alert from Lookout with instructions on how to update the app. The admin can also choose to block access to certain corporate domains or the internet altogether until the issue has been resolved.

Overview

A vulnerability in the Android version of Instagram was recently discovered in versions prior to 120.0.0.26.128. In the affected versions, there is a vulnerability in the way Instagram processes images using “Mozjpeg”, an open source tool used to decode JPEG images that are uploaded to its platform.

By exploiting this vulnerability, the attacker can take control of any function or permission Instagram has been granted by the user. For example, the attacker could control the device’s microphone and camera or gain access to other data on the device that Instagram has permission to access. To commence an attack, the threat actor simply needs to send the target a malicious image, which could be through email, SMS, a 3rd-party messaging app, or another social media platform. If the target opens the malicious image in Instagram, the malicious code behind it is executed and the threat actor now has control of the target’s Instagram app.

Lookout Analysis

In order for this attack to be successful, the victim needs to have a vulnerable version of Instagram installed, save the malicious image to the device, and then open it in Instagram. Since the malicious image can be delivered to the device in so many ways, a threat actor may be able to easily use social engineering to convince the target to upload the image. One particularly large risk is that many users automatically save images from WhatsApp, which takes the attacker one step closer to a successful attempt.

Once the attacker has control of Instagram’s functionality, they could pose a massive security risk to the individual as well as the organization they work for if they choose to take control of the microphone and access data such as photos and contacts.

Lookout Coverage and Recommendation for Admins

Lookout will detect outdated versions of Instagram for Android as part of its default policy that alerts a user if an app on their device has an exploitable vulnerability. The admin can customize the policy to set a risk level and response that align with their organization’s security policies.

If the admin chooses to alert devices, end users with vulnerable versions of the app will receive an alert from Lookout with instructions on how to update the app. The admin can also choose to block access to certain corporate domains or the internet altogether until the issue has been resolved.

Colleagues standing in an open meeting area and sharing a humorous moment

Stop Cyberattacks Before They Start With Industry-Leading Threat Intelligence.

Other Related Threats

New

September 22, 2023

iOS 16.6.1 and iOS 17.0

Apple recently released two software updates for iOS and iPad OS for vulnerabilities that can form an exploit chain and are also known to install Predator spyware.

September 15, 2023

Scattered Spider

September 19, 2023

CVE-2023-4863